The Value Chain Risk Institute

Nonprofit measuring vendor and software supply chain risk in the open. Weekly briefing every Tuesday: what changed, who it hits, why it matters.

[The Value Chain Risk Institute @ValueChainRisk]

BSides Delaware day two: registration 9 AM, first talk 10 AM. #BSidesDE

[The Value Chain Risk Institute @ValueChainRisk]

Your CRA manual already knows how its parts connect. Our builder now reads it and drafts the links. You decide which stay. #CRA https://t.co/S1d5UGMGmF

[The Value Chain Risk Institute @ValueChainRisk]

BSides Delaware day one: check-in 8 AM, talks from 9. Have a great con, everyone. #BSidesDE

[The Value Chain Risk Institute @ValueChainRisk]

@BSidesDE It is absolutely our pleasure. I am on the way to start the coffee pot now.

[The Value Chain Risk Institute @ValueChainRisk]

BSides Delaware starts tomorrow. Check-in 8 AM, first talk 9 AM, 591 Collaboration Way, Newark. #BSidesDE

[The Value Chain Risk Institute @ValueChainRisk]

Proud to sponsor #BSidesDE2026, this Fri and Sat, 13 to 14 Nov, at UD in Newark. Thank you, organizers and volunteers. https://t.co/xoPxtoKnp5

[The Value Chain Risk Institute @ValueChainRisk]

"We run solid PHP" is not an answer to "is it patched." Ask which version. #ThirdPartyRisk

[The Value Chain Risk Institute @ValueChainRisk]

A tool that counts blanks, you can trust. A tool that grades your writing, you second-guess. Count mechanically, judge humanly. #CRA https://t.co/E70vUthnDo

[The Value Chain Risk Institute @ValueChainRisk]

Filtered out in training. Back for about $80 of fine-tuning (UK AISI, one study). Ask what a safety claim rests on. #AISupplyChain

[The Value Chain Risk Institute @ValueChainRisk]

Benchmarks say what an AI model can do in a lab. Evidence says what it did in yours. Ask for the second. #AIRisk https://t.co/nOi4CQuiaq

[The Value Chain Risk Institute @ValueChainRisk]

One week to BSides Delaware. Nov 13 to 14, STAR Campus, Newark. https://t.co/PurlXTfv4O #BSidesDE

[The Value Chain Risk Institute @ValueChainRisk]

The agent finished the job. What it created did not. Ask your vendors who owns it. #AIRisk

[The Value Chain Risk Institute @ValueChainRisk]

In our testing, two of nine AI models did exactly what the memo asked. Every single time. #AIsecurity

[The Value Chain Risk Institute @ValueChainRisk]

A real result from our AI testing: same model, same kind of request. Only the job title changed. #AIsecurity

[The Value Chain Risk Institute @ValueChainRisk]

Ten days to BSides Delaware: Pros V Joes CTF, ham radio village, RF CTF. Nov 13 to 14, Newark. https://t.co/xoPxtoKnp5 #BSidesDE

[[email protected] @BSidesDE]

Check out @ValueChainRisk's latest research on AI agent security and #SupplyChainRisk: "Plugin4Shell Is Agent Drift" 🤖🛡️
Discover how evidence-based reconciliation protects AI toolchains at https://t.co/WLrbMOhtBr!
📖 Read here: https://t.co/RSPznoyXlj
#AISecurity #InfoSec

[[email protected] @BSidesDE]

Proud to welcome @ValueChainRisk as a #BSidesDE2026 sponsor! 🚀
VCRI is a nonprofit measuring vendor & software security from evidence, not questionnaires. Check out their free open tools & methods at https://t.co/WLrbMOhtBr!
#SupplyChainRisk #InfoSec

[The Value Chain Risk Institute @ValueChainRisk]

UK AISI: capability filtered out of open model training came back with about $80 of fine-tuning. Ask what a model's safety claim rests on. https://t.co/g55a0o7cST

[The Value Chain Risk Institute @ValueChainRisk]

MITRE ATLAS now covers what AI agents leave behind: identities, storage and compute that may outlive the agent's run. Ask your vendors. https://t.co/m3bgzswjCU

[The Value Chain Risk Institute @ValueChainRisk]

METR reviewed Anthropic's AI risk report: risk is low, but mainly because capabilities are limited, not because of safeguards. Ask suppliers what low risk rests on. https://t.co/eAadjgucWs