Daniel Bardenstein: Why Third-Party Risk Is Broken

Welcome back to Zero Signal! In this episode, hosts Conor Sherman and Stuart Mitchell sit down with Daniel Bardenstein, founder and CEO of Manifest Cyber, former Chief of Technology Strategy at CISA, and former cybersecurity lead for Operation Warp Speed. With open-weight models like GLM 5.2 rapidly challenging proprietary AI providers like ChatGPT and Claude on performance while offering up to 5x to 6x cost savings, Daniel unpacks why basic arithmetic is driving an enterprise shift back toward open-weight models. He breaks down the complex supply chain dynamics behind AI datasets, fine-tuning, and model dependencies, highlighting how untracked data inputs can quietly introduce massive legal, compliance, and security liabilities. The conversation addresses the ongoing breakdown of traditional Third-Party Risk Management (TPRM). Daniel explains why relying on static paper questionnaires, SOC 2 reports, and superficial web scans fails to capture non-deterministic AI risks or the hidden fourth- and fifth-party software dependencies lurking inside modern vendor products. To solve this, he advocates for treating AI as a subset of software and leveraging machine-readable AI Bills of Materials (AI BOMs) to automate inventory management, streamline license compliance, and protect pipelines against shadow AI created by developers using tools like Claude Code. About the Guest Daniel Bardenstein is the founder and CEO of Manifest Cyber. He previously served as the Chief of Technology Strategy at the Cybersecurity and Infrastructure Security Agency (CISA), led cybersecurity for Operation Warp Speed, and helped architect national-level cross-sector Security Performance Goals. Continued Reading & Resources CISA Cross-Sector Cybersecurity Performance Goals: https://cisa.gov/cpgs CycloneDX SBOM/AIBOM Standard Specification: https://cyclonedx.org SPDX Software & AI Bill of Materials Standard: https://spdx.dev NIST Software Supply Chain Security Guidance: https://nist.gov/software-supply-chain OWASP Top 10 for Large Language Model Applications: https://owasp.org/www-project-top-10-... LAION-5B Dataset Research Analysis (Stanford University): https://cyber.fsi.stanford.edu Key Topics & Timestamps 00:00 Open-Weight Models & The Economics of GLM 5.2 04:15 The Shift from Proprietary APIs to Open-Weight Models 08:50 Mapping Supply Chain Risks in Datasets and Fine-Tuning 12:20 Software Supply Chain Models Applied to AI Inventory 18:10 Navigating Complex AI Model Licensing & Compliance 24:00 Shadow AI, Local Models, and "Vibe Coding" Developer Risks 33:00 The Failure of Traditional Third-Party Risk Management (TPRM) 40:30 Operationalizing AI Bills of Materials (AI BOMs) for Automation Meet our Sponsors Hampton North is the premier US-based cybersecurity search firm: https://hamptonnorth.com/?utm_source=... Sysdig is the leader in AI-powered real-time cloud defense: https://www.sysdig.com/?utm_source=we...