Cybersecurity exposure is not limited to emerging or lesser-known AI companies. Black Kite separately assessed 50 companies from the Forbes AI 50 list to examine security findings among some of the industry's most recognized names.

Black Kite identified critical unpatched vulnerabilities at 52% of Forbes AI 50 companies, known-exploited vulnerabilities at 26%, and Botnet Infection findings at 34%. Infostealer records contained corporate login information associated with 28%.

Email authentication findings were less common in this cohort: 10% had DMARC-related findings, 4% had DKIM-related findings, and none had SPF-related findings.

The results challenge the assumption that market recognition is a substitute for security assessment. Critical vulnerabilities appeared at 52% of Forbes AI 50 companies, compared with 34.2% of the broader AI population. Infostealer-related exposure was also more frequently observed, at 28% versus 6.8%.

Larger or more visible digital footprints can create more opportunities for external findings to be detected. What the results demonstrate is that a supplier's reputation cannot replace an assessment of its actual cybersecurity exposure.

The Forbes AI 50 run far larger infrastructures, a median of 220 externally visible assets against 18 across the study, yet their ransomware susceptibility is spread much like the ecosystem's: 16 of the 50 sit at or above the critical threshold.