Podcast

Alice in Supply Chains - Episode 21

September 15, 2026

Episode description:

In this episode of the Alice in Supply Chains Podcast, Adrian Sanabria and Alexandre Sieira discuss four stories shaping third-party cyber risk management - from a BGP hijacking that compromised software updates to emerging AI risks, the rise of inside-out scanning in financial institutions, and proposed UK restrictions on risky technology suppliers.

Show notes:

- Story one focuses on a wild BGP hijacking incident that compromised updates for a vendor that makes hypervisor management software (Virtualizor by Softaculous). Attackers were able to take over part of hosting company Hetzner’s IP space, create a valid TLS certificate for Softaculous’s website and serve up an identical copy of the website. Softaculous didn’t cryptographically check the integrity of updates, so the attack succeeded in compromising customers.

‍

- In story two, the Financial Stability Board, an organization created by the G20 after the 2008 financial crisis, warns of risks from AI. The risks were twofold: the AI bubble and threats directly from rogue AI agents.

‍

- In story three, Alexandre shares an observation that, at least in Latin America, financial institutions are writing inside-out scanning into their MSAs.

‍

- Finally, in story four, UK politicians propose to amend the Cyber Security and Resilience bill to expand restrictions on tech suppliers seen as ‘risky’. A troubling addition aims to remove transparency at the same time.

‍

Links - for reference:

‍

Show Transcript

Watch or listen to full episodes in English

Recent Episodes

Episode 20 | Recorded Live at Black Hat in Las Vegas!

On episode 20, Adrian and Alexandre discuss four recent stories shaping third-party and AI risk: SOC 2 commitments deferred by vendors, the lessons from Brazil’s PSTI security requirements, AI agents and security incidents involving Hugging Face, OpenAI and Anthropic, and a prompt injection case involving outside counsel in Brazil. The episode explores what these incidents mean for TPCRM, vendor assurance, regulatory compliance, AI governance, and third-party contracts.

Episode 19

Episode 19 of Alice in Supply Chains explores how cyber risk is evolving beyond traditional security concerns and why organizations need to rethink how they measure, manage, and communicate risk. Adrian Sanabria and Alexandre Sieira discuss the latest developments influencing the cybersecurity landscape, from the real financial impact of breaches and emerging software supply chain threats to practical approaches for third-party cyber risk management and the evolving regulatory environment. Whether you're responsible for security, risk, procurement, or compliance, this episode offers valuable insights into the challenges shaping cyber risk management today.

Episode 18

In this month's episode of Alice in Supply Chains, Alexandre Sieira and Adrian Sanabria cut through the AI-hacking hype to focus on the vulnerabilities that are actually driving ransomware and cyber insurance claims: old, unpatched systems and forgotten assets. They also examine the growing dispute between Microsoft and security researchers, npm's new package provenance features as a partial defense against supply chain attacks, and the broader European push for digital sovereignty.