Podcast
Episode Description:
Alice in Supply Chains Episode 22 explores AI security, exposed API keys, and third-party cyber risk with Adrian Sanabria and Alexandre Sieira.
Show Notes:
In Episode 22 of Alice in Supply Chains, hosts Alexandre Sieira and Adrian Sanabria examine third-party cyber risk through AI security incidents, exposed credentials, and the lasting consequences of vendor breaches.
This episode covers:
- Irregular: how a misconfigured third-party testing environment gave AI models unintended internet access, and what the incidents reveal about shared responsibility.
- Labcorp and AMCA: the years-long legal fallout from a supplier’s data breach, even after that supplier went out of business.
- Manchester Airports Group: exposed API credentials, compromised customer data, and the hidden risks of travel providers that sit outside traditional third-party risk programs.
- Open-weight AI models: the security tradeoffs of choosing models and inference infrastructure, including data jurisdiction, model provenance, and data poisoning.
- AI for classification and decisions: the potential for faster, cheaper security decisions, and why structured outputs and confidence scores do not guarantee accuracy.
Watch or listen to full episodes in English.
Recent episodes
Episode 21
In this episode of the Alice in Supply Chains Podcast, Adrian Sanabria and Alexandre Sieira discuss four stories shaping third-party cyber risk management - from a BGP hijacking that compromised software updates to emerging AI risks, the rise of inside-out scanning in financial institutions, and proposed UK restrictions on risky technology suppliers.
.png)
Episode 20 | Recorded Live at Black Hat in Las Vegas!
On episode 20, Adrian and Alexandre discuss four recent stories shaping third-party and AI risk: SOC 2 commitments deferred by vendors, the lessons from Brazil’s PSTI security requirements, AI agents and security incidents involving Hugging Face, OpenAI and Anthropic, and a prompt injection case involving outside counsel in Brazil. The episode explores what these incidents mean for TPCRM, vendor assurance, regulatory compliance, AI governance, and third-party contracts.
Episode 19
Episode 19 of Alice in Supply Chains explores how cyber risk is evolving beyond traditional security concerns and why organizations need to rethink how they measure, manage, and communicate risk. Adrian Sanabria and Alexandre Sieira discuss the latest developments influencing the cybersecurity landscape, from the real financial impact of breaches and emerging software supply chain threats to practical approaches for third-party cyber risk management and the evolving regulatory environment. Whether you're responsible for security, risk, procurement, or compliance, this episode offers valuable insights into the challenges shaping cyber risk management today.