Paul Foley, CTO of qashqade, has long believed that operational resilience doesn’t stop at your own firewall. As private markets continue to digitize and outsource critical operations, the weakest link is no longer inside your systems, it’s in your supply chain.
“Too many vendor discussions stop at ‘Do you have disaster recovery?’” Paul notes. “The real questions should be: What do you test? How do you test it? What were the outcomes?” In other words, it’s time to shift from a compliance mindset to a capability mindset from feeling safe to being safe.
With regulators and clients expecting more transparency, supply chain resilience is no longer optional. It’s the next frontier.
The Missing Piece in Resilience Conversations
While many firms have made progress on internal operational resilience (business continuity, cyber posture, cloud transformation) the risk that remains least visible yet most impactful is what happens when a key third-party fails.
That’s why Paul advocates for going beyond tick-box due diligence:
- Ask for real evidence of third-party testing outcomes
- Understand not just what your vendors promise but what they’ve proven
- Demand shared learning and transparency around risks
“Feeling safe isn’t the same as being safe,” Paul warns.
From Assumptions to Evidence-Based Supply Chain Resilience
Modern supply chain risk management requires moving from assumptions to action:
- Risk must be quantified, not theorized
- Controls must be measured and verified, not assumed
- Contracts should enable monitoring, not just indemnify loss
This evolution is especially critical in private markets, where outsourcing spans fund administration, data processing, and reporting.
“Supply chain resilience has to be predictive, proactive, and based on real data—not vendor assurances.”
The Role of AI and Next-Gen SIEMs
Many firms have Security Information and Event Management (SIEM) platforms but few use them beyond alerts. Paul sees huge untapped potential:
- Integrating threat intelligence across vendor networks
- Using predictive analytics to anticipate outages, fraud risks, or misconfigurations
- Applying AI to surface anomalies that would be invisible to manual processes
“As AI matures, SIEMs will help us see around corners, not just clean up after failure,” Paul explains.
Preparing for the Next Chapter of Resilience
Firms that lead on supply chain resilience will gain a critical edge not just in audits or certifications, but in client trust and long-term stability. This isn’t a future concern. It’s a right now concern.
Want to go deeper on building resilience across your infrastructure, teams, and vendors?
Download our free eBook: Operational Resilience in Private Markets, featuring Paul Foley’s complete interview.
