Appendix
Security Findings by Company Size, Age, and Funding
The AI ecosystem is young and small. Among companies with a recorded headcount, 87% have fewer than 50 employees and nearly half have ten or fewer. Among companies with a recorded founding year, more than half were founded in 2022 or later. That profile explains the limited footprint seen above, and it also hides where the exposure sits.
Every finding in this study rises with company size. Critical unpatched vulnerabilities appear at 26% of AI companies with ten or fewer employees, 42% of those with 11 to 50, 54% of those with 51 to 100, and roughly two in three of those with more than 250. Employee credentials in infostealer logs follow the same curve more steeply: 1.7% at the smallest companies, 22% at 51 to 100 employees, and about half of companies with more than 250. The share at or above the critical ransomware threshold climbs from 23% to over 50%. The pattern holds when companies with a limited footprint are excluded. Part of the vulnerability difference is simply more infrastructure to scan; stolen employee credentials are not, and they rise fastest of all.
The same curve appears by age and by capital. Companies founded before 2014 show double the critical-vulnerability rate of those founded in 2023 or later (52% against 26%), and 24 times the infostealer rate (24% against 1%). Where funding is disclosed, companies that have raised more than $250 million show a critical-vulnerability rate of 69% and an infostealer rate of 34%, against 31% and 5% for those that have raised less than $1 million.
For a third-party cyber risk program, the implication is direct. The companies an organization is most likely to contract with, established vendors with real teams and real customers, are also the ones most likely to carry a critical vulnerability, exposed credentials, and an elevated ransomware profile. Among AI companies with more than 50 employees, 58% had a critical unpatched vulnerability, 29% had credentials in infostealer logs, and 49% were at or above the ransomware threshold.