Alice in Supply Chains

About Alice in Supply Chains

In 2022, Tenchi Security created the Alice in Supply Chains newsletter to share and highlight stories on third-party and supply chain risks and attacks, their impacts on services and businesses, and how the industry is moving forward to manage these risks. Following the meteoric success of the newsletter, we've created a podcast! Every month, hosts Adrian Sanabria and Alexandre Sieira will discuss the top six stories from each monthly newsletter, and their thoughts on the future of third party cyber risk management.

Publisher

Tenchi Security

Category

news

Language

en

Explicit

No

First episode

22 Jan 2025

Latest episode

15 Sept 2026

Latest episodes

26 episodes in the feed.

1. 

   15 Sept 2026

   Episode 21 | September, 2026

   In this episode of the Alice in Supply Chains Podcast, hosts Adrian Sanabria (https://www.linkedin.com/in/adrian-sanabria/) and Alexandre Sieira (https://www.linkedin.com/in/sieira/)discuss the latest news related to third party cyber risk management. - Story one focuses on a wild BGP hijacking incident that compromised updates for a vendor that makes hypervisor management software (Virtualizor by Softaculous). Attackers were able to take over part of hosting company Hetzner’s IP space, create a valid TLS certificate for Softaculous’s website and serve up an identical copy of the website. Softaculous didn’t cryptographically check the integrity of updates, so the attack succeeded in compromising customers. - In story two, the Financial Stability Board, an organization created by the G20 after the 2008 financial crisis, warns of risks from AI. The risks were twofold: the AI bubble and threats directly from rogue AI agents. - In story three, Alexandre shares an observation that, at least in Latin America, financial institutions are writing inside-out scanning into their MSAs. - Finally, in story four, UK politicians propose to amend the Cyber Security and Resilience bill to expand restrictions on tech suppliers seen as ‘risky’. A troubling addition aims to remove transparency at the same time. Links - for reference: Story 1: https://arstechnica.com/security/2026/09/well-executed-bgp-attack-uses-hijacked-ips-to-infect-real-networks/ ( https://arstechnica.com/security/2026/09/well-executed-bgp-attack-uses-hijacked-ips-to-infect-real-networks/) Story 2: https://therecord.media/cyber-risk-from-frontier-ai-most-immediate-concern-to-global-finance (https://therecord.media/cyber-risk-from-frontier-ai-most-immediate-concern-to-global-finance) Story 3: No link Story 4: https://therecord.media/uk-technology-national-security (https://therecord.media/uk-technology-national-security)

2. 

   19 Aug 2026

   Episode 20 | August, 2026

   Recording in person for the first time — from a scorching Las Vegas during Black Hat week — Adrian and Alexandre open with Adrian's BSides Las Vegas talk debunking the "60% of breached small businesses fail" myth. Story one covers the "trust me bro, I'll eventually get you a SOC 2" trend: contracts that let vendors start business now and promise a SOC 2 within a year. The guys argue this inverts the whole point — SOC 2 isn't a control, it's an assurance mechanism, so deferring it means hiring first and assessing later. With compliance-automation vendors promising push-button SOC 2s and the economic incentives that produced Delve unchanged, expect more rubber-stamp mills. Story two heads to Brazil, where CMSW Solutions — the first PSTI (PIX payment infrastructure provider) publicly breached in last year's wave of nine-figure heists — passed the Central Bank's tough new requirements, then exited the PSTI business anyway. The lesson for TPCRM teams: "we meet the compliance requirements and no more" is a trap, because sometimes (moving hundreds of millions daily) the regulatory floor sits far below actual risk, and sometimes (a drywall contractor facing CMMC) far above it. Story three was the talk of Black Hat: Hugging Face announced it was hacked by an AI agent, OpenAI raised its hand to claim the oopsie, and Anthropic then admitted its agents had escaped sandboxes and done the same. We discuss the uncomfortable questions: where's the CFAA energy that gets aimed at human researchers, and why do we tolerate two-nines availability and sloppy containment from vendors whose entire pitch is how dangerous their technology is? Practical advice: hold AI labs to a higher vendor standard, and consider running inference through hyperscalers for better infrastructure, IAM, and data residency guarantees. The final story is one for the "wouldn't even occur to a sci-fi writer" file: outside counsel defending Brazilian cosmetics giant Natura embedded a prompt injection in a court filing, attempting to manipulate the judiciary's automated document processing. The judge found the firm litigated in bad faith, applied the maximum 10% misconduct fine, and referred the lawyers to the bar. The TPCRM takeaway: your third parties' AI use isn't just a data-leakage question anymore — review whether your contracts with outside counsel (and everyone else) cover willful acts like this. Links: Story 1: https://www.linkedin.com/posts/kelsey-waters_ive-now-seen-this-twice-enterprise-buyers-share-7483510195877240832-nZFg/ (Recording in person for the first time — from a scorching Las Vegas during Black Hat week — Adrian and Alexandre open with Adrian) Story 2: https://www.linkedin.com/posts/cmsw-tecnologiafinanceira-infraestruturafinanceira-share-7487486750743969794-_xQi/ (Recording in person for the first time — from a scorching Las Vegas during Black Hat week — Adrian and Alexandre open with Adrian) Story 3: https://kaynemcgladrey.com/blog/when-the-arsonist-sells-fire-insurance/ (Recording in person for the first time — from a scorching Las Vegas during Black Hat week — Adrian and Alexandre open with Adrian) Story 4: https://brazileconomy.com.br/empresas/2026/08/natura-e-condenada-pela-justica-por-litigancia-de-ma-fe-e-manipulacao-de-ia/ (https://brazileconomy.com.br/empresas/2026/08/natura-e-condenada-pela-justica-por-litigancia-de-ma-fe-e-manipulacao-de-ia/) Adrian’s BSides Las Vegas talk: https://youtu.be/K9tDYG4dMSY?t=609 (https://brazileconomy.com.br/empresas/2026/08/natura-e-condenada-pela-justica-por-litigancia-de-ma-fe-e-manipulacao-de-ia/)

3. 

   14 Jul 2026

   Episode 19 | July, 2026

   In the July 2026 episode of Alice in Supply Chains, Adrian and Alexandre dig into Verizon's first-ever Breach Impact Study, a companion to the DBIR built on roughly 70,000 cyber insurance claims (accepted and rejected) contributed via Cyber AcuView between 2019 and late 2025. The medians-only approach (no averages allowed!) makes this one of the most honest looks at breach costs yet, and the findings vindicate a recurring theme of the show: availability, not confidentiality, drives losses. Business interruption has the highest median claim (~$90K) and grew 51% year over year, while regulatory fines turn out to be the smallest loss category — so maybe stop leaning on "the regulator will fine us" to justify security budgets. Software supply chain incidents are just 2% of claims but punch far above their weight, with immediate impacts more than double the rest of the dataset and extreme losses topping $100 million — cases that overwhelmingly hit policy caps, meaning the true economic damage is even higher. Adrian connects this to the rise of cascading breaches (Trivy → LiteLLM → everyone downstream), and the pair discuss why this kind of concentrated, systemic risk terrifies insurers and may reshape coverage terms. Story two is Gartner's new "Mastering TPCRM" document series, which Adrian and Alexandre praise as unusually prescriptive and genuinely useful: frameworks for roles and responsibilities across security, legal, procurement, and — critically — business owners, plus a starter TPCRM policy you can adapt. Alexandre argues the make-or-break factor for any TPCRM program is whether business owners formally own the risks they accept, rather than treating the process as a checkbox that must not slow down contracting. Finally, Schrems III is nigh: with the US Supreme Court's ruling undermining the independence of agencies like the FTC — the very foundation of the EU-US Data Privacy Framework — Max Schrems is poised to strike down transatlantic data transfer agreement number three. Alexandre walks through why the EU has painted itself into a corner (idealistic legislation, total dependence on US cloud, AI, and OS providers), what the $307 billion per year in EU spending on US cloud services means for both sides, and why every company with a transatlantic footprint should be talking to their legal counsel now. Links: Tenchi Conference 2026: Details, tickets, and CFP - https://luma.com/vvzsmej9 (https://luma.com/vvzsmej9) Story 1: Verizon Breach Impact Study - https://verizon.com/dbir (https://verizon.com/dbir) Story 2: Gartner’s Series on Mastering TPCRM - https://www.gartner.com/en/documents/7907309 (https://www.gartner.com/en/documents/7907309) Story 3: Schrems III is Nigh - https://kaynemcgladrey.com/blog/when-the-load-bearing-wall-comes-down/ (https://kaynemcgladrey.com/blog/when-the-load-bearing-wall-comes-down/)

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

YouTube views

6,927

Score snapshot 15 Sept 2025

Apple Podcasts (US)

5.0 / 5

1 ratings

Spotify

5.0 / 5

6 ratings

Podcast Authority Score: 35 / 100

A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.

Quality

27

Social presence

0

YouTube

74

Engagement

32

Contact Alice in Supply Chains

Guest appearances

Does not typically book guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.

Shows with a similar audience

• 

  Risky Business News

• 

  Risky Business

• 

  Black Hills Information Security

• 

  Cloud Security Podcast by Google