Black Kite reports lower vulnerability exposure but steady credential signals at large manufacturers

Black Kite’s 2026 manufacturing report, announced on 17 September, found lower rates of two externally visible vulnerability indicators among large manufacturers than in 2024, while the share associated with credentials in stealer logs was virtually unchanged. The contrast shows why vulnerability remediation and credential protection require separate attention. The figures are risk signals, not proof that the organisations were compromised.

According to the cyber risk vendor, the share of its cohort with at least one critical vulnerability fell from 80% in 2024 to 74.8% in August 2026. Exposure to a vulnerability in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue fell from 67% to 54.2%. By contrast, the share with employee or system credentials in stealer logs moved from 69% to 69.1%.

CISA describes the KEV catalogue as the authoritative source of vulnerabilities known to have been exploited in the wild and recommends using it to inform vulnerability-management priorities. The reported fall is consistent with better prioritisation inside Black Kite’s dataset, but it cannot establish comprehensive patch-management maturity across manufacturing. Nor does a KEV match prove that the vulnerability was exploited at a particular company.

External findings require careful interpretation

Black Kite’s August scan also reported that 35.6% of the cohort lacked properly configured DMARC, 34.3% had what the company classified as an active botnet finding and 29.8% had at least one recorded data breach. These categories reflect the vendor’s external telemetry and historical records. They do not independently confirm a current internal infection or continuing intrusion at every flagged organisation.

A stealer-log match can justify an investigation, but it does not establish that the associated credentials remain valid or can reach corporate resources. Black Kite’s report does not disclose whether the credentials came from company-managed devices, what privileges they carried or whether the accounts were protected by multifactor authentication. The result therefore supports a narrower finding about persistent credential exposure, not a sector-wide verdict on identity and access management.

Black Kite’s separately tracked pool of disclosed manufacturing victims showed a less favourable trend. Among those victims, stealer-log findings increased from 25% in 2023 to 41.8% in 2026. Misconfiguration findings declined from 83.7% to 71%, while internet-exposed remote-access ports changed little, moving from 51.3% to 51.9%. These overlapping indicators do not establish that credential exposure caused the reported rise in incidents.

A limited cohort, not a manufacturing census

The report’s Top 1000 label covers 1,049 manufacturers with annual revenue above $1 billion across 10 of manufacturing’s 21 NAICS subsectors. Black Kite says the label is not a literal ranking of the 1,000 largest manufacturers. The results cannot therefore be generalised to all manufacturers, smaller businesses, every geographic market or the 11 subsectors outside the cohort.

For its incident analysis, Black Kite assembled a working base of 5,237 disclosed ransomware and data-extortion victims between 1 January 2023 and 29 July 2026. That included 4,780 manufacturing victims and 457 distribution victims. The company says it collected records from leak sites, extortion posts and dark-web sources, then validated them against open-source intelligence and internal telemetry. Private and undisclosed incidents are absent, and Black Kite did not publish the raw victim list or company-level scan data needed to reproduce its findings independently.

Within that dataset, Black Kite counted 1,183 disclosed manufacturing incidents from 1 January to 29 July 2026, compared with 847 in the equivalent 2025 period, an increase of 39.7%. The partial 2026 count also exceeded the 1,071 incidents recorded for all of 2024. These figures do not represent every ransomware event because undetected, private and undisclosed incidents are not included, and changes in public visibility can affect reported totals.

Revenue information was available for only part of the 2026 victim pool. Among that subset, 70.2% of manufacturing victims had revenue between $10 million and $100 million, and the median victim revenue was $42.9 million. The concentration makes ransomware exposure among mid-sized suppliers a potential continuity concern for larger manufacturers. It does not establish ransomware prevalence across all suppliers or revenue bands.

How Australian organisations should read the findings

Black Kite did not publish a separate Australian result, so its percentages are not a benchmark for Australian manufacturing. Australian Signals Directorate reporting nevertheless demonstrates the relevance of the two control areas. ASD’s 2024-25 Cyber Threat Report says credential-stealing malware and purchased usernames and passwords were used in subsequent attacks on corporate accounts and networks. Compromised accounts or credentials featured in 42% of Category 3 incidents, while the Australian Cyber Security Centre responded to 138 ransomware incidents during the year.

ASD’s Essential Eight treats application and operating-system patching and multifactor authentication as core mitigations. Its guidance uses exposure-based patching timeframes, including rapid treatment for specified critical vulnerabilities. It also requires multifactor authentication for organisational online services and privileged users at relevant maturity levels. The two control areas address different parts of the risk picture highlighted by Black Kite.

Organisations using external findings should validate stealer-log, botnet, DMARC and remote-access signals against internal inventories and security telemetry before declaring either compromise or remediation complete. A lower external vulnerability count does not establish that every relevant internal or operational technology asset has been patched, just as a leaked credential does not confirm that an account remains usable.

The research was produced by the company selling the risk-monitoring platform used in the study, and the report promotes Black Kite’s own scoring system and services. Its report and announcement also conflict over a claimed sector-leading streak and the wording of the 2026 growth period, reinforcing the need for precise attribution and period-specific figures. For Australian organisations, the study is best treated as a prompt to test their own controls and suppliers, not as a domestic benchmark. Its clearest finding is limited but useful: lower vulnerability exposure can coexist with an essentially unchanged credential indicator, and neither measure alone establishes compromise.

External vulnerability and credential findings are most useful when treated as leads for validation rather than verdicts on compromise. Use that distinction to frame further study with The Hack Academy’s online cybersecurity training programme, which offers self-paced learning and practical exercises alongside theory in cybersecurity fundamentals, networking and internet vulnerabilities.