HITRUST’s Tom Kellermann on Third-Party Risk, Defending Against Persistent Access
By Tom Field (SecurityEditor)
Island hopping is no longer just a network threat. It’s evolving across cloud, APIs and artificial intelligence tools, as attackers attempt to hijack an organization’s infrastructure to target customers, partners and government agencies. This persistent form of supply chain attacks requires urgent changes to third-party risk practices, said vice president of cyber risk at HITRUST Tim Kellermann.
As geopolitical tensions intensify, attackers are embedding themselves deeper and longer into environments through access mining and agentic AI manipulation. The key to mitigating this threat, Kellermann said, lies in AI security assessments, stronger third-party certifications and updated service-level agreements.
“Most people haven’t dealt with the true beast within ransomware, which is that secondary RAT or rootkit that’s been put on a sleep cycle,” Kellermann said. “And now, as everyone embraces AI, they don’t understand how the AI itself can become that dark passenger.”
In a video interview with Information Security Media Group, Kellermann discussed:
How island hopping has evolved from networks to AI environments;
Why AI assessments must include model poisoning and persistence checks;
The need to revise SLAs and risk agreements for modern third-party threats.
Vice president of cyber risk at HITRUST, Tom Kellermann previously led cyber strategy at Contrast Security. Prior to that he served as head of cybersecurity strategy at VMware and was the CEO of Strategic Cyber Ventures. He served on the Commission on Cyber Security for the 44th president of the United States and was an adviser to the International Cyber Security Protection Alliance. He was also the chief cybersecurity officer for Trend Micro, responsible for the analysis of emerging cybersecurity threats and relevant defensive technologies.
