Black Kite's Ransomware Susceptibility Index® (RSI™) Shows that Organizations with High Scores are 291 Times More Likely to Experience a Ransomware Attack

Three years of testing against real-world ransomware attacks show RSI™ has become an increasingly reliable indicator of ransomware susceptibility.

BOSTON, Oct. 14, 2026 /PRNewswire/ -- Black Kite, the leader in third-party cyber risk management, today announced findings validating the predictive power of its Ransomware Susceptibility Index® (RSI™), which measures the likelihood of which vendors are most likely to be hit with ransomware, using real-time signals to spotlight risk. The Black Kite Research Group evaluated RSI against 7,551 publicly disclosed ransomware victims from 2025. The analysis found that organizations with an RSI above 0.8 were 291 times more likely to experience a ransomware attack than those below 0.2.

"Questionnaires can tell you what a vendor believes to be true about its security posture, but they can't tell you everything an attacker can see today," said Bob Maley, Chief Security Officer, Black Kite. "Organizations need evidence-based scoring, and RSI delivers it by reflecting how threat actors actually operate and calibrating against thousands of publicly disclosed ransomware victims."

How RSI Works
RSI assesses an organization's susceptibility to ransomware by comparing its external risk signals and characteristics against patterns from thousands of publicly disclosed ransomware victims. Scores range from 0 to 1, with higher values indicating greater susceptibility. In many cases, RSI begins to rise months before a ransomware attack, giving risk teams an early signal and more time to act.

Unlike point-in-time assessments and self-reported controls, RSI is grounded in observable evidence, providing a continuously updated view of ransomware susceptibility based on what attackers can see from the outside.

Tested Every Year since 2023. The model keeps getting sharper.
RSI has been tested against real-world ransomware outcomes for three consecutive years, and its ability to distinguish between high- and low-susceptibility organizations has strengthened each year. Organizations in the high-RSI band were 27 times more likely to experience a ransomware attack than those in the low band in 2023. That increased to 96 times in 2024 and 291 times in 2025. Importantly, the percentage of high-RSI organizations hit by ransomware remained consistently elevated, while the percentage of low-RSI organizations hit fell from 1.7% to 0.5% to just 0.14%. The result is a model that has maintained its ability to identify organizations at high risk while becoming increasingly precise at identifying those at low risk.

The Proof

• Validated against real attacks: The Black Kite Research Group measured RSI against 7,551 publicly disclosed ransomware victims from 2025.
• Separates high-risk from low-risk organizations: Organizations with an RSI above 0.8 were 291 times more likely to experience a ransomware attack than those below 0.2.
• Year-over-year validation: RSI's ability to distinguish high- from low-susceptibility organizations has strengthened across three consecutive annual calibrations, from 27x in 2023 to 96x in 2024 and 291x in 2025.
• Scores and real-world outcomes: 41% of the high-RSI band was hit by ransomware, compared with 0.14% of the low band.

RSI is available within the Black Kite platform. To learn more, get a free RSI™ rating for your organization or a third party at blackkite.com/free-rsi-rating.

About Black Kite
Black Kite is an AI-native third-party cyber risk management platform built for the connected world. By distilling billions of external risk signals from millions of monitored organizations, Black Kite delivers the trusted intelligence that powers a connected defense network, enabling organizations to identify risk earlier, act faster, and move from isolated defense to collective resilience. With Black Kite, organizations benefit from greater control, earlier warning, and the confidence to work safely with third parties at scale. Black Kite has received numerous industry awards and recognition from customers. Learn more at www.blackkite.com, or on the Black Kite blog.

Media Contact:
Michelle Kearney
Hi-Touch PR
443-857-9468
[email protected]

SOURCE Black Kite