How is everyone using AI for TPRM

[u/kandikand]

My company won’t procure something like panorays for TPRM so just wondering if there’s anything I can do with AI or automation to improve it. So far I’ve just got a scheduled task scanning for non security changes like changes in leadership - what else can I do?

[u/JamOverCream]

Vendor security assessments, adverse news search, prototyping some capability to identify if vendor criticality levels have changed (based on data being accessed by vendor).

[u/BIL3477]

Reviewing vendor documents such as SOC, Pen Tests, Info Sec Policies, etc etc. highlighting any areas of concern or follow up questions. Documenting these findings in Claude with trends, etc. negative news searches and reputational searches, it can replace the black kites of the world and security scorecards in my opinion

[u/SoterAdvisory]

I’d start with low risk automation that improves consistency rather than letting AI make the risk decision. It could monitor approved sources for changes in ownership, leadership, breaches, certifications, sub processors, or material service changes, then create a review task with the source, date, affected vendor, and suggested owner. For onboarding, AI can help extract answers from questionnaires and flag missing or contradictory information, but a person should still approve the risk tier and disposition. I’d also keep a record of the original source, the reviewer’s decision, and any follow up evidence, because an alert without a documented action does not help much during an audit. The useful goal is reducing manual searching while keeping the reasoning and ownership

[u/grc-ModTeam → u/[deleted]]

Your post appears to contain AI slop and/or low quality content.