Analysis: Blast Radius for Third-Party Breaches Bigger Than Reported

### Executive Summary Black Kite's analysis of 136 third‑party breaches shows extensive supply‑chain impact—710 directly affected companies, ~26,000 additional organizations, and up to 433 million individuals—exposing large visibility and remediation gaps (median 10 days to detect, 73 days to disclose), a high prevalence of critical vulnerabilities (54%) and leaked credentials (23%). The report warns adversaries increasingly target interconnected vendors and midsized suppliers, and are adopting AI to enhance phishing and ransomware operations; it recommends stronger patch management, multifactor authentication, and continuous supply‑chain testing.