Vulnerabilities at small, deep suppliers

Beyond Third Parties: Mapping Fourth-Party Risk and Early-Stage Suppliers – with Layla White (TechPassport)

Episode overview

Season 2 opens with a practical deep dive into one of the hardest problems in modern third-party risk management: understanding what sits beyond your immediate suppliers. Mike is joined by Layla White, founder of TechPassport, to unpack why fourth- and fifth-party dependencies remain opaque, how early-stage suppliers change the risk profile, and why traditional questionnaires and web-scraping approaches struggle to keep up with today’s supply chains.

The conversation blends lived experience from financial services procurement and vendor management with a grounded look at how supply chain mapping actually works in the wild, where outages, cloud concentration, geopolitics, and cyber incidents collide.

What you’ll hear in this episode

• Why fourth- and fifth-party risk is still a blind spot for many organisations
• The limits of questionnaires and AI/web-scraped data for mapping supply chains
• How to identify critical dependencies deeper in the supply chain
• The problem of hidden concentration risk (especially with cloud and shared infrastructure)
• Why small suppliers and early-stage tech firms introduce different resilience risks
• The importance of validating supplier-provided data rather than guessing from public sources
• How outages propagate through unseen dependencies
• Why supply chain risk now stretches beyond cyber into resilience, data, ESG, and modern slavery
• Where regulation is pushing firms to understand and evidence extended dependencies

Key takeaways

• Supply chain risk is no longer a third-party problem. The real fragility often sits further down the chain.
• Public signals and scraped data are useful clues, not ground truth. Critical dependencies usually only emerge when suppliers confirm them directly.
• Concentration risk is rarely obvious until something breaks. Mapping dependencies before an incident is the difference between response and surprise.
• Early-stage suppliers need structure and support to meet enterprise expectations, not just scrutiny.
• Effective TPRM is a system of approaches, not a single tool. Questionnaires, live data, mapping, and supplier engagement all have different strengths.

Guest bio

Layla White is the founder of TechPassport, a platform focused on improving how organisations gather and manage supplier information, map extended supply chains, and engage early-stage technology providers. Layla previously worked in financial services procurement and vendor management, where she experienced first-hand the friction, delays, and blind spots that exist in traditional third-party onboarding and supply chain visibility.

Who this episode is for

• Third-Party Risk and Operational Resilience leaders
• Procurement and Vendor Management teams
• Cyber and Cloud risk practitioners
• Risk, Compliance, and Resilience professionals
• Anyone grappling with fourth-party visibility, concentration risk, or supplier onboarding in complex ecosystems

Listen to the episode

🎧 Full episode: https://thirdpartytherapy.com

Tags / themes

TPRM, Fourth-Party Risk, Supply Chain Mapping, Concentration Risk, Operational Resilience, Early-Stage Suppliers, Cloud Dependencies, Cyber Resilience