CISO's open letter on third-party software risk is a call to action

This briefing outlines JPMorgan Chase CISO Pat Opet's warning that the ubiquity of SaaS creates concentrated, systemic risk due to overly permissive identity integrations, opaque third- and fourth-party dependencies, and rushed vendor practices; it catalogs recent supply-chain issues and misconfigurations and calls for stronger third-party software risk management (TPSRM). The piece advocates adopting SaaSBOMs (extended bills of materials) to inventory external services, improve visibility, enable risk scoring, and drive secure-by-default vendor behavior to mitigate SaaS-related exposures.