Written by: Bob Maley, Chief Security Officer

Reactivity isn’t the best option in most areas of life. You don’t want to buy a first aid kit while you’re actively wounded or hike to the nearest exit to fill up a gas can because your car ran out of fuel on the highway. In the same way, reacting to third-party risk as it’s happening (e.g., one of your vendors facing a zero-day threat or an auditor flagging one of your business-critical vendors as noncompliant) is responding too late. And your risk posture, reputation, and (let’s be honest) sanity will likely suffer as a result. 

Instead, protecting your business against increased third-party breaches and responding to a rapidly expanding vendor ecosystem requires a more proactive, planned approach. It takes new strategies that traditional TPRM solutions often don’t consider—monitoring your third-party risks in real-time and identifying weak points before anything significant ever happens. It’s like watching your gas gauge and filling up your car long before you hit empty or preparing for unforeseen injuries by keeping a first aid kit on hand. 

Let’s dive into a few differences between a traditional, reactive approach to TPRM and a proactive cyber security strategy powered by Black Kite that keeps you one step ahead.

From Point-in-Time Snapshots to Continuous Monitoring

Traditional TPRM tends to lean on point-in-time snapshots about a company’s third-party risk posture. However, this approach misses many rapidly shifting factors in vendor relationships. A vendor that seemed secure might suddenly make changes that increase their level of risk. Or a new zero-day vulnerability might emerge that affects some of your third-party resources.

How Black Kite Solves It

To keep a close eye on these constant changes, Black Kite offers continuous monitoring, with the ability to narrow down findings to the risks that matter most to your organization. We don’t inundate you with data; instead, we prioritize and bring attention to the alerts that matter most in a sea of vendors, applications and data points. By watching vendors’ security posture over an extended period, your team collects better context than a static score or rating could ever provide. 

From Inaccurate Scoring to Precise Data

When your team considers quantifying risk, established systems like security rating services (SRS) scores might come to mind. However, these scoring systems leave out many important nuances, such as how a vendor is mitigating an emerging threat. SRS scores can also be vague, as two security service organizations will often provide two different letter ratings for the same business. Sometimes, it seems like the score came out of a black box, with no way of knowing how the security service decided on that particular rating. 

How Black Kite Solves It

Instead of relying on ambiguous scoring systems, Black Kite uses technical cybersecurity ratings using commonly-used frameworks developed by the MITRE Corporation. We conduct non-intrusive scans and rank each vendor in 20 categories, such as patch management, attack surface, and network security. The total score is a weighted average of these individual categories. It is then translated into a letter-grade system for quantifying risk at a glance.

Black Kite also shows how each vendor ranks in the following categories:

• Potential financial impact by monetary amount, calculated with the Open FAIR™ model
• Correlation with industry-accepted compliance frameworks 
• Ransomware susceptibility, as shown by the Ransomware Susceptibility Index^®

With this precise data, your team can take proactive cyber security to the next level by accurately identifying which vendors pose the most significant threats and make informed risk decisions.

From Vague Findings to Actionable Insights

Commonly used rating systems also fail to provide actionable information. If the only information you have about a business-critical vendor’s risk posture is that they scored a “D” in their SRS rating, your team might not know what to do next. Do you tell the vendor and invite further confusion because neither party knows what caused the low score? Do you ignore it and hope for the best? Or do you raise the alarm in your organization and cause a domino effect of business complications?

How Black Kite Solves It

Black Kite prioritizes transparency and accuracy in vendor risk management, offering deep, actionable insights into each vendor’s risk posture, including their susceptibility to ransomware attacks. With this detailed data, you can better reach out to stakeholders within the business or to the vendors directly and have productive conversations about risk management. By fostering more collaborative relationships and removing uncertainty, you increase the likelihood that a vendor will take positive action to improve their risk posture. 

In the case of significant threats, such as data breaches or ransomware attacks, we also leverage FocusTags™, ensuring that your team immediately sees when a high-risk incident occurs in your vendor ecosystem. We filter out the noise and confusion, so your team can focus on the next steps that will most significantly mitigate your third-party risk. 

Sign Up for a Vendor Risk Assessment Today

A proactive approach to third-party risk management can make all the difference for your security team. Proactive cyber security contributes to a better relationship between you and your vendors, less noise and confusion for your team, and more concrete, actionable next steps. Rather than waiting to see what happens or chasing false alarms, your team can take control of vendor risk and prioritize protecting your most valuable assets. 

Want to see Black Kite in action? Sign up for our free risk assessment to see how your vendor ecosystem stacks up.

The post Heading Off Disruption: How to Implement Truly Proactive TPRM appeared first on Black Kite.

Written by: Bob Maley, Chief Security Officer

Contributor: Candan Bolukbas, CTO and Founder

In today’s fast-moving tech landscape, companies often face the temptation to prioritize speed over security when developing software. While getting to market quickly might offer a competitive edge for a software company, the long-term risks can be catastrophic—especially when that company becomes a third-party vendor whose products are embedded in other cyber ecosystems. When security is treated as an afterthought, the consequences can ripple across entire supply chains, leaving businesses vulnerable to breaches, ransomware attacks, and data loss. 

For companies relying on third-party vendors, a single security oversight can expose them to significant financial loss, reputational damage, and regulatory penalties. As cyber threats become more sophisticated, the price of neglecting security during product development is far too high for both vendors and their customers.

That’s why, in 2016, when we first built Black Kite as a third-party risk management (TPRM) solution, security was at the very top of our list. As a vendor ourselves, we understood the responsibility that comes with being part of our customers’ cyber ecosystems. We knew that any vulnerability in our own product could become a vulnerability for the companies relying on us to secure their third-party relationships. Our goal wasn’t just to help businesses identify and manage risks in their vendor networks—it was also to ensure that we weren’t contributing to those risks. 

From day one, we designed Black Kite to be as secure as possible, embedding security into every layer of our platform, just like our solution helps companies do with their own vendors.

So when the opportunity to sign the CISA Secure by Design Pledge came around last year, it felt like a natural step for us. The pledge aligns perfectly with the principles we’ve followed since the beginning—building secure software that protects not only our customers but also the broader digital ecosystem. By committing to this initiative, we reinforced our dedication to putting security at the forefront of everything we do. 

Taking the CISA Secure by Design Pledge

Recently, we joined more than 200 tech companies in signing CISA’s Secure by Design Pledge. For Black Kite, signing the pledge wasn’t about making a drastic shift; it was about publicly affirming what we’ve practiced for the past eight years. As a Chief Information Security Officer (CSO) who joined in 2019, I was thrilled to join a company whose product was already well-established, with many proactive security measures in place. 

I recently sat down with co-founder and Chief Technology Officer Candan Bolukbas to discuss how Black Kite’s security-first approach already aligns with the tenets of the pledge, underscoring our commitment to helping businesses protect themselves from third-party risks.

The pledge requires us to meet seven key security goals within the year following signature. That would be daunting for many companies of our size, but it was a no-brainer for me and our leadership team.

For one, the seven goals outlined in the pledge align well with several compliance frameworks we had already embraced at Black Kite, including ISO 27001, SOC 2, and FedRAMP. Moreover, we have already adopted many essential security best practices that map to the pledge, like using MFA and avoiding default passwords in our software. 

While compliance frameworks and pledges like CISA’s are designed to improve security, any CISO worth their salt will tell you that checking the boxes on a compliance audit or pledge does not mean you are fully secure. We’ve always considered it a goal to be one step ahead of the “bad guys” and remain on the cutting edge of defensive and offensive security.

Today, I want to share some foundational principles built into Black Kite and how we have evolved our security practices. Our goal, of course, is not just to tick the boxes on the pledge, but to uphold and demonstrate our commitment to security — for all of our stakeholders, from employees to customers to investors. 

Black Kite’s Secure by Design Roots

One of the most unusual facets of Black Kite’s culture is the security knowledge and expertise in our C-Suite. Our CEO, CTO, CSO (myself), and COO all have backgrounds in security; in fact, our COO is a former CISO himself. 

This isn’t something that every business can replicate. But it’s part of the reason we’ve had such success with building a secure-by-design organization and product. Everyone in the C-Suite has bought into the importance of security from day one.

This has reinforced for me that the culture of security is just as important as the tools, processes, and people who make security happen. 

Let’s face it: The role of CISO is a challenging job. That’s true even when you have access to Fortune 500 resources. For one thing, the security talent shortage continues to plague every industry, meaning that even large companies rarely have sufficient personnel for security. Meanwhile, the threat landscape shifts faster every year — now at an exponential rate, thanks to AI — meaning that CISOs only have to deal with more risk as time passes. And, unfortunately, when a breach happens, whether it was the CISO’s fault or not, they are often scapegoated. 

With this pressure in mind, I always say educating the team about security is 90% of the battle. Fortunately, at Black Kite’s highest levels, I haven’t had to educate; rather, I’ve had partners who support my vision without hesitation. Again, this isn’t a luxury every business has. But it’s key to understand that culture and education lay the foundation for security.

In addition to this culture of security, the founders of Black Kite, as I mentioned earlier, believe deeply in security by design. Our CTO, in particular, brings a background as an “offensive” security practitioner to bear on his vision for Black Kite. Candan served as a network and security administrator and then a security manager for the government of Turkey. He also served as a Certified Ethical Hacker (CEH) for NATO, testing the security posture of many global organizations. 

As a co-founder of Black Kite, Candan has spearheaded the effort to ensure security across our culture, systems, and code. Black Kite’s software has been built with secure-by-design principles from the very beginning. And Candan and the rest of the executive team have been true partners to me, making my job easier because they already fully grasp the importance of what a CISO does.

Before I joined Black Kite (at the seed stage, so very early in the company’s journey), the team had already implemented measures like:

• Information security policies
• Multi-factor authentication
• Implementation of third-party risk monitoring (TPRM)

Candan and the team embraced these practices, not just because they were building a security platform but because they knew first-hand the repercussions of operating insecurely.

Black Kite and the CISA Secure by Design Pledge

As I mentioned, when we were invited to take the CISA Secure by Design Pledge, I had no hesitations. Here are the core aspects of the Secure by Design Pledge and how we implement them at Black Kite today:

1. Multi-Factor Authentication

The CISA pledge asks signers to implement MFA across as much of their environment as possible. At Black Kite, we have implemented and enforced MFA since 2017 via Google Authenticator. We enforce MFA for all federal clients and privileged accounts. Black Kite customers can also enable their personal MFA in conjunction with established MFA. 

Candan implemented MFA early on at Black Kite because of several career experiences. When he worked for the Counter Cyber Terrorism Task Force, he and the red teams there would often employ brute forcing to test defenses. When they found open, remote administrative ports, they would search the dark web for leaked credentials, then use those to gain access and attempt lateral movement.

MFA is a key countermeasure to prevent the success of similar attacks. Attackers need access to at least two different authentication sources to succeed with a brute-force attack. Authenticator tools are an ideal MFA component since their short-lived, one-time codes make it even harder for attackers to succeed with password-based attacks.

2. Default Passwords

Many development and production environments use default passwords. CISA’s pledge requires organizations to minimize the use of default passwords to close off this attack surface. Black Kite does not use default passwords in any development or production environments. All access is based on actual user accounts. 

This means even if a bad actor gained entry to a system, they could not use default passwords to expand their footprint within it. This quickly stops much of the fallout from a successful breach.

3. Reducing Entire Classes of Vulnerability

This pledge component involves improving vulnerability management to reduce risk over time.

Early on, Black Kite adopted the widely-known Patch Tuesday — implementing patches for known vulnerabilities on the second Tuesday of every month. When I joined the team, we expanded our countermeasures to include regular vulnerability scanning using several tools and services. 

In addition, our architecture team is working towards implementing least privilege access across the company and our product. We are also empowering developers to build more securely. We monitor our Jira ticketing system for vulnerabilities, and our metric for measuring reduction is a decline in tickets created.

4. Security Patches

By signing the pledge, organizations agree to work on increasing the use of patches by their customers and users. 

At Black Kite, our customers are responsible for performing systems security patching on their own platforms. To support them, Black Kite performs independent penetration testing on its code, and any identified defects are repaired in development and then released as patches.

5. Vulnerability Disclosure Policy

This part of the pledge requests teams to produce a vulnerability disclosure policy, permit anyone to disclose vulnerabilities without repercussions, provide a channel for reporting them, and allow public disclosure in line with global standards. 

Black Kite practices full disclosure with our customers. If Black Kite were to experience an intrusion, customers would have access to gather evidence. In my experience, this level of maturity is fairly rare for a company of our size and age. 

In addition, we have a Trust center, found at trust.blackkite.com, where anyone can learn more about our commitment to security and request a SOC 2 report or penetration test results. 

6. CVEs

CVEs, or common vulnerabilities and exposures, is a system used to identify and track vulnerabilities in software and systems. The pledge asks signers to demonstrate transparent reporting of vulnerabilities.

Black Kite identifies its own CVEs through independent penetration tests. While Black Kite does not publish its CVEs publicly, we do make our penetration test results available to customers on request.

Additionally, anyone can visit Black Kite’s Trust Center for more detailed security control and process information. Any stakeholder may request our SOC 2 report and proof of compliance with other well-known standards.

7. Evidence of Intrusions 

Finally, the CISA pledge calls on organizations to enable customers to gather evidence of intrusions within their products. At Black Kite, we fully embrace this level of transparency. Should an intrusion occur, we have a clear process in place that allows customers to collect relevant forensic data directly from our systems. This ensures they can take necessary action to protect their own environments.

In addition, Black Kite provides customers with access to detailed logs, incident reports, and audit trails upon request so they can perform their own incident investigations. We believe that empowering our customers with the right tools and information is essential to maintaining trust and ensuring that both parties can respond swiftly and effectively to any potential threats.

Startups and Security Maturity

While working at a startup or scale-up can sometimes be seen as a disadvantage when it comes to security, there are some unique advantages at play these days. For example, many investors now seek evidence of security policies and controls before funding companies. Customers are also increasingly savvy about security, in part due to measures like CISA’s pledge. In other words, there are many incentives today to “do the right thing” regarding security. 

One of the other major advantages that startups and scale-ups have is their ability to build security processes from the ground up rather than retrofitting them into legacy systems. Startups can often move more quickly to adopt new security technologies and practices without being slowed down by outdated infrastructures or bureaucratic hurdles. At Black Kite, we took full advantage of this agility. From day one, security wasn’t just something we added on after our product matured—it was a core part of our design and architecture.

As a third-party vulnerability management platform, Black Kite’s customers naturally request to see proof of our own security posture. We make this available through our Trust Center, where customers can access critical resources, including our SOC 2 Type II report, ISO 27001:2022 certificate, and a summary of penetration tests. Additionally, our platform leverages trusted subprocessors like Google Cloud to ensure the highest levels of data protection.

Black Kite’s Trust Center also showcases our extensive security controls, including encryption, access restrictions, and disaster recovery plans, all of which are updated regularly to reflect our ongoing commitment to secure operations. This transparency allows our customers to verify our security posture and gives them confidence that we’ve built our platform with secure-by-design principles from the very beginning.

As a CISO, I feel fortunate to be part of a scale-up business that takes security seriously. While signing the CISA pledge is neither the beginning nor the end of our security efforts, it’s an important way to join forces with other organizations and demonstrate our shared commitment to security.

Visit our Trust Center to learn more about our security practices, access compliance certifications like SOC 2 and ISO 27001, and review key resources like our Pentest Summary and Information Security Policy. You can also explore our security controls and infrastructure details or request access to additional documentation of our commitment to transparency and secure-by-design principles.

The post Built to Protect: The Importance of Security by Design in TPRM appeared first on Black Kite.

Written by: Gizem Toprak & Müzeyyen Gökçen Tapkan

What is OSFI?

The Office of the Superintendent of Financial Institutions (OSFI) is an independent agency of the Government of Canada that is responsible for the supervision and regulation of banks, insurance companies, and trust and loan companies. OSFI reports to the Canadian Minister of Finance.

The Role of OSFI in Financial Regulation

Supervision of Financial Institutions

OSFI supervises financial institutions through regular reviews, risk assessments and ongoing monitoring. It allows OSFI to detect potential risks early and take corrective measures to reduce them. By maintaining strict oversight, OSFI increases confidence in the financial system by ensuring that financial institutions operate safely and comply with regulatory requirements.

Setting Regulatory Standards

OSFI sets regulatory standards to ensure the stability, efficiency and resilience of Canada’s financial sector. These standards cover a wide range of areas such as capital adequacy, corporate governance and risk management. By establishing clear and comprehensive guidelines, OSFI contributes to the overall stability of the financial system by helping financial institutions effectively manage their risks and maintain strong financial health.

Crisis Management

OSFI plays a critical role in crisis management by implementing contingency plans and coordinating with other regulatory agencies. OSFI’s crisis management framework includes early intervention measures and resolution strategies to address challenges faced by troubled financial institutions. This proactive approach helps reduce the impact of financial crises, protect the interests of depositors and policyholders, and maintain confidence in the financial system.

Enforcement

OSFI’s enforcement activities ensure that financial institutions comply with regulatory standards and operate within the legal framework. This involves investigating potential violations, imposing penalties, and taking corrective actions against non-compliant entities. Through diligent enforcement, OSFI upholds the integrity of the financial system, deters misconduct, and promotes a culture of accountability and transparency within the financial sector.

OSFI-B13: Cybersecurity and Technology Risk

OSFI B-13 guidance to help Federally Regulated Financial Institutions (FRFIs) mitigate cybersecurity and technology risks. OSFI B-13 introduces new management requirements for the organizational structure of IT departments, encompassing all operational units and technology control owners. The guidance mandates that financial institutions develop a clear cybersecurity strategy that aligns with their overall organizational strategy. Additionally, it emphasizes the need to assess third-party vendor risk and integrate cybersecurity practices into their project management and systems development lifecycles.

Key Highlights of OSFI-B13

Cyber Security

Will employ a secure technology posture that protects the confidentiality, integrity and availability of FRFI’s technology assets.

Governance and Oversight

It requires FRFI’s to manage technology and cyber risks through clear responsibilities and frameworks.

Technology Operations and Resilience

FRFI’s technology environment is expected to be maintained “up to date” and supported by sustainable technology operating processes.

OSFI-B10 and Third-Party Risk Management

OSFI B-10 aims to expand the definition of third parties to include any person or entity that has a relationship with your financial institution, such as sponsors, spokespeople, or charities. This significantly impacts the way organizations identify, assess and mitigate third-party risks. It also addresses the risk of concentration and requires organizations to evaluate the risk of relying on a single vendor for multiple services both before and during the deal. This assessment helps determine appropriate risk mitigation levels. Calls for standardization of contracts to clearly define and manage relationships with third parties.

Key Highlights of OSFI – B10

Third Parties

It calls for standardized contracts to reduce potential risks associated with third-party relationships.

Risk Assessment

Risk assessment ensures that organizations remain alert and can promptly resolve any issues that arise with third-party service providers.

Due Diligence

This includes assessing the regulatory compliance and overall risk profile of third-party service providers.

Third-Party Risk Management Framework (TPRMF)

Most federally regulated financial institutions (FRFIs) have policies addressing specific third-party regulations, such as outsourcing and auditing, but often lack an integrated third-party risk management framework (TPRMF). The revised OSFI B-10 requires FRFIs to develop a TPRMF to assess, risk rate, classify, and manage all third-party relationships across the enterprise. This framework should cover the entire lifecycle of third-party orchestrations, from sourcing to exit; It should enable FRFIs to identify, assess, manage, mitigate, monitor and report third-party risks, including concentration risk, which is difficult to manage in a single environment.

How Similar Are OSFI B-13 and NIST CSF ?

Scope

• OSFI B-13 Mandatory for Canadian financial institutions; highly specific to the financial sector.

• NIST CSF Voluntary and intended for use by organizations in any sector globally.

Compliance

• OSFI B-13 Sets out mandatory requirements for compliance with Canadian financial regulations.

• NIST CSF Provides guidelines and best practices without mandatory compliance requirements, although it can be adapted to meet regulatory needs.

Structure

• OSFI B-13 Prescriptive and detailed, with specific requirements for governance, risk assessment, incident response, and third-party management.

• NIST CSF Structured around five core functions (Identify, Protect, Detect, Respond, Recover) and is designed to be flexible and adaptable.

Strategy

• OSFI B-13 Requires alignment of cybersecurity strategy with the overall business strategy of financial institutions.

• NIST CSF Encourages integration of cybersecurity into organizational risk management processes but is more flexible regarding how this is achieved.

Vendor and Third-Party Risk Management

• OSFI B-13 Specifically addresses the need for assessing and managing third-party vendor risks in detail.

• NIST CSF Includes third-party risk management as part of its broader risk management guidelines but is less prescriptive.

Conclusion: Strengthening Financial Institutions Through Comprehensive Risk Management

In conclusion, OSFI’s B-10 and B-13 guidelines are critical frameworks for ensuring the safety, resilience, and compliance of Canadian financial institutions in today’s increasingly complex and interconnected digital landscape. By addressing both technology and third-party risks, these regulations empower financial institutions to take a proactive approach to risk management. While OSFI B-13 focuses heavily on cybersecurity and the integration of IT practices into broader business strategies, OSFI B-10 sharpens its lens on third-party relationships, urging financial institutions to establish robust frameworks for managing vendor risks. Together, these guidelines not only strengthen the operational integrity of financial institutions but also reinforce the confidence of stakeholders, ensuring the long-term stability of Canada’s financial system. As regulatory landscapes continue to evolve, financial institutions that align their practices with these standards will be better equipped to navigate risks and maintain resilience in the face of emerging challenges.

How Black Kite Can Help with AI

Black Kite’s UniQuE™ Parser, the industry’s first cyber-aware AI engine, enables organizations to automate the extraction and analysis of vendor contracts and security documentation, ensuring compliance with regulatory requirements while saving time and resources. You can quickly identify gaps, evaluate vendor alignment with OSFI guidelines, and gain a complete, centralized view of your third-party risk landscape. Learn more about automating compliance.

The post Understanding OSFI B-10 and B-13 For Financial Institutions appeared first on Black Kite.

Links

• Grace Study Bible Progress
• Grace Study Bible – Detailed Progress Report
• Transformed By Grace
• Transformed By Grace YouTube Channel
• Conferences
• Fall Sale Items