Navigating Security Risks in AI Supply Chains

As artificial intelligence (AI) continues to reshape industries, it brings not only enhanced efficiencies but also significant security vulnerabilities. A comprehensive study by Black Kite highlights alarming shortcomings in security practices among AI suppliers, suggesting that businesses need to tread carefully when integrating these technologies.

Understanding the Landscape of AI Supply Chain Security

The 2026 AI Supply Chain Report: The Risks Behind Your AI Relationships emphasizes the need for vigilance. With over 18,000 AI companies assessed, it reveals a sector struggling with fundamental security principles. Despite the promise of AI in optimizing operations, the study highlights a stark reality—many providers do not adhere to even basic security protocols.

Key Findings on Security Threats

The analysis paints a concerning picture of the AI supplier landscape:

• Critical Vulnerabilities: 34.2% of companies assessed had at least one significant unpatched vulnerability, posing potential risks that can affect their clients.
• Email Security Issues: An overwhelming 61.7% faced issues with DMARC configurations, while 37.3% struggled with DKIM, both of which could facilitate phishing attempts.
• Ransomware Risks: Almost 30% of AI providers showed a heightened vulnerability to ransomware, indicating a dangerous trend in a landscape already fraught with cyber threats.
• Network Anomalies: Unusual activities were identified in 44.3% of organizations, while 41.8% experienced botnet-related activity, raising red flags about potential breaches.

Implications for Business Operations

Investments in AI are surging, with reports predicting enterprise spending could reach around $37 billion by 2025. A considerable portion of these solutions—76%—are purchased rather than developed internally, which raises pressing concerns about reliance on third-party integrations.

The integration of AI systems can undeniably streamline processes; however, it also heightens the risk of existing vulnerabilities. A breach in an AI supplier could expose not just their systems but also sensitive customer data and critical business infrastructure.

Worryingly, the study indicated that 19.9% of AI suppliers had corporate login credentials leaked in data breaches. Moreover, 33.2% of the assessed companies maintained a limited digital footprint, which can obscure potential risks associated with their operations.

Strategies for Mitigating Risks

In light of these findings, businesses must adopt proactive strategies to safeguard their supply chains. Continuous monitoring of AI suppliers and rigorous security assessments should become standard practices.

Black Kite's report advocates for:

• Ongoing Vigilance: Companies should engage in regular discussions with suppliers to remain updated on their security practices and potential vulnerabilities.
• Prioritizing Risks: Address vulnerabilities based on their severity and potential impact, particularly focusing on threats like ransomware.
• Thorough Audits: Businesses need to conduct comprehensive evaluations of AI tools, scrutinizing integrations and access permissions to minimize risk exposure.

If a company chooses to retain a specific AI tool, it is essential to restrict its permissions to only what is necessary for functionality, thus limiting the overall attack surface.

Conclusion

As AI technologies evolve and become integral to business operations, the associated security risks command attention. Companies must proactively assess and address these vulnerabilities to navigate their digital supply chains effectively. By implementing robust strategies for monitoring and managing AI supplier relationships, organizations can harness the benefits of AI while bolstering their security posture against emerging threats.