Third-party risk research and resources

Research, customer stories, webinars, and company news on third-party risk management.

01 · All posts

Playbook5 min read

A PHP2Shell incident remediation playbook in Coverbase Radar

On October 21, 2026 the PHP project shipped emergency fixes for CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Both are rated 9.2 on CVSS v4.0 and let an attacker with no credentials run code on servers running PHP 5 through 8. Cloudflare reported exploitation attempts before the fix was out, and CERT-EU and Australia's ACSC told organizations to patch or take affected sites offline. WordPress automatic updates do not install the fix, because the flaw is in the PHP runtime and not in WordPress.

Case study3 min read

How Edward Jones is rethinking third-party risk management with AI

Edward Jones is using AI to reduce manual work, connect fragmented supplier information, and help analysts focus on the risks that matter most.

Case study3 min read

How Alviere built an end-to-end third-party risk program without building a bigger team

Alviere replaced spreadsheets and siloed reviews with one connected program for every third party, from vendors and bank partners to prospective clients. It did it without adding headcount.

Press release3 min read

Coverbase adds third-party risk veterans as enterprise adoption accelerates

Brian Shaw and Constantine Malaxos join as enterprise customers expand across financial services, healthcare, and technology. SAN FRANCISCO, CA, September 29, 2026. Coverbase, AI engineered for third-party risk management (TPRM), today announced that Brian Shaw has joined as GTM Lead and Constantine Malaxos as Head of Alliances. Both bring decades of experience building and selling third-party risk technology to large enterprises.

Research report16 min read

Your System Is a Network of Other Systems

How roughly 700 OpenAI evaluation agents chained a package mirror, a stranger's test app, and 14 leaked tokens into a Hugging Face production compromise, and what that does to vendor trust built on annual attestations.

Article4 min read

What we told the OCC

We filed a comment letter on the proposed interagency TPRM guidance on September 24. It is seven pages and you can read the whole thing here (PDF). This is the summary, with a bit of why we said what we said.

Article4 min read

The regulators just said the quiet part about TPRM out loud

On September 11 the OCC, Fed, FDIC, and NCUA proposed replacement guidance for third-party risk management. The Federal Register version went up September 15 and comments close November 16. Nothing is final. The 2023 guidance is still the one your examiner is carrying. But if you have spent the last three years building a program to the 2023 text, read the preamble of this one, because it is the agencies describing your program back to you and saying they did not mean for it to turn out that way.

Case study3 min read

Coastal Community Bank made AI-driven assessments ready for examiner review

At Coastal, reviewers can trace a control decision to the vendor evidence behind it. Two decades of records now live in one system.

WebinarOn-demand webinar

The future of third-party risk: from point-in-time assessments to continuous monitoring

Watch the on-demand conversation on continuous monitoring, better risk signals, and agentic due diligence in TPRM.

Watch

Research report14 min read

Twelve Weeks: From Acquisition to Attack

Two threat actors, two vulnerability classes, one target: what the Abbott incidents reveal about the security gap between acquired and integrated systems.

WebinarOn-demand webinar

Why vendor risk management doesn't work the same way for sponsor banks

Sponsor banks are growing fast, and so is the risk workload that comes with it. In a recent conversation hosted by The BaaS Association, Coverbase's Danny Higdon and FedFis's Tanner Mayo broke down why the standard TPRM playbook falls short for embedded finance, and what's replacing it. Below are the key takeaways, with the full recording embedded at the end.

Watch

Article6 min read

NIST SP 800-18 Revision 2: what you need to know

NIST SP 800-18 Revision 2 adds a system-level C-SCRM plan with supplier inventories and continuous monitoring. See what TPRM teams should do next.

Ready for agentic third-party risk and security?

Book a demo