Layer 1: The AI company
Beyond Patching: Signs of Malicious Activity and Stolen Credentials
Identifying vulnerable software is only one part of understanding a supplier's cybersecurity risk. A broader assessment also considers suspicious network activity, signs of botnet involvement, and corporate login information that may have been stolen by malware.
Unusual network behavior
Black Kite identified unusual network activity at 44.3% of the AI companies in the study. Every organization’s network has a normal rhythm: the systems it talks to, the volume of data it moves, and the ports it uses. Black Kite analyzes network traffic records (NetFlow) to establish that baseline for each company and flags significant departures from it, such as connections to high-risk or never-before-seen addresses, sudden spikes in outbound data, or traffic on unexpected ports. These are the patterns that typically accompany data theft or communication with attacker-controlled servers, which is why they deserve investigation even when no vulnerability has been found.
Botnet Infection
Black Kite identified Botnet Infection findings at 6.5% of the AI companies in the study. These findings link IP addresses associated with the companies to sources reporting botnet activity. Botnets are networks of compromised devices used by attackers to distribute malware, send spam, and launch cyberattacks.
Such findings warrant investigation into potentially malicious activity involving a supplier's infrastructure, although an IP reputation match alone does not confirm that the company experienced a compromise.
The two findings also overlap: of the 1,771 AI companies with a known exploited vulnerability, 14.7% (260 companies) also had Botnet Infection findings, meaning the same supplier shows both an exploitable weakness and infrastructure already associated with malicious activity.
This overlap matters. These suppliers present two different security concerns: a vulnerability with a documented history of exploitation and network infrastructure associated with botnet activity.
Their coexistence gives security teams a stronger reason to investigate the affected supplier and determine whether the findings involve business-critical systems.
Stolen credentials
Information-stealing malware can collect saved usernames, passwords, and other login details from infected computers. Those records may later become available to criminals, creating opportunities for unauthorized account access.
Corporate login information associated with 6.8% of the AI companies in the study appeared in records collected by information-stealing malware. These included credentials related to company services and third-party business applications such as cloud platforms and collaboration tools.
For customers, the concern extends beyond the AI supplier's own systems. Corporate credentials may also provide access to cloud platforms, development environments, collaboration tools, and other services supporting the AI product.
If stolen credentials remain valid and are misused, an attacker may be able to reach systems or information that the supplier uses to serve its customers. This creates a potential path for an incident originating at the supplier to affect organizations that depend on its services.
For a customer evaluating an AI supplier, these results broaden the question beyond whether the supplier patches. They point to whether it notices when something goes wrong, protects its people’s credentials, and would tell its customers.
Three in Ten AI Companies Reach the Critical Ransomware Susceptibility Threshold
Vulnerabilities, botnet findings, and exposed credentials rarely appear alone. The Ransomware Susceptibility Index® (RSI®) combines them into a single view of how exposed a supplier is to ransomware.
Ransomware does not skip AI companies. In February 2026, Straive, a Singapore-based provider of AI data and content services, appeared on the Qilin ransomware leak site. Black Kite’s Ransomware Susceptibility Index (RSI) for the company had sat above the critical threshold since November 2025, three months before the listing, and rose to nearly 0.9 after it.
RSI measures the externally visible conditions that put a company on ransomware groups’ radar: exploitable vulnerabilities, exposed remote access, stolen credentials, botnet activity, and misconfigurations, weighted by real-world exploitability. It runs from 0.0 to 1.0. In Black Kite’s analysis of ransomware victims between April 2025 and March 2026, 41% of companies with an RSI above 0.8 were attacked, 5.1% of those between 0.4 and 0.6, and 0.14% of those below 0.2: a company in the top band was 291 times more likely to be hit than one in the bottom band.
Across the AI companies in this study, 29.7% scored at or above 0.4, and 11.5% at or above 0.6. The distribution below shows where the population sits: most companies cluster between 0.2 and 0.4, a long tail reaches into the bands where attack rates climb steeply.
Is that better or worse than the industries that buy AI? Black Kite's assessments of manufacturing, healthcare, and IT vendors put 37% to 39% at or above the threshold. The AI average looks lower only because thousands of very small AI companies have almost no visible infrastructure. Among AI companies with a visible footprint, 37.8% were at or above 0.4, the same level as those industries. At the high end AI companies stand apart: 11.5% scored 0.6 or above, against 4.6% to 10.3% in the reference groups.
This identifies a group of suppliers that warrants closer attention, particularly when their services process sensitive customer information or support critical business operations.
Security Findings Differ by What AI Companies Build
The roles described earlier in this report do not carry the same security profile. For the most visible weakness, the picture is flat: critical unpatched vulnerabilities appeared at roughly one in three companies in every group, from model and infrastructure developers (36.2%) to companies building everyday business applications (35.2%) and industrial AI (38.1%). The weakness is not concentrated in one corner of the ecosystem. The only group below that level is content, entertainment, and consumer AI, at 25.0%, which also has the largest share of companies with a small external footprint.
Stolen credentials tell a different story, and it follows the supplier’s role. Infostealer-related findings were most common among companies that develop and implement AI for other organizations (10.0%), nearly three times the rate among consumer-facing AI companies (3.6%) and well above the rate among model and infrastructure developers (6.0%). Looking at specific activities, cloud solution providers (19.9%), data and labeling companies (13.9%), and customer service platforms (11.5%) recorded the highest rates in the study, while model and platform developers recorded one of the lowest (4.1%). The pattern holds when companies with a small external footprint are excluded.
The activities with the highest infostealer exposure are the ones whose work takes them deepest into customer environments: integrators, cloud providers, data handlers, and platforms that process customer conversations. The same group also had the highest share at or above the critical ransomware susceptibility threshold (32.9%). For a third-party cyber risk program, this is the practical conclusion of the classification: the supplier's role helps identify which security weaknesses deserve closer attention.
Security Findings Also Differ by Region
Geographic differences extend beyond the technologies companies develop. Black Kite also identified different cybersecurity profiles across the major AI regions.
China’s AI companies had nearly twice the US rate of critical unpatched vulnerabilities:
of China's AI companies
compared with
of US AI companies.
The share reaching Black Kite’s critical ransomware susceptibility threshold was also approximately twice as high, at 48.5% versus 24.3%.
Known exploited vulnerabilities are spread more evenly.
They appeared at
of China's AI companies
and
of US AI companies,
with Europe at 9.4% and India highest at 12.6%, mostly because of Rapid Reset. Excluding that vulnerability, the regions sit within a narrow band: 5.3% in China, 4.4% in the US, 5.6% in Europe and India.
Botnet Infection findings were similar across regions, from 4.6% in India to 7.5% in the United States, with China at 6.1%.
India stands out for exposed corporate credentials.
Infostealer-related findings appeared at
of Indian AI companies
compared with
in the United States.
Critical vulnerabilities were present at 38.4%, and 33.4% reached the critical ransomware susceptibility threshold.
Europe and Canada had critical vulnerability rates of 33.8% and 30.4%, respectively. Their shares at or above the ransomware threshold were 29.6% and 27.6%. Taiwan, analyzed separately from China, recorded 44.9% for critical vulnerabilities and 40.5% for the ransomware threshold.
Footprint and ransomware susceptibility move together in every region, but not at the same pace. In the United States the median RSI stays below the threshold even among companies with thousands of assets; in China and India it crosses 0.4 once a company has more than about 30 visible assets.
These comparisons identify the security conditions that deserve attention within different supplier populations. The final decision should still reflect the individual supplier’s security posture, business role, dependencies, and access to customer systems.
Next: Do the best-known names look different?
Black Kite tested 50 of them.