54% of the 140 vendors whose client base is meaningfully concentrated in finance carry at least one vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
| Publisher | Black Kite |
| Report | 2026 State of Financial Services: The Dual Storm of Ransomware and Vendor Ecosystem Risk |
| Published | 3 June 2026 |
| Topics | Exploit Catalogs, Vendor Risk, Financial Services |
Published by Black Kite in 2026 State of Financial Services: The Dual Storm of Ransomware and Vendor Ecosystem Risk, 3 June 2026. The figure is taken from the report as published; the full methodology is in the source.