Third-party cyber risk vendor Black Kite has launched an integration that puts its vendor risk intelligence inside CrowdStrike Falcon Next-Gen SIEM, so SOC teams can work supplier exposure in the same queue as their own alerts.
According to Black Kite’s 2 November announcement, the integration sends its Ransomware Susceptibility Index scores, FocusTags and aggregated vendor ratings into the SIEM. Black Kite escalates third-party vulnerabilities by criticality, confidence and EPSS score, CrowdStrike’s Charlotte Agentic SOAR playbooks enrich and investigate each finding, and remediation requests go to the vendor through Black Kite’s The Bridge. Ticket status and metrics such as average days to close critical findings flow back into the SIEM dashboard. The integration is listed in the CrowdStrike Marketplace.
Chuck Schauber, Chief Product Officer at Black Kite, said that “most SOC workflows have no mechanism to surface that risk until it’s an active incident.” The announcement also claims the integration cuts third-party incident response times by 5x, a vendor figure with no published method.
In our reading, the shift is organizational. Vendor risk has usually lived with GRC teams as questionnaires and annual ratings, while the SOC learns about a supplier breach from the news. Routing supplier findings into SOC playbooks gives them an owner with a clock, but it also means analysts inherit tickets they cannot fix themselves and depend on the vendor’s response. Teams evaluating this kind of integration should agree up front which supplier findings page the SOC and which stay with procurement. Our earlier brief on Black Kite’s mid-market ransomware data and our brief on ConnectWise suspending a cloud backup service show how supplier incidents land on customers.
Source: Black Kite via PR Newswire
