Black Kite’s 2026 AI Supply Chain Report: The Risks Behind Your AI Relationships
What happened
Black Kite released its 2026 AI Supply Chain Report after analyzing 18,160 companies that provide AI products and services. The study found that over one-third of these companies had at least one critical unpatched security vulnerability, and more than 60% had weaknesses in email authentication. The report also identified that customers of AI companies can inherit security risks through suppliers’ infrastructure and software integrations. The findings are based on data collected in September and October 2026.
Key details
- 18,160 AI companies were assessed in the report.
- 34.2% had at least one critical unpatched vulnerability.
- 61.7% had DMARC email authentication weaknesses; DKIM and SPF weaknesses were found at 37.3% and 11.2%, respectively.
- 9.8% had vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog.
- 29.7% met or exceeded Black Kite’s critical ransomware susceptibility threshold.
Why it matters
Organizations that purchase AI products or services may face increased cybersecurity risks due to vulnerabilities in their suppliers’ systems and integrations. This means businesses must thoroughly review the security of their AI vendors, not just the AI products themselves, to avoid exposure to attacks or data breaches. The report highlights the need for enterprise security teams to assess supplier infrastructure, integration permissions, and credential management to protect their own systems.