Think With Your Brian

Delve's response to the substack is finally out

Couldn't agree more here. If you aren't ten minutes early, you are late.

Vendor due diligence has become a standard practice in cybersecurity, but it’s not living up to its promise. These programs are often more about checking compliance boxes than addressing real security risks. Vendors complete lengthy questionnaires with generic responses, giving organizations the illusion of safety while doing little to prevent actual breaches. The biggest flaw is the static nature of these assessments. Cyber threats evolve daily, yet due diligence is often a one-and-done process, leaving businesses blind to future vulnerabilities. Even worse, companies frequently treat all vendors the same, wasting time on low-risk providers instead of focusing on those who pose the greatest threats. It’s time to rethink the approach. Continuous monitoring, prioritizing high-risk vendors, and fostering better security practices with partners can make a real difference. Instead of relying on outdated and superficial processes, organizations need to adopt dynamic strategies that address the risks of today—and tomorrow. Vendor due diligence, as it stands, isn’t just ineffective; it’s a costly misstep.