CCT 355: Zapier Breach Lessons For Cloud Security and Setting Up TPRM Program in 15 Minutes

About this episode

The episode discusses lessons from a Zapier breach and how to quickly set up a Third Party Risk Management program.

Send us Fan Mail The breach that takes down a company often does not kick in the front door. It walks in through a “simple” integration you set up months ago, powered by a token no one remembered to rotate. We start with a real-world Zapier-style scenario and unpack how researchers chained together a harmless-looking code block, an AWS Lambda environment, and a misconfigured IAM role to reach private repository files and ultimately an NPM token that could enable a supply chain attack. From t...

People in this episode

Host: Shon Gerber

Topics covered

• cloud security
• TPRM program
• supply chain attack
• cybersecurity
• integration risks

Keywords

• Zapier breach
• cloud security
• TPRM
• AWS Lambda
• IAM role
• supply chain attack
• cybersecurity

Mentioned in this episode

Organizations: Zapier, AWS, NPM

More episodes of CISSP Cyber Training Podcast - CISSP Training Program

• CCT 356: Supply Chain Attacks Are Exploding in 2026 — Here's What the NCSC Wants You to Do · June 8, 2026 · 42 min
• CCT 354: Data Security Controls and Compliance Requirements for the CISSP (Domain 2.3) - REPLAY · June 1, 2026 · 37 min
• CCT 353: AI Agent Governance Essentials - CISSP Practice Questions · May 28, 2026 · 28 min
• CCT 352: Data Security Controls and Compliance Requirements for the CISSP (Domain 2.3) - REPLAY · May 25, 2026 · 40 min
• CCT351: BitLocker Bypass Reality Check (YellowKey) and CISSP Practice Questions · May 21, 2026 · 24 min
• CCT 350: Investigation Types Made Simple - CISSP Training (Replay) · May 18, 2026 · 45 min