Jim Rosenthal on Using AI to Prioritize Third-Party Cybersecurity Risks

Companies can have strong internal defenses and still be exposed through a supplier. Jim Rosenthal, CEO of cyber defense platform BlueVoyant, says that makes third-party risk management a practical race: identify critical flaws across a sprawling vendor network, then help the affected suppliers fix them before attackers find a way in.

His argument shifts the focus from security ratings to remediation. A rating can signal that a vendor has a problem, but the customer is often left to chase the fix. When alerts arrive faster than teams can investigate them, that process can produce fatigue rather than safer systems. Rosenthal’s approach pairs rapid vulnerability assessment with specific guidance for affected vendors.

Why suppliers create an attack path

Attackers may target a supplier to reach a customer whose own defenses are harder to breach. Rosenthal says they scan for externally visible, critical vulnerabilities, compromise a supplier, and then try to move upstream to its clients. Artificial intelligence and machine learning can help attackers perform that search at scale, raising the pressure on companies to find and address exposed software quickly.

“The goal is simple: if there’s an external-facing critical vulnerability, the client needs to cure it before an adversary discovers and exploits it,” Rosenthal said. In his view, each new critical flaw starts a race between those looking for a way in and the teams working to close the exposure.

Rosenthal estimates that two to four new critical zero-day software vulnerabilities emerge each month and can affect software already in use. In a supply chain with thousands of suppliers, he says it’s likely that some will be running affected software. The challenge is not limited to discovering which flaw matters; teams also need to work out which vendors are exposed and get those vendors to act.

Remediation changes the response

Security ratings services can identify possible risks, but a notification alone doesn’t tell a vendor what to change. Rosenthal points to studies showing that, among 100 or 1,000 vendors affected by a typical new zero-day flaw, fewer than 10% patch within 10 days without assistance. About one third patch within 90 days.

He attributes slow responses in part to vendors not knowing that a flaw affects them or where it appears in their software. That’s a gap between receiving an alert and being able to act on it. A remediation-focused program closes some of that gap by contacting affected vendors as soon as a critical vulnerability is identified and sharing its location, the relevant patch, or a configuration change that can address it.

With this assistance, Rosenthal says, 50% of vendors can remediate within 10 days, and all can do so within 90 days. Those figures describe the outcomes he cited in the interview; the source doesn’t specify the study methods or the conditions behind the comparisons.

The workload helps explain why direct support matters. Rosenthal says organizations face 200 critical vulnerabilities a week, a pace that can outstrip small security teams. Vendors may also have incomplete knowledge of their networks. Even when they want to improve their defenses, locating affected software and deciding what to fix can compete with other security work.

AI speeds triage, while people still need to act

Rosenthal describes AI and machine learning as tools for quickly assessing new vulnerabilities. The first task is to distinguish flaws that pose a serious compromise risk from lower-severity issues. He says hundreds of new zero-days emerge weekly, and automated systems can assess each one within an hour or two of its appearance.

That screening can evaluate a couple hundred vulnerabilities in a week and typically identify one critical vulnerability during that period, he said. A human team doing the same initial analysis would need weeks. Faster triage can help security teams focus their attention, but assessment alone doesn’t patch a supplier’s systems. The operational value depends on pairing the result with accurate exposure information and a path to remediation.

Rosenthal describes critical vulnerabilities as scoring 8 to 10 on a 10-point scale. The source doesn’t provide details about the scoring method or how the automated assessments were validated. For organizations weighing this approach, those details matter: speed is useful only if teams can trust the prioritization enough to direct vendor outreach.

Risk controls need to fit vendor operations

Suppliers have to divide limited cybersecurity resources between defending their own networks and responding to requests from customers. Rosenthal says they naturally prioritize internal defenses, which can make external risk discovery and follow-through difficult for the companies that depend on them.

He recommends combining external monitoring with periodic assessments of vendors’ cyber maturity. Those reviews can use questionnaires, audits, or both. The aim is to keep track of weaknesses across the vendor base without turning every finding into an unmanaged alert.

Rosenthal argues that a better-defended supplier network can support business continuity because a disruption at a vendor can affect customer operations. His larger point is that third-party security is an operating concern as much as a scoring exercise: companies need to know which suppliers are exposed, provide enough detail for them to respond, and check that remediation happens. AI may shorten the time to identify the risks, but sustained improvement depends on whether vendors can put the fixes into practice.

Rosenthal’s background

Rosenthal served as Morgan Stanley’s chief operating officer until 2017, when he co-founded BlueVoyant. At Morgan Stanley, he was responsible to the CEO and board for cybersecurity. He received the 2017 Critical Infrastructure Protection Award from the Financial Services Information Sharing and Analysis Center.

He co-chairs Sheltered Harbor, a consortium of financial firms, industry associations, and technology providers focused on preserving confidence in the event of a cyberattack. He previously chaired the Securities Industry and Financial Markets Association and its cybersecurity committee from 2014 to 2017. Before Morgan Stanley, he was a senior partner at McKinsey & Company and CFO of Tishman Speyer Properties.