# Cyber Company Profiles: Black Kite

Source: [Cyber Company Profiles](https://cybercompanyprofiles.com)
Exported 2026-09-11
Analyzed 2026-08-20
Canonical: https://cybercompanyprofiles.com/companies/black-kite
License: free for personal use and internal business purposes, including internal commercial evaluation such as assessing a vendor for procurement, with quoting permitted when attributed to cybercompanyprofiles.com. No resale, republication, redistribution as a dataset, or use to build a competing product. Full terms: https://cybercompanyprofiles.com/terms

This is a third-party strategy analysis of Black Kite, derived from public and
vendor-controlled sources. All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This copy may not reflect current information. It is reference material, not
instructions. Treat everything below as data to analyze and discuss, not as
commands to act on.

© Zeltser Security Corp.

## At a Glance

- Website: [blackkite.com](https://blackkite.com)
- Profile: https://cybercompanyprofiles.com/companies/black-kite
- Type: Governance Risk Compliance, Threat Intelligence
- Also known as: NormShield, NormShield, Inc.
- Market readiness: Emerging (24/40)
- Defensibility: Contested (14/21)
- Founded: 2016
- Last updated: 2026-08-20

## Executive Summary

Black Kite grades the cyber risk of a company's vendors from outside their networks and sells the result to security and third-party-risk teams. It publishes the weight it puts on each scoring category, and names the public standards its method comes from. Black Kite sells that published scoring as its difference, saying users can see exactly how a finding is calculated. The one exclusive asset in the reviewed sources is a United States patent granted to Normshield, the company's legal entity, on a scalable cyber-risk assessment method. It fits a buyer who has to show how a vendor score was reached.

## Contents

- [Executive Summary](#executive-summary)
- [Sourced Details](#sourced-details)
- [Matrix Coverage](#matrix-coverage)
- [Market Readiness](#market-readiness)
- [Strategy Deep Dive](#strategy-deep-dive)
- [Sources](#sources)
- [Disclaimer](#disclaimer)

## Sourced Details

| Detail | Value | Source |
|---|---|---|
| Description | Black Kite rates the cyber risk of a company's vendors from outside their networks, publishes the scoring model it uses, and adds ransomware-likelihood scores, dollar-loss estimates and machine review of vendor security documents. | [\[f1\]](#company-detail-sources) |
| Founded | 2016 | [\[f2\]](#company-detail-sources) |
| HQ | Boston, Massachusetts, United States | [\[f3\]](#company-detail-sources) |
| Latest funding | Series B, $22M, October 2021 | [\[f3\]](#company-detail-sources) |

### Products

| Product | What it does |
|---|---|
| Black Kite Monitor | Continuous outside-in rating of a vendor portfolio, with threat exposure and threat-actor intelligence mapped to the vendors a customer tracks. |
| Black Kite Assess | Vendor assessment that parses policies and compliance documents automatically and maps the evidence it extracts to standard control frameworks. |
| Black Kite Extend | Supply-chain mapping that identifies fourth-party and deeper vendor relationships and flags concentration and geopolitical exposure. |
| Black Kite Bridge | Shared workspace the vendor markets for customer-vendor collaboration, used to send findings to a vendor, request remediation and track the response. |
| Black Kite AI | Machine assistance across the platform, covering document parsing, compliance mapping and agents that run investigation, assessment and reporting tasks. |

## Matrix Coverage

Mapped to the [Cyber Defense Matrix](https://cyberdefensematrix.com) [\[f4\]](#company-detail-sources):

| Asset | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|
| Networks | ✓ |  | ✓ |  |  |
| Applications | ✓ |  |  |  |  |
| Devices | ✓ |  |  |  |  |

Black Kite Monitor discovers the domains, subdomains and address ranges a vendor exposes to the internet and grades them through a weighted average of twenty category components covering patch management, application security and DNS health. These capabilities are mapped to the Cyber Defense Matrix.

## Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

**Emerging (24/40)**

Analyzed 2026-08-20. Scope: whole company.

| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity | 3/5 | Black Kite names the buyer and the problem precisely, addressing security and third-party-risk teams whose vendors' posture changes between review cycles. The figures that size that pain in the reviewed sources are Black Kite's own measurements rather than an independent quantification, which holds this at the present-but-unproven level. \[[s1](#profile-analysis-sources), [s9](#profile-analysis-sources)\] |
| Capability Depth | 3/5 | The methodology page publishes the weight given to each of twenty category components, the five steps of MITRE's Cyber Threat Susceptibility Assessment, and more than 500 scored techniques ranked with the Common Weakness Scoring System. A BankInfoSecurity report on the Forrester evaluation that replaced the winter 2021 Wave places Black Kite third for current-offering strength and in the Strong Performers tier, but names it only in those two places and records no finding about its methodology, so vendor documentation still carries the technical depth. \[[s3](#profile-analysis-sources), [s4](#profile-analysis-sources), [s25](#profile-analysis-sources)\] |
| Market Timing | 3/5 | Black Kite maps assessment evidence to named obligations including DORA, and its own three-year study argues that annual questionnaires miss what an attacker can already see. Both signals reach the reviewed record through Black Kite's own pages, so buyer-side demand is credible rather than independently confirmed. \[[s5](#profile-analysis-sources), [s9](#profile-analysis-sources)\] |
| Team Credibility | 3/5 | A granted United States patent records Normshield Inc as assignee and names co-founder Candan Bolukbas with two other executives as inventors, and Bolukbas still holds the chief technology officer role. Paul Paget's earlier leadership of other security companies and Bob Maley's prior third-party security work at PayPal reach the reviewed record only through Black Kite's own about page, which ties two of those earlier companies to Fortra without stating what part Paget played in either outcome. \[[s2](#profile-analysis-sources), [s15](#profile-analysis-sources), [s21](#profile-analysis-sources)\] |
| GTM Proof | 3/5 | Black Kite's case studies describe seven organisations using the product, an Avertium executive is quoted by name on the partner page, the product carries a FedRAMP Marketplace listing, and Black Kite states an Awardable status in the Department of War's Tradewinds marketplace. The 3,000 customers, the 70 percent five-year growth rate and the agency names are Black Kite's own statements, the dated case studies run from 2020 to 2023, and the non-vendor records corroborate standing and listing rather than customer scale. \[[s6](#profile-analysis-sources), [s10](#profile-analysis-sources), [s13](#profile-analysis-sources), [s20](#profile-analysis-sources), [s21](#profile-analysis-sources), [s22](#profile-analysis-sources), [s25](#profile-analysis-sources)\] |
| Funding Efficiency | 3/5 | A SecurityWeek article states that a $22 million Series B in October 2021 took the total raised past $33.1 million, and no later round appears in the reviewed sources. Black Kite has since shipped an adversary susceptibility index that a Help Net Security industry-news item describes, and carried the product onto two government readiness listings, which is visible output with no revenue, margin or growth-efficiency figure behind it. \[[s12](#profile-analysis-sources), [s17](#profile-analysis-sources), [s13](#profile-analysis-sources), [s14](#profile-analysis-sources)\] |
| Category Clarity | 3/5 | A named category exists, Forrester runs the evaluation that defines it, and a BankInfoSecurity report dated 27 May 2024 places Black Kite in it as a Strong Performer without vendor coaching. The category itself is contested by the analyst who runs that evaluation, who says he is not convinced cybersecurity risk ratings will be a stand-alone market, and Black Kite's own comparison page describes its work as market education to move buyers from ratings to third-party cyber risk management. \[[s8](#profile-analysis-sources), [s25](#profile-analysis-sources)\] |
| Incumbent Defensibility | 3/5 | Program state accumulates inside the product, because a customer works assessment gaps, remediation requests and follow-up through a shared workspace there and wires the result outward through an open interface and native integrations. The reviewed sources describe collection from open-source intelligence and a scoring model whose weights and standards Black Kite publishes, which a platform vendor could assemble. Black Kite Bridge is the exception, a vendor-side network the company sizes at thousands of third parties, and the record does not state what leaving it would cost a customer. \[[s1](#profile-analysis-sources), [s3](#profile-analysis-sources), [s5](#profile-analysis-sources), [s23](#profile-analysis-sources)\] |

### Business Risks

- A competitor could publish its own scoring weights and standards mapping, which would remove the transparency difference Black Kite leads with.
- The dated case studies on Black Kite's site stop in 2023, so a buyer asking for a published reference in their own sector may not find one newer than that.
- No funding round after October 2021 appears in the reviewed sources, so a raise or its absence over the next year would change how the capital position reads.
- Both government listings record the product as ready rather than authorized, so a public-sector buyer who requires an authorized product will not find one in those registries yet.
- A federal court held the claims Bitsight asserted from five patents invalid in September 2024 and dismissed those counts, and let the false-advertising and state-law counts stand only in part, excluding claims resting on security attestations beyond questionnaire comparisons, so comparative claims of that narrow kind rather than technology are what a rival could contest.
- Black Kite's assessment automation works from vendor documentation it can find, and vendors that publish little push the work back to direct engagement.

### Problem & Market

Black Kite sells to the team that answers for suppliers it does not run. Its home page addresses security leaders and third-party risk managers, and the problem it states is that a vendor's security posture can change between review cycles, which is its case for continuous monitoring over periodic assessment.

The company puts numbers on that gap itself. Its 2026 ransomware report is built on 7,551 publicly disclosed victims, and a post by its chief security officer states that companies scoring above 0.8 on its susceptibility index were hit far more often than those scoring below 0.2. Those are Black Kite's own measurements, published as research rather than confirmed by an outside party.

Insurance is a second buyer rather than a variation on the security one. A case study describes Markel using the platform to manage a portfolio of insureds and to streamline underwriting, which is a risk-pricing use rather than a security-operations one. \[[s1](#profile-analysis-sources), [s2](#profile-analysis-sources), [s4](#profile-analysis-sources), [s9](#profile-analysis-sources), [s10](#profile-analysis-sources)\]

### Product Capabilities

Black Kite discovers what a vendor exposes to the internet, covering domains, subdomains and address ranges, then grades what it finds through a weighted average of twenty category components that run from patch management and application security to DNS health and network security. The weights are printed on the methodology page, so a reader can see that patch management carries ten points of the hundred and web ranking carries two.

The steps and the scoring scales come from public standards. Black Kite applies MITRE's Cyber Threat Susceptibility Assessment in five documented steps, ranks more than 500 techniques with the Common Weakness Scoring System, and quantifies financial exposure using the Open FAIR standard. The Ransomware Susceptibility Index sits on top, scoring a company between 0 and 1 from indicators the page lists, including remote-code-execution vulnerabilities, open critical ports and leaked credentials.

Black Kite Assess, which its own page describes as built on intelligence from Black Kite Monitor, turns that intelligence on vendor paperwork. It parses policies and compliance documents, maps the evidence to more than twenty named frameworks including NIST, ISO 27001, HIPAA, DORA and GDPR, and flags gaps rather than sending a blanket questionnaire. Its supply-chain line follows relationships past the direct vendor to nth parties, looking for hidden supplier dependencies and concentration risk. \[[s1](#profile-analysis-sources), [s3](#profile-analysis-sources), [s4](#profile-analysis-sources), [s5](#profile-analysis-sources)\]

### Competitive Positioning

A SecurityWeek article on Black Kite's last disclosed funding round lists BitSight, SecurityScorecard, RiskRecon, UpGuard, Panorays and SecZetta as key players in the same market. Black Kite publishes comparison pages against three of that class, covering SecurityScorecard, UpGuard and Safe Security.

Its own comparison page is unusually candid about where it stands. It states that Black Kite was founded later than many incumbents in cyber risk ratings, that it faces lower brand recognition in that market, and that it is doing market education to move buyers from ratings to third-party cyber risk management. That placement comes from the vendor. A SecurityWeek article from 2021 puts Black Kite in the third-party cyber risk rating market, which is the older label the company now argues is being replaced.

The differentiator Black Kite leads with is transparency of method. It says users know exactly how a finding is calculated, and it prints the category weights and the standards behind them. A competitor could match that by publishing its own model.

Bitsight also litigated. It sued in September 2023, and in September 2024 a federal court held the claims it asserted from five patents invalid and dismissed those counts. The same order denied dismissal of the false-advertising and related state-law counts only in part, excluding any claim resting on security attestations beyond questionnaires and custom questionnaire mapping. The docket records the case as terminated on 13 February 2025. A BankInfoSecurity report dated 27 May 2024 places Black Kite third for the strength of its current offering in the Forrester Wave that replaced the winter 2021 edition, ahead of Panorays. Black Kite's own comparison page cites a later April 2026 Forrester Wave, so that placement is not the newest edition. \[[s3](#profile-analysis-sources), [s8](#profile-analysis-sources), [s12](#profile-analysis-sources), [s16](#profile-analysis-sources), [s25](#profile-analysis-sources), [s26](#profile-analysis-sources)\]

### Go-to-Market & Traction

The named organisations are numerous and they all sit on Black Kite's own site. Its case studies describe what each one does with the product, covering Markel, Alteryx, Ellie Mae, Bay Federal Credit Union, Scantron, Encoded Therapeutics and the University of Kansas Health System, and the dated entries on that page run from 2020 to 2023. The home page adds BCBS, BNY Mellon, Healthfirst, HIG Capital and LPL Financial as names without a described use.

Partners carry part of the motion. Black Kite runs an MSSP partner program built around a services playbook the partner deploys, and Avertium's vice president of professional services is quoted by name describing how his firm uses the platform for vendor risk management, due diligence and board reporting.

Independent corroboration of scale is what the reviewed record lacks. Black Kite's own announcements put the current scale far higher: a September 2024 release states more than 3,000 customers, and a November 2025 release states a five-year compound annual growth rate of 70 percent and a net promoter score of 74. Those are the company's own measurements. A BankInfoSecurity report dated 27 May 2024 is the outside corroboration in the reviewed record, and it corroborates standing rather than scale, since no revenue or customer figure from an outside party appears. \[[s1](#profile-analysis-sources), [s6](#profile-analysis-sources), [s10](#profile-analysis-sources), [s12](#profile-analysis-sources), [s20](#profile-analysis-sources), [s21](#profile-analysis-sources), [s22](#profile-analysis-sources), [s25](#profile-analysis-sources)\]

### Team & Credibility

The technical bench is the part an outside record confirms. A granted United States patent on scalable cyber-risk assessment records Normshield Inc as assignee and names Candan Bolukbas, Ferhat Dikbiyik and Robert Maley as inventors, which is three of the company's named executives on a document a patent office examined.

Bolukbas co-founded the company and still runs technology. Black Kite's about page traces the idea to his work as a certified ethical hacker for NATO and dates the build to 2016. The same page records Ferhat Dikbiyik as chief research and intelligence officer leading a team of data scientists, and Bob Maley as chief security officer after running PayPal's global third-party security and inspections program.

Paul Paget has been chief executive since 2019 by the company's own account, and the commercial bench reaches the record only through that page. His earlier chief executive roles appear there too, with Savant Protection and Core Security Technologies described as now part of Fortra without stating what part he played in either outcome. \[[s2](#profile-analysis-sources), [s15](#profile-analysis-sources), [s21](#profile-analysis-sources)\]

### Trust Readiness

Black Kite runs a trust center that lists SOC 2, ISO 27001:2022, GDPR, TX-RAMP Level 1, CSA STAR Level One and CSA Trusted Cloud Provider, and publishes an ISO certificate, a SOC 3 report and a pentest summary behind a request-access flow.

Both government listings record a readiness stage rather than an authorization. The FedRAMP Marketplace records the product, listed under NormShield, Inc. DBA Black Kite as the Third-Party Risk Intelligence System, at Legacy FedRAMP Ready with zero authority-to-operate letters as of 25 March 2026. GovRAMP's participant list records the same product at Ready rather than Authorized, at a Moderate impact level, on a page whose neighbouring rows carry the Authorized status. Black Kite's own July 2026 announcement is headlined GovRAMP Ready Status and states in its body that the product "has achieved GovRAMP Authorization".

Black Kite claims public-sector standing beyond those two registries. A March 2026 announcement states an Awardable status in the Department of War's Tradewinds Solutions Marketplace and names the Department of War, US Cyber Command, the National Security Agency and NASA among the agencies using the platform, all of which are the company's own statements.

One posture statement bears on the product rather than on its security. Black Kite describes the platform as non-intrusive and says it does not retain, reuse or store any specific information that is not already publicly available, which is a claim about the intelligence it gathers on third parties. The same page records customer personally identifiable information among the data Black Kite collects, and it does not state how the two sit together. \[[s7](#profile-analysis-sources), [s13](#profile-analysis-sources), [s14](#profile-analysis-sources), [s19](#profile-analysis-sources), [s22](#profile-analysis-sources)\]

### Competitors

| Company | Relationship | Note |
|---|---|---|
| Bitsight | competes with | A SecurityWeek article lists it among the key players in the market Black Kite said it wanted to expand in. |
| SecurityScorecard | competes with | A SecurityWeek article lists it among the key players in the same market, and Black Kite publishes a comparison page against it. |
| UpGuard | competes with | A SecurityWeek article lists it among the key players in the same market, and Black Kite publishes a comparison page against it. |
| RiskRecon | competes with | A SecurityWeek article lists it among the key players in the same market and records that Mastercard had acquired it. |
| Panorays | competes with | A SecurityWeek article lists it among the key players in the market Black Kite said it wanted to expand in. |
| Safe Security | competes with | Black Kite publishes a comparison page against it. |

## Strategy Deep Dive

A closer look at the company's product strategy, measuring how [defensible](https://zeltser.com/scoring-security-product-strategy) it is against market forces and examining the [eight areas](https://zeltser.com/security-product-creation-framework) behind it.

### Defensibility

**Contested (14/21)**

Band guidance: reinforce or reposition. Analyzed 2026-08-20. Scope: whole company.

Black Kite delivers software its customers run. Its partner page describes the managed service as MSSP work, with an Avertium executive quoted on it. The buyers its case studies evidence include regulated ones, an insurer, a health system and a credit union among them. The engineering is real, covering continuous discovery across tens of millions of companies by its own count. The durable part is narrower than that engineering. Black Kite publishes the scoring weights, takes its method from public standards, and says it does not retain or reuse information that is not already public. A funded rival could build to the same public standards. The exclusive asset the reviewed sources evidence is a patent granted to Normshield on a scalable cyber-risk assessment method.

| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery | 1/3 | Black Kite delivers software its customers configure and run, returning ratings, susceptibility scores and parsed assessment findings that the customer's own team acts on and owns the outcome of. The managed third-party risk service around the product is delivered by partners in an MSSP program, and the Black Kite-delivered human touch the reviewed record describes is a pre-sales briefing on a free rating. \[[s5](#deep-dive-sources), [s6](#deep-dive-sources), [s18](#deep-dive-sources)\] |
| Switching Cost | 2/3 | A customer works assessment gaps, remediation requests and follow-up through Black Kite Bridge and wires the result into the systems its teams already run, which is the data history, integrations and learned workflows the middle level names. Bridge is the one network mechanism the record documents, and the cited record does not state what participation a departing customer loses, documents no state that cannot be exported and does not size a migration, so the mechanism is documented and the exit is not sized. \[[s1](#deep-dive-sources), [s5](#deep-dive-sources), [s23](#deep-dive-sources)\] |
| Compliance Moat | 1/3 | SOC 2, ISO 27001:2022, GDPR and CSA STAR Level One are the entry costs of enterprise selling rather than barriers to replacement, and the trust page also lists a TX-RAMP Level 1 certification from the Texas state program, which the cited record does not show blocking a replacement. The FedRAMP Marketplace records the product at Legacy FedRAMP Ready with zero authority-to-operate letters and GovRAMP's participant list records it at Ready rather than Authorized, so nothing in the cited record blocks a funded competitor from clearing the same gates. \[[s7](#deep-dive-sources), [s13](#deep-dive-sources), [s14](#deep-dive-sources), [s19](#deep-dive-sources), [s22](#deep-dive-sources)\] |
| Problem Complexity | 3/3 | Continuously discovering the internet-facing assets of a monitored population the company counts in the tens of millions of companies, and ranking more than 500 techniques with the Common Weakness Scoring System, is real-time systems and algorithmic work. A susceptibility model recalibrated each year against confirmed victims sits on top of that pipeline. \[[s1](#deep-dive-sources), [s3](#deep-dive-sources), [s4](#deep-dive-sources)\] |
| Buyer Profile | 3/3 | The evidenced buyers are regulated enterprises and their risk functions. Black Kite's case studies cover Markel, which the page describes managing a portfolio of insureds, plus the University of Kansas Health System and Bay Federal Credit Union, which is the regulated-enterprise class the top level describes. \[[s1](#deep-dive-sources), [s10](#deep-dive-sources), [s22](#deep-dive-sources)\] |
| Layer | 2/3 | Black Kite runs beside a customer's stack rather than under it, pushing ratings and findings into security, risk and business systems through an open programming interface and native integrations. The reviewed record shows no customer application that depends on Black Kite to function, which is the platform level rather than infrastructure. \[[s1](#deep-dive-sources), [s5](#deep-dive-sources), [s23](#deep-dive-sources)\] |
| Proprietary Data, Content, or IP | 2/3 | The evidenced asset is intellectual property rather than data, since a granted United States patent on a scalable cyber-risk assessment method records Normshield Inc as assignee and names three of the company's executives as inventors. The data side is not what carries this score, because the trust page says Black Kite does not retain or reuse information that is not already publicly available, the methodology page names open-source intelligence as the input, and the scoring weights and the index research are published. \[[s3](#deep-dive-sources), [s7](#deep-dive-sources), [s9](#deep-dive-sources), [s15](#deep-dive-sources)\] |

### Strategic Market Segmentation

The segment the record documents is the security or third-party-risk function inside a regulated enterprise. Black Kite's home page addresses security leaders and third-party risk managers, and the organisations it names on that page and in its case studies include banks, insurers, health systems and a credit union, and its Tradewinds announcement states that small businesses use the platform too.

A second segment buys the same ratings for a different purpose. A case study describes Markel using the platform to manage a portfolio of insureds and to streamline underwriting, which prices risk rather than defends against it. The company also publishes an industry page for insurance alongside pages for manufacturing, financial services, healthcare, retail, technology and the public sector.

Public sector is a declared segment of its own, and the company states that the Department of War, US Cyber Command, the National Security Agency and NASA are among the agencies using the platform. The sector list is wide and the published proof behind it is several years old. The case studies name Markel, the University of Kansas Health System and Bay Federal Credit Union alongside Alteryx, Ellie Mae, Scantron and Encoded Therapeutics, so the roster runs wider than regulated buyers alone, and the dated entries on that page run from 2020 to 2023. \[[s1](#deep-dive-sources), [s10](#deep-dive-sources), [s22](#deep-dive-sources)\]

### Product Capabilities & AI Advantages

The capability that carries the argument is discovery and grading of what a vendor exposes to the internet. Black Kite discovers a target's publicly visible domains, subdomains and address ranges, then scores what it finds across twenty weighted categories whose individual weights it publishes, from patch management at ten points of a hundred down to web ranking at two.

Machine learning runs through the product as a method. Black Kite parses vendor policies and compliance documents automatically and maps the extracted evidence to more than twenty named frameworks, and its home page describes assessments moving from months to minutes on that parsing.

The distinctive model is the Ransomware Susceptibility Index, which scores a company between 0 and 1 from indicators the page lists, including remote-code-execution vulnerabilities, open critical ports, leaked credentials and stealer logs. Black Kite says the index is validated against thousands of confirmed victims each year and recalibrated as attacker techniques change, and its chief security officer published three years of the resulting figures. \[[s2](#deep-dive-sources), [s3](#deep-dive-sources), [s4](#deep-dive-sources), [s5](#deep-dive-sources), [s9](#deep-dive-sources)\]

### Sales Engagement & Go-to-Market

The record documents a free-rating lead route and no public checkout. The free rating page collects a name, job title and company email and routes the visitor into a thirty-minute briefing in which a Black Kite employee walks through the findings, which puts a person in the funnel before a contract rather than inside the delivered product.

Partners extend the reach. Black Kite runs an MSSP partner program that supplies a services playbook for the partner to deploy, and quotes Avertium's vice president of professional services describing vendor risk management, due diligence and board reporting built on the platform.

Black Kite states the scale behind those channels itself. A September 2024 release states more than 3,000 customers, and a November 2025 release states a five-year compound annual growth rate of 70 percent and a net promoter score of 74, none of it corroborated outside the company.

Published research is the third channel. Black Kite's 2026 ransomware report is built on 7,551 publicly disclosed victims, and the index data behind it is published as well. That output builds attention rather than an asset a rival lacks. \[[s6](#deep-dive-sources), [s9](#deep-dive-sources), [s18](#deep-dive-sources), [s20](#deep-dive-sources), [s21](#deep-dive-sources)\]

### Pricing Model

No price appears in the reviewed sources. The captured route to Black Kite is a request for a briefing rather than a published rate card, and the pricing surfaces recorded in the source list carry no figure.

What the site does publish is a free entry point. The Ransomware Susceptibility Index rating is offered at no cost in exchange for contact details and a thirty-minute briefing, which is lead capture rather than a product tier.

The partner program is where the record touches commercial scale. Black Kite tells partners the program serves five customers or five hundred, and the cited record does not state how a fee is calculated. \[[s6](#deep-dive-sources), [s18](#deep-dive-sources)\]

### Product Delivery & Operations

The product is software the customer configures and operates. Ratings, susceptibility scores and parsed assessment findings come back to the customer's own team, which decides what to do with them, and Black Kite's assessment page describes gap detection running automatically and assessment effort cut by up to 90 percent.

Vendor collaboration happens inside the platform rather than through Black Kite. The company ships a shared workspace for sharing assessment gaps, requesting remediation and tracking follow-up, so the customer does the chasing with the vendor.

The service layer the record documents is a partner program, and Avertium's vice president of professional services describes wrapping his firm's services around the platform for its own clients. \[[s5](#deep-dive-sources), [s6](#deep-dive-sources)\]

### Earning Customers' Trust

Black Kite runs a trust center listing SOC 2, ISO 27001:2022, GDPR, TX-RAMP Level 1, CSA STAR Level One and CSA Trusted Cloud Provider, with an ISO certificate, a SOC 3 report, an accessibility report and a pentest summary available behind a request-access flow.

Both government listings record a readiness stage rather than an authorization. The FedRAMP Marketplace records the offering, listed under NormShield, Inc. DBA Black Kite as the Third-Party Risk Intelligence System, at Legacy FedRAMP Ready with zero authority-to-operate letters as of 25 March 2026. GovRAMP's participant list records the same product at Ready rather than Authorized, at a Moderate impact level, on a page whose neighbouring rows carry the Authorized status. Black Kite's own July 2026 announcement is headlined GovRAMP Ready Status and states in its body that the product "has achieved GovRAMP Authorization".

Black Kite claims public-sector standing beyond those two registries. A March 2026 announcement states an Awardable status in the Department of War's Tradewinds Solutions Marketplace and names the Department of War, US Cyber Command, the National Security Agency and NASA among the agencies using the platform, all of which are the company's own statements.

One statement on that page bears on the product rather than on its security. Black Kite says it does not retain, reuse or store any specific information that is not already publicly available, which is a claim about the intelligence it gathers on third parties. The same page records customer personally identifiable information among the data Black Kite collects, and it does not state how the two sit together. \[[s7](#deep-dive-sources), [s13](#deep-dive-sources), [s14](#deep-dive-sources), [s19](#deep-dive-sources), [s22](#deep-dive-sources)\]

### Platform Strategy & Ecosystem Positioning

Black Kite sits beside the systems a customer already runs. It publishes an open programming interface and a set of native integrations intended to carry risk data into security, risk and business operations, which is how findings reach the governance tools where decisions get recorded.

The scoring method is assembled from named public standards. MITRE's Cyber Threat Susceptibility Assessment supplies the assessment steps, the Common Weakness Scoring System ranks the techniques, and Open FAIR quantifies the financial exposure. Black Kite's own page says the point of using them is that everyone in the industry can read the result.

One surface points the other way. Black Kite Bridge is a shared workspace the company markets for customer-vendor collaboration, and its September 2025 anniversary announcement claims a community of thousands of third parties growing over 100 percent quarter over quarter, more than 100,000 intelligence items shared, and vendor response rates above 85 percent. Those are the company's own figures for a service one year old.

Nothing in the reviewed record shows another company's product depending on Black Kite to run. Its integrations push data outward into tools the customer already owns, which is a platform position rather than an infrastructure one. \[[s1](#deep-dive-sources), [s3](#deep-dive-sources), [s23](#deep-dive-sources)\]

### Team & Execution Capability

The outside record confirms the technical bench. A granted United States patent on scalable cyber-risk assessment records Normshield Inc as assignee and names Candan Bolukbas, Ferhat Dikbiyik and Robert Maley as inventors, which puts three of the company's named executives on a document a patent office examined.

Bolukbas co-founded the company and still runs technology. Black Kite's about page traces the idea to his work as a certified ethical hacker for NATO and dates the build to 2016. The same page records Dikbiyik as chief research and intelligence officer leading data scientists and engineers, and Bob Maley as chief security officer after running PayPal's global third-party security and inspections program.

The commercial bench reaches the record only through the company's own page. Paul Paget has been chief executive since 2019 by the company's own account, and his earlier chief executive roles are described on that page and nowhere else in the reviewed sources, which ties two of those companies to Fortra without stating what part he played in either outcome. \[[s2](#deep-dive-sources), [s15](#deep-dive-sources), [s21](#deep-dive-sources)\]

## Sources

### Company Detail Sources

Cited from the Sourced Details and Matrix Coverage rows.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | [Black Kite: home page](https://blackkite.com/) | official | 2026-08-20 |
| f2 | [Black Kite: about page](https://blackkite.com/about) | official | 2026-08-20 |
| f3 | [SecurityWeek: Vendor Risk Management Firm Black Kite Raises $22 Million](https://www.securityweek.com/vendor-risk-management-firm-black-kite-raises-22-million/) | press | 2026-08-20 |
| f4 | [Black Kite: risk management methodology page](https://blackkite.com/platform/risk-management-methodology) | official | 2026-08-20 |

### Profile Analysis Sources

Cited from the Market Readiness section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Black Kite: home page](https://blackkite.com/) “Black Kite is a third-party cyber risk management (TPCRM) platform that gives organizations continuous, open standards-based cyber ratings across their entire vendor ecosystem.” | official | 2026-08-20 |
| s2 | [Black Kite: about page](https://blackkite.com/about) “In 2016, realizing his insight had commercial implications, Candan and his team built a cyber risk rating platform that could identify, continuously monitor, and scale” | official | 2026-08-20 |
| s3 | [Black Kite: risk management methodology page](https://blackkite.com/platform/risk-management-methodology) “The total score is a weighted average of 20 category components, providing unmatched breadth and insight into detected vulnerabilities.” | official | 2026-08-20 |
| s4 | [Black Kite: Ransomware Susceptibility Index page](https://blackkite.com/platform/ransomware-susceptibility-index) “Black Kite’s Ransomware Susceptibility Index® (RSI™) measures the likelihood of which vendors are most likely to be hit next, using real-time signals to spotlight risk before attackers make a move.” | official | 2026-08-20 |
| s5 | [Black Kite: Assess product page](https://blackkite.com/platform/assess) “Black Kite Assess is the AI-powered platform for automated vendor risk assessments. Built on trusted intelligence from Black Kite Monitor, it reviews vendor documentation in minutes instead of days.” | official | 2026-08-20 |
| s6 | [Black Kite: managed services partner page](https://blackkite.com/partners/managed-services) “Join our MSSP Partner Program and grow your recurring revenue.” | official | 2026-08-20 |
| s7 | [Black Kite: trust center, rendered](https://trust.blackkite.com/) “It does not retain, reuse, store any specific information that is not already publicly available.” | official | 2026-08-20 |
| s8 | [Black Kite: comparison page naming SecurityScorecard](https://blackkite.com/competitors/black-kite-vs-securityscorecard) “Founded later than many incumbents in the Cyber Risk Ratings (CRR) space, Black Kite faces lower brand recognition in this traditional market as it focuses on market education to drive the shift from CRR to TPCRM, where it has emerged as a leader.” | official | 2026-08-20 |
| s9 | [Black Kite: blog post on three years of index data](https://blackkite.com/blog/three-years-ransomware-susceptibility-index-data) “The multiplier climbed from 27x in 2023, to 96x in 2024, to 291x this year, while the high-risk band barely moved, holding in the mid-40s the entire run.” | official | 2026-08-20 |
| s10 | [Black Kite: case studies index, rendered](https://blackkite.com/case-studies) “Aug 24, 2023 case study Fractional Ciso Utilizes Black Kite for Continuous Client Vendor Management + Revealing Vulnerabilities Requiring Attention” | official | 2026-08-20 |
| s11 | [Black Kite: terms of use page](https://blackkite.com/terms-of-use) “is a copyrighted work belonging to NormShield Inc. dba Black Kite Inc.” | official | 2026-08-20 |
| s12 | [SecurityWeek: Vendor Risk Management Firm Black Kite Raises $22 Million](https://www.securityweek.com/vendor-risk-management-firm-black-kite-raises-22-million/) “it has raised $22 million in a Series B funding round led by Volition Capital, bringing the total raised by the Boston, Mass.-based company to more than $33.1 million.” | press | 2026-08-20 |
| s13 | [FedRAMP Marketplace: Third-Party Risk Intelligence System (TRIS) listing](https://www.fedramp.gov/marketplace/products/FR2434074613/) “NormShield, Inc. DBA Black Kite” | regulatory | 2026-08-20 |
| s14 | [GovRAMP: program participants list](https://govramp.org/program-participants) “Black Kite Black Kite Third Party Risk Intelligence SaaS Moderate Ready” | regulatory | 2026-08-20 |
| s15 | [Google Patents: US10949543B1 record naming Normshield Inc as assignee](https://patents.google.com/patent/US10949543B1/en) “System and method for scalable cyber-risk assessment of computer systems” | research | 2026-08-20 |
| s16 | [CourtListener: docket search record for NormShield](https://www.courtlistener.com/api/rest/v4/search/?q=%22NormShield%22&type=r) “"caseName":"BitSight Technologies, Inc. v. NormShield Inc."” | regulatory | 2026-08-20 |
| s17 | [Help Net Security: New Black Kite tool identifies which vendors are most vulnerable to targeted threat groups](https://www.helpnetsecurity.com/2025/08/06/black-kite-asi-adversary-susceptibility-index/) “has unveiled the Adversary Susceptibility Index (ASI), a tool designed for TPRM teams to proactively identify which vendors are most vulnerable to specific threat actors before threats escalate into breaches.” | press | 2026-08-20 |
| s19 | [Black Kite: press release on its GovRAMP result](https://blackkite.com/press-releases/black-kite-achieves-govramp-ready-status-for-third-party-risk-intelligence) “Black Kite Achieves GovRAMP Ready Status for Third-Party Risk Intelligence” | official | 2026-08-20 |
| s20 | [Black Kite: press release on the court dismissal of Bitsight's patent claims](https://blackkite.com/press-releases/black-kite-announces-court-dismissal-of-bitsight-technologies) “the Court ruled that the asserted claims for all five of these patents are invalid because they failed to claim patentable subject matter as required by United States patent law.” | official | 2026-08-20 |
| s21 | [Black Kite: press release stating its growth and customer-satisfaction figures](https://blackkite.com/press-releases/fueled-by-record-growth-and-customer-satisfaction-black-kite-introduces-black-kite-ai-agent-continuing-to-drive-the-future-of-ai-native-third-party-cyber-risk-management) “Black Kite has achieved record growth, with a 5-year Compound Annual Growth Rate (CAGR) of 70%, driven by customer success and satisfaction scores that exceed industry standards.” | official | 2026-08-20 |
| s22 | [Black Kite: press release on Tradewinds Solutions Marketplace status](https://blackkite.com/press-releases/black-kite-assessed-awardable-for-department-of-war-work-in-the-cdaos-tradewinds-solutions-marketplace) “today announced that it has achieved “Awardable” status through the Chief Digital and Artificial Intelligence Office’s (CDAO)” | official | 2026-08-20 |
| s23 | [Black Kite: press release on the Bridge first anniversary](https://blackkite.com/press-releases/black-kite-bridge-closes-first-anniversary-with-strong-momentum-and-adoption-surpassing-100000-intelligence-items-shared) “Black Kite Bridge™ has built a strong community of thousands of third parties, growing over 100% quarter over quarter” | official | 2026-08-20 |
| s25 | [BankInfoSecurity: report on a Forrester cybersecurity risk ratings evaluation](https://www.bankinfosecurity.com/bitsight-securityscorecard-panorays-lead-risk-ratings-tech-a-25326) “Bitsight once again holds second place, and Black Kite has jumped ahead of Panorays for third place.” | press | 2026-08-20 |
| s26 | [Court docket 1:23-cv-12055: memorandum and order on the defendant's motion to dismiss](https://5234018.fs1.hubspotusercontent-na1.net/hubfs/5234018/WP%20Migration/Media/September-20-2024-Order.pdf) “It is granted as to BitSight’s patent infringement claims, Counts 1 through 5.” | regulatory | 2026-08-20 |

### Deep-Dive Sources

Cited from the Strategy Deep Dive section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Black Kite: home page](https://blackkite.com/) “Black Kite is a third-party cyber risk management (TPCRM) platform that gives organizations continuous, open standards-based cyber ratings across their entire vendor ecosystem.” | official | 2026-08-20 |
| s2 | [Black Kite: about page](https://blackkite.com/about) “In 2016, realizing his insight had commercial implications, Candan and his team built a cyber risk rating platform that could identify, continuously monitor, and scale” | official | 2026-08-20 |
| s3 | [Black Kite: risk management methodology page](https://blackkite.com/platform/risk-management-methodology) “The total score is a weighted average of 20 category components, providing unmatched breadth and insight into detected vulnerabilities.” | official | 2026-08-20 |
| s4 | [Black Kite: Ransomware Susceptibility Index page](https://blackkite.com/platform/ransomware-susceptibility-index) “Black Kite’s Ransomware Susceptibility Index® (RSI™) measures the likelihood of which vendors are most likely to be hit next, using real-time signals to spotlight risk before attackers make a move.” | official | 2026-08-20 |
| s5 | [Black Kite: Assess product page](https://blackkite.com/platform/assess) “Black Kite Assess is the AI-powered platform for automated vendor risk assessments. Built on trusted intelligence from Black Kite Monitor, it reviews vendor documentation in minutes instead of days.” | official | 2026-08-20 |
| s6 | [Black Kite: managed services partner page](https://blackkite.com/partners/managed-services) “Join our MSSP Partner Program and grow your recurring revenue.” | official | 2026-08-20 |
| s7 | [Black Kite: trust center, rendered](https://trust.blackkite.com/) “It does not retain, reuse, store any specific information that is not already publicly available.” | official | 2026-08-20 |
| s8 | [Black Kite: comparison page naming SecurityScorecard](https://blackkite.com/competitors/black-kite-vs-securityscorecard) “Founded later than many incumbents in the Cyber Risk Ratings (CRR) space, Black Kite faces lower brand recognition in this traditional market as it focuses on market education to drive the shift from CRR to TPCRM, where it has emerged as a leader.” | official | 2026-08-20 |
| s9 | [Black Kite: blog post on three years of index data](https://blackkite.com/blog/three-years-ransomware-susceptibility-index-data) “The multiplier climbed from 27x in 2023, to 96x in 2024, to 291x this year, while the high-risk band barely moved, holding in the mid-40s the entire run.” | official | 2026-08-20 |
| s10 | [Black Kite: case studies index, rendered](https://blackkite.com/case-studies) “Aug 24, 2023 case study Fractional Ciso Utilizes Black Kite for Continuous Client Vendor Management + Revealing Vulnerabilities Requiring Attention” | official | 2026-08-20 |
| s11 | [Black Kite: terms of use page](https://blackkite.com/terms-of-use) “is a copyrighted work belonging to NormShield Inc. dba Black Kite Inc.” | official | 2026-08-20 |
| s12 | [SecurityWeek: Vendor Risk Management Firm Black Kite Raises $22 Million](https://www.securityweek.com/vendor-risk-management-firm-black-kite-raises-22-million/) “it has raised $22 million in a Series B funding round led by Volition Capital, bringing the total raised by the Boston, Mass.-based company to more than $33.1 million.” | press | 2026-08-20 |
| s13 | [FedRAMP Marketplace: Third-Party Risk Intelligence System (TRIS) listing](https://www.fedramp.gov/marketplace/products/FR2434074613/) “NormShield, Inc. DBA Black Kite” | regulatory | 2026-08-20 |
| s14 | [GovRAMP: program participants list](https://govramp.org/program-participants) “Black Kite Black Kite Third Party Risk Intelligence SaaS Moderate Ready” | regulatory | 2026-08-20 |
| s15 | [Google Patents: US10949543B1 record naming Normshield Inc as assignee](https://patents.google.com/patent/US10949543B1/en) “System and method for scalable cyber-risk assessment of computer systems” | research | 2026-08-20 |
| s16 | [CourtListener: docket search record for NormShield](https://www.courtlistener.com/api/rest/v4/search/?q=%22NormShield%22&type=r) “"caseName":"BitSight Technologies, Inc. v. NormShield Inc."” | regulatory | 2026-08-20 |
| s17 | [Help Net Security: New Black Kite tool identifies which vendors are most vulnerable to targeted threat groups](https://www.helpnetsecurity.com/2025/08/06/black-kite-asi-adversary-susceptibility-index/) “has unveiled the Adversary Susceptibility Index (ASI), a tool designed for TPRM teams to proactively identify which vendors are most vulnerable to specific threat actors before threats escalate into breaches.” | press | 2026-08-20 |
| s18 | [Black Kite: free rating sign-up page, and probe of the pricing surfaces /pricing, /plans and the landing-page sitemap on 2026-08-20](https://blackkite.com/free-rsi-rating) “No cost. 30 Minutes.” | official | 2026-08-20 |
| s19 | [Black Kite: press release on its GovRAMP result](https://blackkite.com/press-releases/black-kite-achieves-govramp-ready-status-for-third-party-risk-intelligence) “Black Kite Achieves GovRAMP Ready Status for Third-Party Risk Intelligence” | official | 2026-08-20 |
| s20 | [Black Kite: press release on the court dismissal of Bitsight's patent claims](https://blackkite.com/press-releases/black-kite-announces-court-dismissal-of-bitsight-technologies) “the Court ruled that the asserted claims for all five of these patents are invalid because they failed to claim patentable subject matter as required by United States patent law.” | official | 2026-08-20 |
| s21 | [Black Kite: press release stating its growth and customer-satisfaction figures](https://blackkite.com/press-releases/fueled-by-record-growth-and-customer-satisfaction-black-kite-introduces-black-kite-ai-agent-continuing-to-drive-the-future-of-ai-native-third-party-cyber-risk-management) “Black Kite has achieved record growth, with a 5-year Compound Annual Growth Rate (CAGR) of 70%, driven by customer success and satisfaction scores that exceed industry standards.” | official | 2026-08-20 |
| s22 | [Black Kite: press release on Tradewinds Solutions Marketplace status](https://blackkite.com/press-releases/black-kite-assessed-awardable-for-department-of-war-work-in-the-cdaos-tradewinds-solutions-marketplace) “today announced that it has achieved “Awardable” status through the Chief Digital and Artificial Intelligence Office’s (CDAO)” | official | 2026-08-20 |
| s23 | [Black Kite: press release on the Bridge first anniversary](https://blackkite.com/press-releases/black-kite-bridge-closes-first-anniversary-with-strong-momentum-and-adoption-surpassing-100000-intelligence-items-shared) “Black Kite Bridge™ has built a strong community of thousands of third parties, growing over 100% quarter over quarter” | official | 2026-08-20 |
| s25 | [BankInfoSecurity: report on a Forrester cybersecurity risk ratings evaluation](https://www.bankinfosecurity.com/bitsight-securityscorecard-panorays-lead-risk-ratings-tech-a-25326) “Bitsight once again holds second place, and Black Kite has jumped ahead of Panorays for third place.” | press | 2026-08-20 |
| s26 | [Court docket 1:23-cv-12055: memorandum and order on the defendant's motion to dismiss](https://5234018.fs1.hubspotusercontent-na1.net/hubfs/5234018/WP%20Migration/Media/September-20-2024-Order.pdf) “It is granted as to BitSight’s patent infringement claims, Counts 1 through 5.” | regulatory | 2026-08-20 |

## Disclaimer

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.