--- title: "Put the Car in Gear and Shift Correctly: Highlights From SANS DFIR Summit" description: Learn how to effectively manage third-party application risks in cybersecurity with a strategic image: https://vorlon.io/hubfs/gear%20shift.webp --- [Third Party Risk Management](https://vorlon.io/third-party-risk-management) > Put the Car in Gear and Shift Correctly: Highlights From SANS DFIR Summit # Put the Car in Gear and Shift Correctly: Highlights From SANS DFIR Summit [Sasiel Saadon](https://vorlon.io/third-party-risk-management/author/sasiel-saadon) | Sep 03, 2024 [![Share on linkedin](https://vorlon.io/hubfs/ll-assets/Images/Icons/LinkedIn.svg) ](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fvorlon.io%2Fthird-party-risk-management%2Fput-the-car-in-gear-and-shift-correctly-highlights-from-sans-dfir-summit%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://vorlon.io/hubfs/ll-assets/Images/Icons/X.svg) ](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fvorlon.io%2Fthird-party-risk-management%2Fput-the-car-in-gear-and-shift-correctly-highlights-from-sans-dfir-summit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fvorlon.io%2Fthird-party-risk-management%2Fput-the-car-in-gear-and-shift-correctly-highlights-from-sans-dfir-summit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=Put+the+Car+in+Gear+and+Shift+Correctly%3A+Highlights+From+SANS+DFIR+Summit) [![Share on email](https://vorlon.io/hubfs/ll-assets/Images/Icons/envelope.svg) ](mailto:?subject=Check%20out%20https%3A%2F%2Fvorlon.io%2Fthird-party-risk-management%2Fput-the-car-in-gear-and-shift-correctly-highlights-from-sans-dfir-summit%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fvorlon.io%2Fthird-party-risk-management%2Fput-the-car-in-gear-and-shift-correctly-highlights-from-sans-dfir-summit%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Put the Car in Gear and Shift Correctly: Highlights From SANS DFIR Summit](https://vorlon.io/hs-fs/hubfs/gear%20shift.webp?width=1200&height=820&name=gear%20shift.webp) Last week, at the SANS DFIR Security Summit, my colleague Mike Cioffi and I had the opportunity to dive deep into an often overlooked but critical aspect of cybersecurity: the management of third-party application risks. During our 30-minute discussion, we aimed to shed light on common challenges and misconceptions surrounding this topic. You can view the [full presentation here.](https://vorlon.io/hubfs/SS%2c%20MC-%20Reducing%20Third-Party%20Application%20Risks%20%20Shifting%20Correctly.mp4)   **Identifying the Unseen Threats** It’s a tough pill to swallow when someone points out a problem you didn’t know you had. That was our role last week—to be the bearers of inconvenient truths about your API security strategy and third-party landscape. Our goal was not just to spotlight these issues but also to guide the audience toward a strategic approach to managing them effectively.   **The Escalating Problem** As organizations increasingly integrate third-party applications, each new connection introduces potential vulnerabilities. Risks such as sensitive data theft, supply chain API attacks, and ungoverned Network Host Interfaces (NHIs) become more prevalent. These threats illustrate the complex web of dependencies and the lack of control that can exacerbate security challenges.   **Beyond Shifting Left or Right: Shifting Correctly** Traditional security strategies often emphasize “Shifting Left”—integrating security early in the development process. However, this approach falls short with third-party applications for several reasons: - Lack of access to original source code and control over released versions. - Varying levels of security maturity among different vendors. - Dependency on other third-party components that remain outside vendor control. On the other hand, “Shifting Right”—which focuses on continuous monitoring and review—alone isn’t sufficient either. Although it’s crucial for identifying and mitigating risks in real-time, it must be part of a more comprehensive strategy.   **Shifting Correctly: A Holistic Approach** Our recommended strategy, “Shifting Correctly,” combines proactive and reactive measures to manage third-party applications effectively: - **Mapping and Understanding Integrations:** Knowing which applications interact and how they are connected is the first step. - **Identifying Mission-Critical Applications:** Recognizing and prioritizing the security of applications that are crucial to business operations. - **Continuous Monitoring:** Implementing real-time monitoring across all third-party applications to detect any abnormal activity quickly. - **Detailed Risk Assessments and Accountability:** Each application’s complexity and business impact must be assessed. Additionally, understanding who owns each API key/token is vital for accountability and security. - **Monitoring Overly Permissive Secrets and Sensitive Data Flows:** Keeping an eye on how sensitive information is shared between applications and ensuring that access permissions are strictly regulated. By embracing both proactive and preventive approaches, organizations can significantly reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR), enhancing their overall security posture.   **Looking Forward** Our talk was just the beginning. As threats evolve, so too must our strategies to counter them. By understanding and implementing a balanced approach to API security and third-party management, we can safeguard our data and systems more effectively than ever before.  If you’d like to continue the conversation, [request a demo here](https://go.vorlonsecurity.com/vorlon-demo). View the full [presentation here](https://vorlon.io/hubfs/SS%2c%20MC-%20Reducing%20Third-Party%20Application%20Risks%20%20Shifting%20Correctly.mp4) or [download the slides](https://vorlon.io/hubfs/2024-SANS-DFIR-Event-Slides-Security-Track.pdf).  About the author ![Sasiel Saadon](https://vorlon.io/hs-fs/hubfs/Sasiel%20Saadon%20headshot%20clear%20bg.png?width=120&height=120&name=Sasiel%20Saadon%20headshot%20clear%20bg.png) [Sasiel Saadon](https://vorlon.io/third-party-risk-management/author/sasiel-saadon) [Follow me on LinkedIn ](https://www.linkedin.com/in/sasielsaadon/) Sasiel Saadon, Director of Engineering at Vorlon, is a software engineering leader with expertise in software development and complex SaaS/web applications. He has progressed through multiple roles at Vorlon over nearly three years, advancing from ... [Read Full Bio](https://vorlon.io/third-party-risk-management/author/sasiel-saadon) [![ShinyHunters Sidebar Ad](https://vorlon.io/hs-fs/hubfs/Images%20-%202026/2026%20CISO%20Report%20Banner%20Ad%20Final.png?width=350&height=520&name=2026%20CISO%20Report%20Banner%20Ad%20Final.png) ](https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLIFqhHbvMXr9sCtLg3SjGyxucXLDGAEZ6p7hVq%2FHj73J5jIl21ntspuXck0FDhLa5AoCVIiV6UPoFdmfyoCgk5gZhyQN0vNpJbQcKsyBPMqUuCsA79wUgKn%2BCq0jST2BYpRcl6MQO1nqRSUKrW04CR0pGt7umY8qquGOnnq3HJ0%2FYgVqp01i6ughr1Bd0ujJd4m2N8PUt6sJyfXCE46FwKHWOIg3dceObp%2BtoycGA%3D%3D&portalId=24426272) ### Related blogs [View all blogs](https://vorlon.io/blog) [![FinServ Third-Party Risk Management: Meet the Execution Layer](https://vorlon.io/hs-fs/hubfs/BLOG%20FinServ%20Third%20Party%20Risk%20Management%20Meet%20the%20Execution%20Layer-1.png?width=400&height=300&name=BLOG%20FinServ%20Third%20Party%20Risk%20Management%20Meet%20the%20Execution%20Layer-1.png) Security Insights ### FinServ Third-Party Risk Management: Meet the Execution Layer 6 min read Read More ](https://vorlon.io/third-party-risk-management/finserv-tprm-meet-the-execution-layer) [![What Is Third-Party Risk Management? A Comprehensive Guide](https://vorlon.io/hs-fs/hubfs/Third-Party%20Risk%20Management.webp?width=400&height=300&name=Third-Party%20Risk%20Management.webp) ### What Is Third-Party Risk Management? A Comprehensive Guide 8 min read Read More ](https://vorlon.io/third-party-risk-management/what-is-third-party-risk-management) [![Mean Time To What!?](https://vorlon.io/hs-fs/hubfs/MTTC.png?width=400&height=300&name=MTTC.png) Third-Party Apps ### Mean Time To What!? 2 min read Read More ](https://vorlon.io/third-party-risk-management/mean-time-to-what) ## Featured resources [![CISO Report Resource Tile](https://vorlon.io/hs-fs/hubfs/CISO%20Report%20Resource%20Tile.webp?width=1548&height=1046&name=CISO%20Report%20Resource%20Tile.webp) WHITE PAPERS AND RESEARCH ### The Agentic Ecosystem SecurityGap: 2026 CISO Report Why 99% of Organizations Were Breached Through Their SaaS and AI Ecosystem Despite Record Security Investment Read more ](https://go.vorlon.io/vorlon-2026-ciso-report-agentic-ecosystem-security-gap) [![blog 451 why saas and ai are converged (1)](https://vorlon.io/hs-fs/hubfs/Images%20-%202026/blog%20451%20why%20saas%20and%20ai%20are%20converged%20(1).png?width=329&height=222&name=blog%20451%20why%20saas%20and%20ai%20are%20converged%20(1).png) SaaS Security ### 451 Research: Why AI and SaaS Security Are Converging 451 Research highlights how AI and SaaS security are converging. Learn why integrations, OAuth, and ecosystem-level risk now define enterprise security. Read more ](https://vorlon.io/saas-security-blog/451-research-ai-saas-security-convergence) [![datamatrix patent blog](https://vorlon.io/hs-fs/hubfs/datamatrix%20patent%20blog.png?width=1548&height=1046&name=datamatrix%20patent%20blog.png) ### DataMatrix™: Vorlon's Patented Approach to Agentic Ecosystem Security Vorlon's DataMatrix™ technology is now patented. Learn how this intelligent simulation engine secures the agentic ecosystem by mapping AI agents, SaaS integrations, and data in motion. Read more ](https://vorlon.io/saas-security-blog/datamatrix-vorlons-patented-technology) ## Get Proactive Security for Your Agentic Ecosystem Book a Demo [![Vorlon_Logo_Large_White](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/Vorlon_Logo_Large_White.png?width=139&height=33&name=Vorlon_Logo_Large_White.png) ](https://vorlon.io) ## Sign up for industry insights and Vorlon news Start Here - [The Agentic Ecosystem Security Gap](https://vorlon.io/problems-we-solve) - [The Agentic Ecosystem Signal to Action Layer](https://vorlon.io/our-solution) Platform - [Platform](https://vorlon.io/platform) - [AI Agent Runtime Security](https://vorlon.io/ai-runtime-security) - [Total Identity Security](https://vorlon.io/total-identity-security) - [Data-Centric SaaS Security](https://vorlon.io/data-centric-saas-security) - [Compliance Automation](https://vorlon.io/compliance-automation) - [Apps Directory](https://vorlon.io/app-directory) - [SecOps Integrations](https://vorlon.io/integrations) Company - [About](https://vorlon.io/about) - [Careers](https://vorlon.io/careers) - [Press Room](https://vorlon.io/press-room) - [Resources](https://vorlon.io/resources) - [Blog](https://vorlon.io/blog) Let's Connect - Talk to Sales ![soc-type-2](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/soc-type-2.jpg?width=105&height=50&name=soc-type-2.jpg)![aws logo cropped](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/aws%20logo%20cropped.png?width=50&height=50&name=aws%20logo%20cropped.png)![latio innovators on black](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/latio%20innovators%20on%20black.png?width=52&height=50&name=latio%20innovators%20on%20black.png)![2025-CRN-Stellar-Startups](https://vorlon.io/hs-fs/hubfs/Logo/2025-CRN-Stellar-Startups.webp?width=29&height=50&name=2025-CRN-Stellar-Startups.webp)![FS-ISAC-Seal_Affiliate_onblack](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/FS-ISAC-Seal_Affiliate_onblack.png?width=156&height=50&name=FS-ISAC-Seal_Affiliate_onblack.png) © 2026 Vorlon Inc. All rights reserved. - [Terms of Use](https://vorlon.io/terms-of-use) - [Privacy Policy](https://vorlon.io/privacy-policy) - [Sitemap](https://vorlon.io/sitemap) [![ClickCease](https://monitor.clickcease.com/stats/stats.aspx)](https://www.clickcease.com) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Sasiel Saadon", "url" : "https://vorlon.io/third-party-risk-management/author/sasiel-saadon" }, "dateModified" : "2025-09-15T11:03:58.494Z", "datePublished" : "2024-09-03T12:45:00.000Z", "headline" : "Put the Car in Gear and Shift Correctly: Highlights From SANS DFIR Summit", "image" : [ "https://vorlon.io/hubfs/gear%20shift.webp" ], "mainEntityOfPage" : { "@id" : "https://vorlon.io/third-party-risk-management/put-the-car-in-gear-and-shift-correctly-highlights-from-sans-dfir-summit", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://vorlon.io/hubfs/Logo/Vorlon%20logo_two%20tone%20light.svg" }, "name" : "Vorlon Inc." } } ```