Black Kite's Ransomware Susceptibility Index® (RSI™) Shows that Organizations with High Scores are 291 Times More Likely to Experience a Ransomware Attack

Black Kite says its Ransomware Susceptibility Index (RSI) distinguished high- from low-risk organizations by 291x in 2025, based on analysis involving 7,551 publicly disclosed ransomware victims. Ransomware affected 41% of the high-RSI band versus 0.14% of the low band; the reported risk separation rose from 27x in 2023 to 96x in 2024 and 291x in 2025. The findings support the platform’s risk-scoring product but are unlikely to have broad market impact.

Analysis

The investable signal is a possible shift in how enterprises allocate third-party cyber-risk budgets—not evidence, by itself, of improved security outcomes or a new revenue driver for any listed cybersecurity vendor. A risk score that helps teams prioritize vendors could reduce assessment labor and strengthen buyers’ leverage to demand remediation, while increasing friction for suppliers that score poorly. Over time, that may favor vendors able to provide continuous monitoring and remediation workflows over questionnaire-heavy processes; the effect on cybersecurity incumbents is too indirect to trade without adoption data.

The headline separation is not the same as a vendor-level probability forecast: the release does not provide the population denominator, calibration details, false-positive rates, or independent validation. Publicly disclosed incidents may also bias the sample, and improving separation could reflect fewer observed incidents in the low-score group rather than a rising attack rate in the high-score group. Treat the company’s claims as a product-validation signal, not proof of commercial traction.

Near term, this is unlikely to move sector earnings. Over 1–3 months, watch for customer adoption, renewals, and evidence that scores prompt paid remediation or workflow expansion. Over 6–18 months, broader use in procurement and cyber-insurance underwriting could make external risk scores more consequential—but could also create vendor concentration and disputes over score accuracy. No direct equity trade is supported by this announcement alone.

Key Decisions for Investors

• No immediate trade: Black Kite is not represented in the supplied ticker mapping, and the announcement provides no customer, revenue, or conversion data that would establish a listed-company beneficiary.
• Put external cyber-risk monitoring and remediation on the enterprise-security watchlist; look for evidence of budget substitution from manual assessments and questionnaire workflows, rather than assuming net-new cybersecurity spend.
• Reassess only if independent validation and commercial metrics emerge: cohort denominator and false-positive rates, paid deployments, renewal or expansion evidence, and measurable vendor remediation outcomes.
• Falsifiers for the adoption thesis include weak conversion from free ratings to paid contracts, no disclosed workflow or procurement integration, or customer evidence that scores do not change vendor remediation or purchasing decisions.