Cyber Risk Quantification and Supply Chain Security Ratings
Turning Technical Flaws into Financial Facts
Elasticito rates the cyber risk of your suppliers from the outside with Black Kite, adding a ransomware susceptibility score and an Open FAIR estimate of financial loss for each one, with no questionnaire needed to start.
Quantifiable Risk: The New Standard for Supply Chain Risk Management (TPRM)
Request Your Cyber Risk Rating
Financial Risk Quantification Board-Level Metrics
OPEN FAIR™ Model Integration:
Calculate Annualised Loss Expectancy (ALE) for cyber events
Ransomware Susceptibility Scoring:
Proprietary RSI score predicts attack likelihood
Supply Chain Risk Ratings Real-Time Vendor Visibility
AI-Driven Non-Intrusive Assessment:
Passive monitoring without questionnaires
Automated Vendor Onboarding:
Instant risk scoring for new third parties
Portfolio-Level Aggregation:
View cumulative risk across your supply chain
Industry Benchmarking Competitive Intelligence
Peer Comparison:
See how your security posture compares to industry standards
Trend Analysis:
Track improvement over time with historical data
Compliance Scoring:
Meet SOC 2/ISO 27001 supply chain risk management requirements
Questions About Supply Chain Cyber Risk
How do vendor security ratings work?
A security rating scores a company from the outside, using open source intelligence rather than questionnaires or agents. Black Kite, which Elasticito uses for this service, gathers that intelligence continuously and calculates the score as a weighted average of 20 risk categories, such as patch management and credential management. It builds on industry models including MITRE’s Cyber Threat Susceptibility Assessment and Open FAIR. Because it uses outside data, you can rate a supplier before it has answered a single questionnaire.
What is the Ransomware Susceptibility Index?
The Ransomware Susceptibility Index (RSI) is Black Kite’s measure of how likely a company is to suffer a ransomware attack. It combines company size, industry and country with technical signals such as leaked credentials and open critical ports. Black Kite reports that over 70% of ransomware victims had an RSI above its high-risk threshold of 0.4. Sort your supplier list by RSI and start the conversation with anyone above 0.4.
What is cyber risk quantification and how does FAIR work?
Cyber risk quantification expresses cyber risk as a probable financial loss instead of a red, amber or green rating. FAIR (Factor Analysis of Information Risk) is a model for doing it. In Black Kite’s implementation, risk is loss event frequency multiplied by loss magnitude, across six forms of loss including response costs and fines. Black Kite gives each third party a financial range for data breach, ransomware and business interruption, so a board can see where remediation spending removes the most exposure.
Does NIS2 require us to check our suppliers' security?
Yes if you are in scope, and through your EU customers’ contracts if you are not. Article 21 of NIS2 lists supply chain security among the minimum measures, covering the security of relationships with direct suppliers and service providers. Entities must take into account each supplier’s specific vulnerabilities and the overall quality of its cybersecurity practices. DORA sets similar duties for EU financial entities. In the UK, the Cyber Security and Resilience Bill, which amends the NIS Regulations 2018, was at its House of Lords stages in September 2026.
Do security ratings replace vendor security questionnaires?
No, they answer different questions. A rating shows what a supplier exposes to the internet today; a questionnaire asks about internal controls you cannot see from outside, but the answers are self-reported. A stronger pattern is to use ratings to decide which suppliers need scrutiny, then ask those suppliers for independently audited evidence such as a SOC 2 report or ISO 27001 certificate. Black Kite maps that evidence automatically to frameworks including NIST, ISO 27001, SOC 2 and PCI DSS.
What is third-party cyber risk management?
It is how you find which suppliers could cause you a cyber loss, check them before and after you sign, and act when their exposure changes. NIS2 Article 21 lists supply chain security among its minimum measures, and DORA sets similar duties for EU financial entities. A workable sequence is to rate every supplier from the outside, use the ratings to pick which suppliers need scrutiny, and ask those for independently audited evidence. Black Kite updates its data continuously, so the review becomes ongoing rather than annual.
What is fourth-party risk?
It is the risk you inherit from your suppliers’ own suppliers, such as the cloud host or sub-processor your vendor relies on. You have no contract with them, yet a breach there can reach your data. Where personal data is involved, GDPR Article 28 requires a processor to get your authorisation before engaging a sub-processor and to pass the same data protection obligations down. Our guide to fourth-party and sub-processor risk covers the detail.