Alice in Supply Chains - The Podcast!

Episode 21

In this episode of the Alice in Supply Chains Podcast, Adrian Sanabria and Alexandre Sieira discuss four stories shaping third-party cyber risk management - from a BGP hijacking that compromised software updates to emerging AI risks, the rise of inside-out scanning in financial institutions, and proposed UK restrictions on risky technology suppliers.

Episode 20 | Recorded Live at Black Hat in Las Vegas!

On episode 20, Adrian and Alexandre discuss four recent stories shaping third-party and AI risk: SOC 2 commitments deferred by vendors, the lessons from Brazil’s PSTI security requirements, AI agents and security incidents involving Hugging Face, OpenAI and Anthropic, and a prompt injection case involving outside counsel in Brazil. The episode explores what these incidents mean for TPCRM, vendor assurance, regulatory compliance, AI governance, and third-party contracts.

Episode 19

Episode 19 of Alice in Supply Chains explores how cyber risk is evolving beyond traditional security concerns and why organizations need to rethink how they measure, manage, and communicate risk. Adrian Sanabria and Alexandre Sieira discuss the latest developments influencing the cybersecurity landscape, from the real financial impact of breaches and emerging software supply chain threats to practical approaches for third-party cyber risk management and the evolving regulatory environment. Whether you're responsible for security, risk, procurement, or compliance, this episode offers valuable insights into the challenges shaping cyber risk management today.

Episode 18

In this month's episode of Alice in Supply Chains, Alexandre Sieira and Adrian Sanabria cut through the AI-hacking hype to focus on the vulnerabilities that are actually driving ransomware and cyber insurance claims: old, unpatched systems and forgotten assets. They also examine the growing dispute between Microsoft and security researchers, npm's new package provenance features as a partial defense against supply chain attacks, and the broader European push for digital sovereignty.

DBIR Bonus Episode with special guest Alex Pinto (Verizon Business)

This special bonus episode of Alice in Supply Chains dives into the newly released Verizon Business Data Breach Investigations Report (DBIR) 2026 and what its findings reveal about today’s evolving cybersecurity landscape.

Episode 17

Episode 17 of the Alice in Supply Chains podcast, with co-hosts Alex Sieira (CTO & Co-founder, Tenchi Security) and Adrian Sanabria (Principal Researcher, The Defenders Initiative), is now live! In this episode, our expert duo deep-dives into the most pressing third-party cyber risk stories from edition 45 of the Alice in Supply Chains Newsletter, exploring how modern cascading breaches are fundamentally changing the defensive landscape.

Bonus episode - with guest John Hammond

In this special bonus episode, Adrian and Alexandre are joined by John Hammond, one of cybersecurity’s most recognizable YouTube creators and Senior Principal Security Researcher at Huntress, a cybersecurity company dedicated to protecting businesses of all sizes against modern-day cybercrime, for a deep dive into software supply chain attacks using the recent Axios NPM compromise as a case study.

Episode 16

In this April 2026 episode of Alice in Supply Chains, Adrian and Alexandre cover three stories that weren't on anyone's 2026 bingo card — and all of which land on the TPRM analyst's desk.

Episode 15

Hosts Adrian Sanabria (The Defenders Initiative) and Alexandre Sieira (CTO, Tenchi Security) reconvene — both recovering from the notorious con crud — to dig into the biggest stories from a packed month in third-party and supply chain security.

Episode 14

The Alice in Supply Chains Podcast is back for another episode! On it, Adrian Sanabria and Alexandre Sieira share their expert opinions on the most pressing matters in the TPCRM world - as presented on issue #42 of our newsletter of the same name, also launched today! From cyber risk at scale in private equity portfolios, to the evolution of TPCRM in the AI era, to real-world regulatory scrutiny following a major education-sector breach in Canada - this discussion connects the dots between headlines and hard accountability. The takeaway? Third-party risk is no longer an operational checkbox. It’s financial exposure. It’s regulatory pressure. It's a board-level strategy. If you’re responsible for security, risk, compliance, or investment decisions, this episode is your pulse check on where the market is moving.

Bonus Episode - Cyber Risk Quantification with Special Guest Tony Martin-Vegue

Episode 13

In this month’s episode, Alexandre Sieira (CTO & Co-Founder, Tenchi Security) and Adrian Sanabria (Principal Researcher, Defenders Initiative) break down what’s really changing in cybersecurity and third-party risk as we head into 2026.

Episode 12

Join ⁠Alexandre Sieira⁠ (CTO & Cofounder, ⁠Tenchi Security⁠) and ⁠Adrian Sanabria ⁠(Principal Researcher, The Defender's Initiative) as they unpack the most relevant stories from our latest Alice in Supply Chains newsletter (issue #40) - and discuss what they mean for third-party cyber risk management. Topics approached on the last podcast of 2025: Trends in supply chain attacks in general, as observed through this year / The Risks of ignoring corporate culture in third-party due diligence / CISOs are losing control of their security outcomes / Cyber insurance

Episode 11

New Episode Alert! The Alice in Supply Chains Podcast #11 is officially live! Join Alexandre Sieira (CTO & Cofounder, Tenchi Security) and Adrian Sanabria (Principal Researcher, The Defender's Initiative) as they unpack the most relevant stories from our latest Alice in Supply Chains newsletter (#39) - and discuss what they mean for third-party cyber risk management.

Episode 10

In this episode, Alexandre Sieira (CTO & Cofounder of Tenchi Security) and Adrian Sanabria (Principal Researcher at The Defender's Initiative) dive into the key themes from newsletter #38, offering expert insights on the latest developments in third-party cyber risk management. They explore whether cybercriminals have become too successful, unpack Jaguar Land Rover’s recent cyber challenges, discuss the true cost of a breach, and explain why effective risk management can’t stop at a company’s borders. Tune in every month for sharp analysis and essential conversations on the evolving landscape of TPCRM.

Episode 9

In this episode, Alexandre Sieira (CTO & Cofounder of Tenchi Security) and Adrian Sanabria (Principal Researcher at The Defender's Initiative) celebrate the 3rd anniversary of the Alice in Supply Chains newsletter - the very starting point for this podcast. Together, they revisit key highlights from issue #37, unpacking the stories shaping today’s supply chain security landscape: -The Salesloft “Perfect One Attack, Use Many” case -Vendors charging customers to complete security questionnaires -New CISA tools for supply chain security -The Sinqia compromise and the HSBC BRL theft Stay tuned, every month, for in-depth insights, expert analysis, and key discussions on TPCRM challenges.

Episode 8

In this episode, Alexandre Sieira, CTO and Cofounder of Tenchi Security, joins Adrian Sanabria, Principal Researcher at The Defender's Initiative, to break down three key stories from issue #36 of the Alice in Supply Chains newsletter. Together, they explore: -How third-party disruptions can derail operations; -The unusual case of Clorox vs. Cognizant; -Why relying on EU cloud regions may not guarantee data sovereignty — and Microsoft’s admission to French customers; Each conversation delivers practical insights into the fast-changing landscape of third-party cyber risk management.

Episode 7

In today’s new episode, Alexandre Sieira, CTO and Cofounder of Tenchi Security, joins Adrian Sanabria, Principal Researcher at The Defender's Initiative, to unpack three critical stories from issue #35 of the Alice in Supply Chains newsletter. They discuss Scattered Spider’s shift toward aviation and transportation targets, the tragic link between a cyberattack and a patient death in the NHS, and the impact of a cyber incident involving a Brazilian tech provider on financial institutions' reserve accounts.

Bonus Episode - The Limitations of SOC 2 with AJ Yawn

In this special bonus episode, Alexandre Sieira, CTO and Co-founder of Tenchi Security, and Adrian Sanabria, Principal Researcher at The Defender's Initiative, sit down with AJ Yawn — Director of GRC Engineering at Aquia, author of GRC Engineering for AWS, and host of CyberTakes. Together, they dive deep into SOC 2 and its uncertain future, unpacking its challenges, limitations, why it became so widely adopted, and where it may be headed next. It’s a timely, insightful conversation for anyone focused on cyber risk management.

Episode 6

Join Alexandre Sieira, CTO and Co-Founder of Tenchi Security, and Adrian Sanabria, Principal Researcher at the Defenders Initiative, as they break down the most important stories from Issue #34 of the Alice in Supply Chains newsletter.

Episode 5

Join Alexandre Sieira, CTO and Co-Founder of Tenchi Security, and Adrian Sanabria, Principal Researcher at the Defenders Initiative, as they break down the most important stories from Issue #33 of the Alice in Supply Chains newsletter. In this episode, the duo explore why EU businesses are increasingly turning away from U.S. cloud providers, key takeaways from the UK ICO’s investigation into the 2022 NHS breach, and what the infamous "Hanoi rat massacre" can teach us about modern risk practices. They also dive into JPMorgan's CISO Pat Opet’s open letter, which calls for stronger SaaS security and takes aim at weak integration models in today’s interconnected systems.

Bonus Episode - DBIR 2025 with Alex Pinto

Verizon’s 2025 Data Breach Investigations Report (DBIR) is out - and one of the top takeaways couldn’t be more clear: third-party risk is rapidly accelerating. This year, breaches involving third parties doubled compared to last year (from 15% to 30%), often driven by vulnerability exploitation and business disruptions. As the report puts it: when a vendor is hosting your data, the best strategy is to focus on how secure and resilient their environment truly is. The DBIR also highlights a shift in how organizations are addressing third-party risk. While traditional risk questionnaires remain part of the equation, the report underscores a growing need for TPCRM solutions that deliver quantifiable, actionable insights — especially those that assess real-world security controls. At Tenchi, that’s exactly where we’re focused: helping organizations achieve continuous, cooperative, and comprehensive visibility into third-party cyber risk.

Episode 4

Alice in Supply Chains is Tenchi Security’s monthly podcast on third-party cyber risk management (TPCRM). Hosted by Alexandre Sieira (CTO and Co-Founder of Tenchi) and Adrian Sanabria (The Defender’s Initiative), it delivers expert insights and practical analysis. In this episode (#32), they cover the Oracle breaches, from denial to lawsuit, and the GitHub Action hack, sharing key lessons learned.

Episode 3

The third episode of our Alice in Supply Chains Podcast is now live! In this edition, third-party cyber risk experts Alexandre Sieira and Adrian Sanabria come together to deliver sharp insights and deep analysis on the latest TPCRM developments — all drawn from issue #31 of our monthly Alice in Supply Chains newsletter, released earlier this week.

Episode 2

The second episode of the Alice in Supply Chains Podcast is now live! On it, two leading voices in third-party cyber risk management, Alexandre Sieira and Adrian Sanabria, come together to provide expert commentary and in-depth analysis on the latest TPCRM news.

Episode 1

Starting this month, Alice in Supply Chains expands beyond the newsletter to bring you exclusive video commentary and expert analysis from two leading voices in third-party cyber risk management: our CTO and Co- Founder, Alexandre Sieira, and The Defender's Initiative Principal Researcher, Adrian Sanabria. Through monthly episodes, the Alice in Supply Chains Podcast will provide interesting discussions and expert takeaways based on the latest news covered by the newsletter itself - offering you an objective analysis to stay informed and ahead on all things related to TPCRM.