🔓Study Finds 34.2% of 18,160 AI Companies Have Critical Vulnerabilities

Your AI vendors might be the weakest link

Most AI vendors you're trusting with your data can't pass basic security checks. A new study of 18,160 AI companies worldwide found 34.2% had at least one critical vulnerability. That's roughly one in three. If you're plugging third-party models, copilots, or agent platforms into production, this is your problem. Enterprises are buying 76% of their AI solutions instead of building them, so your attack surface is mostly someone else's code and someone else's infrastructure. Vendor vetting isn't a procurement checkbox anymore. The email and network numbers are rough. 61.7% of AI companies had DMARC issues, 37.3% had DKIM weaknesses, and 41.8% showed botnet-related activity. Among 1,732 logged security findings, 48.8% were rated High or Critical. And 19.9% of AI companies offering enterprise deployment solutions had corporate logins in infostealer records. The catch? A single assessment is a snapshot. Vendors change their posture, so you need continual monitoring to catch drift.