Should infosec leaders approach third-party risk management, or other vendor-related processes, any differently when it comes to GenAI tools?

Similarly, I do not see a need to alter our third-party risk management processes specifically for GenAI tools. We utilize a dual approach involving questionnaires and technical assessments to understand and manage vendor risks. This method remains effective regardless of whether we are dealing with traditional technologies or new advancements like GenAI.

I believe that the approach to third-party risk management should remain consistent, even with the introduction of GenAI tools. The fundamental processes and strategies we employ for assessing and managing risks with vendors do not fundamentally change just because the technology involved is new or different.