It's a Thursday afternoon when the Slack alert hits: your identity provider just published a blog post with carefully worded language that makes your stomach drop.
Three questions land simultaneously. Are we affected? What's our exposure? What should we do? You don't know the answer to any of them. Neither does anyone else.
This is vendor incident response — the urgent, high-stakes, and almost universally ad-hoc process of figuring out what someone else's security failure means for your organization. Despite the fact that 59% of companies have experienced a breach caused by a third party, almost no one has a structured methodology for the moment it happens.
This book gives you one.
Someone Else's Breach presents the DC-TPIR (Dependency-Centric Third-Party Incident Response) framework — a complete system for detecting vendor incidents, quantifying your exposure in financial terms, making defensible stay/exit/mitigate decisions under time pressure, and building institutional memory so every incident makes the next one faster and less painful.
What you'll learn:
• How to map vendor dependencies so you know exactly what's at stake before the alert arrives
• A three-component model for estimating exposure probability when your vendor says "a subset of customers may be affected"
• Bayesian updating techniques that refine your estimates as information emerges over hours and days
• Calibrated estimation methods from the superforecasting literature, adapted for incident response under pressure
• A structured decision framework that replaces gut feel and the loudest voice in the room with quantified cost-benefit analysis
• How to build institutional memory that compounds — so the second incident with the same vendor takes thirty minutes instead of six hours
• Proactive resilience design and vendor chaos engineering practices drawn from Kelly Shortridge's security chaos engineering work
• How to use AI to compress your detection-to-decision timeline from hours to minutes — and how to assess the AI-specific risks your vendors are introducing, informed by the Databricks AI Security Framework (DASF)
• SEC 8-K materiality determinations, board-ready reporting, and audit trails that satisfy regulators
Includes two full end-to-end worked examples (an identity provider breach and a cascading AWS availability incident), ready-to-use templates for decision records, chaos experiment specifications, and vendor AI risk assessments, plus a phased implementation roadmap you can start this week.
Written for CISOs, third-party risk managers, security architects, GRC professionals, and anyone who ends up in the emergency meeting when a vendor has a bad day.
