AI vendors expose enterprises to critical security risks, Black Kite report finds

Security failures across the AI supply chain

Cybersecurity firm Black Kite has identified widespread security gaps in the global AI supply chain, with 34.2% of assessed AI companies carrying at least one unpatched critical vulnerability. The findings, published in a report titled "2026 AI Supply Chain Report: The Risks Behind Your AI Relationships," evaluated 18,160 companies across six sectors, from application developers to specialized AI foundations.

The study found that 61.7% of AI vendors struggled with DMARC configuration, leaving them open to email spoofing and phishing attacks. Another 37.3% had weaknesses in DKIM, compounding authentication risks for their customers.

Ransomware, network risks and exposed credentials

Nearly 30% of AI companies assessed were classified as highly susceptible to ransomware, according to Black Kite’s susceptibility index. Network monitoring also flagged unusual activity at 44.3% of these companies, while 41.8% showed signs of botnet-related compromise.

Corporate credentials posed another risk: 19.9% of AI suppliers providing enterprise solutions had login data exposed in infostealer records, and stolen credentials were linked to 6.8% of suppliers overall. The report noted that many of these suppliers have access to customer data, internal developer environments, and enterprise platforms, amplifying the potential impact of a breach.

Integration risks and limited transparency

The risks extend beyond the vendors themselves. Black Kite’s analysis of Model Context Protocol (MCP) components—used to connect AI applications to business systems—found that 48.8% of logged security issues were rated High or Critical severity. These included vulnerabilities like code and command injection, which could allow attackers to move from compromised AI tools into broader corporate networks.

Visibility remains a challenge. The study revealed that 33.2% of AI companies had a "limited" digital footprint, making it difficult for customers to monitor their security posture effectively.

Market growth and evolving threats

Enterprise spending on AI reached $37 billion in 2025, with 76% of these solutions sourced externally rather than built in-house, according to Menlo’s research cited in the report. The shift toward off-the-shelf AI tools increases reliance on third-party vendors, making supply chain security a critical concern for adopters.

Earlier research by Salt Labs, covered in LazyFounder, demonstrated how AI agents with broad access to services like Gmail and cloud storage could be hijacked via a single malicious email. Black Kite’s findings reinforce the need for continuous monitoring, as point-in-time security assessments are insufficient to address evolving threats.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

Founders integrating third-party AI tools into their stacks should treat security audits as non-negotiable due diligence. The Black Kite findings show that nearly one in three suppliers carries unpatched critical flaws, and half of the high-risk issues are buried in the connectors between AI models and business systems—exactly where a breach in one startup’s vendor could ripple across multiple customers.

Key takeaways

• 34.2% of assessed AI suppliers have at least one critical, unpatched vulnerability, creating supply-chain risks for enterprise buyers.
• 61.7% of AI companies fail basic email authentication (DMARC), exposing customers to phishing and impersonation.
• Nearly 30% of AI vendors operate in environments with heightened ransomware exposure, increasing the likelihood of downstream incidents.
• 48.8% of security findings in Model Context Protocol components are rated High or Critical, underscoring risks in AI-to-business-system integrations.

Related on Lazyfounder

• More ai news
• AI agents vulnerable to prompt injection attacks via email, researchers find