How to Run AI Supplier Due Diligence

AI supplier due diligence tells digital leaders what to test, contract, and reject before a vendor’s security gaps become an enterprise incident. It matters now because Menlo Ventures’ 2025 research found 76% of organizational AI use cases were purchased rather than built in-house, up from 53% a year earlier. Black Kite’s November 10, 2026 assessment of 18,160 AI companies found critical unpatched vulnerabilities at 34.2% and ransomware susceptibility—an RSI at or above 0.4—at 29.7%.

Updated November 10, 2026

What should AI supplier due diligence check first?

Black Kite’s November 10 assessment found critical unpatched vulnerabilities at 34.2% of companies, and 9.8% had at least one flaw in CISA’s Known Exploited Vulnerabilities catalog. ZDNET’s summary notes a critical flaw is not automatically critical business risk, but it should be reviewed. The Forbes AI 50 was not a clean result: 52% had critical unpatched vulnerabilities and 26% had known exploited vulnerabilities. Do not treat those shares as a safety ranking.

Findings are externally observed, not confirmed breaches. Observations draw on September and October 2026 data, and 33.2% of companies have a limited digital footprint, so a thin external view can miss risk. Use this order:

1. Confirm any critical vulnerability is unpatched, and whether it is in CISA’s Known Exploited Vulnerabilities catalog.
2. Read a catalog entry as exploitation somewhere in the world, not proof this supplier was attacked. Critical-vulnerability findings generally match observed versions to disclosed flaws; Black Kite did not test exploitation.
3. Handle ransomware-linked exposure and flaws already exploited in the wild before lower-severity items.
4. Judge the role, not the model brand. Foundational technologies are about 10% of the set; everyday applications about 31%; implementation firms about 23%.

How do email, credentials, and ransomware exposure compare?

DMARC weaknesses appeared at 61.7%, DKIM at 37.3%, and SPF at 11.2%. The shares overlap and should not be added. Weak email authentication can make supplier-domain impersonation easier for phishing or fraud.

Stolen corporate logins were tied to 6.8% of AI companies and more than 18,600 finding records. Rates differ sharply by the role you are buying.

A still-valid credential is the issue, not proof every login was used. Separately, 29.7% reached Black Kite’s critical ransomware threshold of 0.4 or higher—48.5% in China, 24.3% in the United States. The report says five of every 100 companies in that range become ransomware victims, a range statistic rather than a forecast for one supplier.

Unusual network activity showed at 44.3%; the press release reported botnet-related findings at 6.5%. Neither confirms a compromise.

What component and MCP risk comes with the product?

Buyers also inherit components they did not select. The 2026 AI Supply Chain Report found security findings tied to n8n, Langflow, or LiteLLM at 105 companies, and CVE-2025-68613, a known-exploited remote code execution flaw in n8n, at 93. PHP versions affected by PHP2Shell vulnerabilities appeared at 939 companies (5.2%). In March 2026, a LiteLLM compromise put credential-harvesting code into Mercor’s environment and, through Mercor, its customers.

Public Model Context Protocol entries added another surface: 305 publicly discoverable MCP server entries attributed to 179 AI companies, and 1,732 findings. High or Critical ratings were 48.8% of findings; 87% of 77 Critical findings were code or command injection. That rate is not the share of all AI companies. Private MCP environments were outside the analysis, and a public entry does not prove production use.

What terms should survive a supplier incident?

Black Kite tells buyers to monitor suppliers continuously, identify shared dependencies, remediate by business impact, and assess integration access. In the report, Dr. Ferhat Dikbiyik, chief research and intelligence officer at Black Kite, commented:

It has to keep pace with adoption, and that takes visibility that is continuous, not periodic.

If the exposure outweighs the capability, do not connect the tool. If you keep it, limit permissions to required work and test how fast access can be revoked. In the agreement review, record who can reach customer data, which components hold credentials, and whether monitoring continues after purchase.

Pair that access test with restrictions on external AI agents and cloud bills from stolen credentials. ZDNET, citing Menlo’s 2026 research, reports $37 billion in enterprise AI spend in 2025, half of it on AI applications.