AI Videos

Beyond Vendor Risk: Real-Time GRC, AI, and Protecting App User Data - Jadee Hanson - CSP #221

The episode centers on Vanta’s Agentic Trust platform and its role in protecting application user data through real‑time governance, risk, and compliance (GRC). Host Jessica Hoffman interviews JD Hanson, Vanta’s security and technology lead, who explains how the company uses its own product internally—acting as “customer zero”—to refine frameworks, drive product development, and demonstrate trust to external customers. Vanta has transitioned from ISO to the NIS CSF framework, building custom maturity models that are evaluated quarterly. This systematic approach surfaces gaps, guides remediation, and has shown measurable progress over two years. A distinctive feature is the public Trust Center, where continuous monitoring automatically updates green checkmarks for each control, offering prospects a live view of Vanta’s security posture. Hanson emphasizes that traditional vendor risk assessments are static and rubber‑stamped, advocating for continuous, transparent monitoring instead. He notes, “continuous monitoring is the most important part,” and highlights collaboration with FedRAMP 2.0 to showcase real‑time evidence. The conversation also touches on AI as a game‑changing force, enabling near‑real‑time, automated third‑party risk evaluations. The shift toward continuous, AI‑enhanced monitoring signals a broader industry move away from point‑in‑time questionnaires toward transparent, real‑time risk visibility. Companies adopting such models can better protect user data, accelerate compliance, and build stronger trust with partners and regulators.