The End of Security Theater: Why TPRM and SOC 2 Are Broken | Guest: Rachel Curran

Rachel Curran argues that third-party risk management (TPRM) has become "security theater" driven by outdated compliance checkboxes, urging a shift toward practical, evidence-based security and continuous monitoring.

Key Takeaways:
• Static questionnaires and one-time audits are ineffective; companies must prioritize continuous monitoring of actual security controls over compliance paperwork 1:50
• MFA remains the single most impactful control for preventing breaches, yet it's frequently neglected in favor of complex, less effective measures 2:40
• Small startups should skip SOC 2 and instead focus on demonstrating core security hygiene through transparent vendor conversations 6:25
• Third-party risk can be a competitive differentiator; companies that proactively share their security posture are more likely to win enterprise deals 14:35
• Organizations must stop using third-party risk as an excuse for poor internal data governance and minimize vendor breach impact through least privilege and robust backups 39:10

As the digital ecosystem becomes increasingly interconnected, the focus must shift from bureaucratic compliance to practical risk reduction, ensuring that security practices actually protect business operations.

Sources:

• 1:50 Security theater in TPRM
• 2:40 MFA as critical control
• 6:25 SOC 2 unsuitability for small startups
• 14:35 Security as competitive differentiator
• 39:10 Internal data governance and least pri