Black Kite Research Unveils Alarming Cybersecurity Gaps in AI Supply Chain
In a recently published report, Black Kite, a prominent player in third-party cyber risk intelligence, has highlighted serious vulnerabilities present within the AI supply chain. This comprehensive study analyzed security weaknesses across 18,160 AI companies globally, unveiling a worrying trend: numerous suppliers, despite their advanced technological capacities, are still grappling with fundamental security measures.
The report, titled "The Risks Behind Your AI Relationships," raises alarms about the increasing third-party cyber risks that organizations expose themselves to as they integrate AI into core business functions. Dr. Ferhat Dikbiyik, Chief Research Intelligence Officer at Black Kite, emphasized that while AI technologies are evolving rapidly, the foundational security practices within the companies that provide these technologies are alarmingly inadequate. He stated, "The AI supply chain isn't failing in exotic ways. It's failing in ordinary ones," indicating that basic oversights in patch management and email security are prevalent among AI suppliers.
The data reveals that approximately 34.2% of AI companies have critical unpatched vulnerabilities. Perhaps most concerning is that nearly 10% of these companies had flaws acknowledged in the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities catalog, indicating that these vulnerabilities have already been exploited in real-world cyber attacks.
Moreover, a staggering 61.7% of AI companies were found to have weaknesses in basic email security, with many susceptible to phishing attacks due to their inadequate Domain-based Message Authentication, Reporting & Conformance (DMARC) implementation. Such vulnerabilities may allow cybercriminals to impersonate legitimate domains to launch fraud efforts — a scenario that poses considerable risks to organizations that rely on these AI suppliers.
The issue of ransomware susceptibility is equally troubling. Nearly 30% of the assessed companies scored at or above 0.4 on Black Kite's Ransomware Susceptibility Index (RSI), indicating they are at heightened risk of ransomware attacks. In addition to software vulnerabilities and email weaknesses, Black Kite identified unusual network activity in 44.3% of AI companies assessed. This statistic hints at a pressing need for vigilance as suspicious behaviors can often be precursors to serious breaches.
Even well-known leaders in the AI sector are not immune to these security challenges. Among the Forbes AI 50, over half (52%) were reportedly found to have critical unpatched vulnerabilities. Despite their prominence, these findings serve as a stark reminder that no company can afford to overlook the need for rigorous cybersecurity assessments.
The risks associated with evolving AI technologies do not exist in isolation, as vulnerabilities in widely used software packages can result in broader exposure across the AI landscape. For instance, Black Kite identified that 5.2% of AI companies were affected by the recently disclosed PHP2Shell vulnerabilities, underscoring how a singular flaw can propagate risk throughout the ecosystem.
Furthermore, certain AI suppliers who develop and manage customer-facing AI technologies experience particularly acute risks. The report indicates that nearly 19.9% of cloud AI solution providers had corporate logins breached, whereas less than 5% of model and platform developers faced similar issues. These suppliers often have extensive access to sensitive data and infrastructure, which accentuates the importance of stringent credential protection measures.
In light of these substantial findings, Black Kite channels its recommendations towards fostering more robust cybersecurity practices. Organizations must continuously monitor their AI suppliers for potential security weaknesses, be vigilant about shared software dependencies, prioritize remediating risks based on their impact on business processes, and thoroughly assess the access that AI applications and integrations have within their networks.
The insights provided by Black Kite in the "2026 AI Supply Chain Report" serve as a cautionary tale for businesses navigating the complexities of an AI-integrated future. With the stakes higher than ever, it’s crucial for organizations to rethink their approaches to third-party risk management as they evolve in an increasingly connected landscape. To read the full report, visit https://blackkite.com/reports/ai-supply-chain-report-2026.
The report, titled "The Risks Behind Your AI Relationships," raises alarms about the increasing third-party cyber risks that organizations expose themselves to as they integrate AI into core business functions. Dr. Ferhat Dikbiyik, Chief Research Intelligence Officer at Black Kite, emphasized that while AI technologies are evolving rapidly, the foundational security practices within the companies that provide these technologies are alarmingly inadequate. He stated, "The AI supply chain isn't failing in exotic ways. It's failing in ordinary ones," indicating that basic oversights in patch management and email security are prevalent among AI suppliers.
The data reveals that approximately 34.2% of AI companies have critical unpatched vulnerabilities. Perhaps most concerning is that nearly 10% of these companies had flaws acknowledged in the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities catalog, indicating that these vulnerabilities have already been exploited in real-world cyber attacks.
Moreover, a staggering 61.7% of AI companies were found to have weaknesses in basic email security, with many susceptible to phishing attacks due to their inadequate Domain-based Message Authentication, Reporting & Conformance (DMARC) implementation. Such vulnerabilities may allow cybercriminals to impersonate legitimate domains to launch fraud efforts — a scenario that poses considerable risks to organizations that rely on these AI suppliers.
The issue of ransomware susceptibility is equally troubling. Nearly 30% of the assessed companies scored at or above 0.4 on Black Kite's Ransomware Susceptibility Index (RSI), indicating they are at heightened risk of ransomware attacks. In addition to software vulnerabilities and email weaknesses, Black Kite identified unusual network activity in 44.3% of AI companies assessed. This statistic hints at a pressing need for vigilance as suspicious behaviors can often be precursors to serious breaches.
Even well-known leaders in the AI sector are not immune to these security challenges. Among the Forbes AI 50, over half (52%) were reportedly found to have critical unpatched vulnerabilities. Despite their prominence, these findings serve as a stark reminder that no company can afford to overlook the need for rigorous cybersecurity assessments.
The risks associated with evolving AI technologies do not exist in isolation, as vulnerabilities in widely used software packages can result in broader exposure across the AI landscape. For instance, Black Kite identified that 5.2% of AI companies were affected by the recently disclosed PHP2Shell vulnerabilities, underscoring how a singular flaw can propagate risk throughout the ecosystem.
Furthermore, certain AI suppliers who develop and manage customer-facing AI technologies experience particularly acute risks. The report indicates that nearly 19.9% of cloud AI solution providers had corporate logins breached, whereas less than 5% of model and platform developers faced similar issues. These suppliers often have extensive access to sensitive data and infrastructure, which accentuates the importance of stringent credential protection measures.
In light of these substantial findings, Black Kite channels its recommendations towards fostering more robust cybersecurity practices. Organizations must continuously monitor their AI suppliers for potential security weaknesses, be vigilant about shared software dependencies, prioritize remediating risks based on their impact on business processes, and thoroughly assess the access that AI applications and integrations have within their networks.
The insights provided by Black Kite in the "2026 AI Supply Chain Report" serve as a cautionary tale for businesses navigating the complexities of an AI-integrated future. With the stakes higher than ever, it’s crucial for organizations to rethink their approaches to third-party risk management as they evolve in an increasingly connected landscape. To read the full report, visit https://blackkite.com/reports/ai-supply-chain-report-2026.
Topics Business Technology）
【About Using Articles】
You can freely use the title and article content by linking to the page where the article is posted.
※ Images cannot be used.
【About Links】
Links are free to use.