Black Kite Third-Party Cyber Risk

Black Kite Third-Party Cyber Risk is a web platform for assessing vendors and continuously watching cyber exposure through multiple layers of the supply chain. It fits security, procurement and risk teams responsible for broad or strategically important supplier portfolios. Its deep dependency mapping and financial analysis are powerful differentiators, while custom pricing and a primarily enterprise-oriented setup make it less suitable for small teams seeking a self-serve tool.

Overview

The platform extends visibility from first-party posture through fifth-party exposure, rather than stopping at direct suppliers. It combines assessment workflows, monitoring, threat intelligence and financial quantification in one environment. Open, auditable standards give risk decisions a traceable basis, which is useful when findings must be explained to executives, auditors or business owners.

Key features

Black Kite identifies suppliers, software products and geographies that could become single points of failure. Its mapping of third-, fourth- and fifth-party relationships shows how an incident at a downstream organization could affect the vendors you rely on. This depth helps organizations with complex interdependencies; teams concerned only with a short list of direct vendors may find the broader model more than they need.

Black Kite Monitor continuously watches vendor portfolios and delivers real-time risk intelligence. FocusTags associate breaches, active exploits, CVEs and dark-web exposures with specific vendors, giving risk owners a practical way to prioritize follow-up. The Ransomware Susceptibility Index adds a predictive, vendor-specific ransomware signal. Together, these tools support ongoing triage rather than a once-a-year review, but they demand a process and staff able to respond to changing alerts.

Open FAIR-based analysis converts vendor and supply-chain cyber posture into dollar-denominated exposure. That makes cyber risk easier to compare with other business risks and to present in financial terms, although the usefulness depends on stakeholders being prepared to act on quantified scenarios.

Black Kite Assess uses AI to parse policies and compliance documents, mapping evidence to more than 25 global frameworks or a custom framework. Its questionnaire library, evidence collection and hybrid assessment method support structured reviews. A shared workspace lets teams show gaps to vendors, request remediation and track follow-up. Workflow automation can reduce coordination overhead, especially across a large portfolio.

Official integrations cover ServiceNow TPRM and ITSM, Aravo, LogicGate Risk Cloud, OneTrust, Archer, Splunk, Jira, Power BI, Slack, Zapier, Microsoft Teams and an MCP Server. These connections can place risk data in existing governance, analytics and collaboration workflows instead of creating another isolated queue.

Black Kite completed a SOC 2 Type 2 examination covering security, availability, confidentiality, processing integrity and privacy criteria. It announced GovRAMP Authorization for its Third-Party Cyber Risk Intelligence platform in July 2026. Production customer data is stored and processed exclusively in US-based Google Cloud Platform regions, an important constraint for organizations requiring non-US residency.

Pricing

Standard

Standard has custom pricing. It is a full-featured product with onboarding, enablement, configuration and environment tuning included, plus unlimited users. It suits organizations wanting the complete capability set without a published per-seat ceiling, but buyers must request a quote before comparing total cost.

Enterprise

Enterprise also uses custom pricing and includes the full-featured product, onboarding, enablement, configuration and environment tuning, with unlimited users.

Platforms

Black Kite is delivered as a web application. Its integrations extend into service management, risk, analytics and messaging systems, but the core product platform is web-based.

Who it's for

Choose Black Kite when your organization must understand downstream supplier exposure, continuously monitor a substantial vendor portfolio, coordinate remediation with vendors and express cyber risk in financial terms. It is a stronger fit for mature security, procurement and risk functions than for a small business needing a low-cost, lightly managed assessment tool.

Pros and cons

• Pros: Fifth-party visibility exposes dependencies that direct-vendor reviews can miss.
• Pros: Continuous monitoring, FocusTags and ransomware prediction provide several ways to prioritize emerging threats.
• Pros: Open FAIR-based financial quantification supports business-level risk discussions.
• Pros: AI evidence mapping, shared vendor workspaces and workflow automation support repeatable assessments.
• Cons: Custom pricing makes budgeting and direct plan comparison difficult.
• Cons: The depth of monitoring and downstream mapping may exceed the needs of teams with small or simple supplier portfolios.
• Cons: US-only production data processing rules out deployments that require another residency region.

Alternatives

Third-Party Risk Management Software is the broader category to review when you want to compare Black Kite with other vendor-risk products. Choose Security Ratings Software when external security scoring is the primary requirement.

SecurityScorecard Third-Party Risk Management is a better starting point for buyers wanting a freemium option, a free plan and API or web access. Diligent Audit suits organizations that need an audit-focused product across Android, iOS, API and web. Certa Third-Party Risk Management is another paid API and web option.

nBoardPortal is a paid iOS and web product with unlimited users, storage, updates and support. Riskonnect is worth considering when project size, complexity and customization call for tailored implementation. Whistic offers a freemium route with a free plan, standardized frameworks and vendor review workflows. Covasant TPRM is a paid alternative. Gartner Third-Party Cybersecurity Insights is another paid web option.

Verdict

Black Kite is a strong choice for organizations that need deep, continuously updated visibility into vendor and downstream supply-chain risk, with remediation workflows and financial exposure analysis in the same platform. Look elsewhere if you need transparent pricing, a lightweight self-serve purchase or production data residency outside the United States.