Topic starter
21/10/2026 7:00 pm
TL;DR: 2,300 disclosed vulnerabilities show how far Mythos discovery has run ahead of fixes, in Black Kite's data set. Third-party risk now turns on remediation speed and dependency concentration, not just how many flaws are found.
Editorial analysis by NHI Mgmt Group, based on content published by Black Kite: “2,300 Mythos Vulnerabilities Disclosed. 421 Patched. That Gap Is in Your Supply Chain.”.
By the numbers:
- Black Kite says roughly 2,300 vulnerabilities were formally disclosed across 392 open-source projects, but only 421 have been patched.
- Black Kite reports that Anthropic’s dashboard showed a 91.4% true positive rate on external review.
Key questions
Q: Why does slow third-party patching increase supply chain risk?
A: Because disclosure turns a hidden flaw into a known weakness while leaving the fix outside your control.
Q: What are the signs that third-party vulnerability governance is failing?
A: The main signals are long vendor response times, repeated exposure in shared components, and a growing gap between confirmed findings and actual patches.
Q: What breaks when a third-party vulnerability is disclosed faster than suppliers can patch it?
A: The control that breaks is remediation-led governance.
Practitioner guidance
- Build a remediation-first vendor scoring model Rank suppliers by patch latency, confirmed disclosure handling, and the number of load-bearing dependencies they operate in your environment.
- Map shared software dependencies across third parties Identify libraries, services, and integrations that appear in multiple vendors so one flaw does not become a multi-vendor exposure event.
- Separate discovery volume from actionable exposure Create a triage process that filters candidate findings by exploitability, business path, and whether the affected vendor can realistically patch.
Bottom line: AI-assisted vulnerability discovery has shifted the bottleneck from finding flaws to getting third parties to fix them.
Glossary terms: Concentration risk, Remediation Latency, Third-Party Cyber Risk, Exploitability-first prioritisation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
23/10/2026 12:48 am
Third-party security has become a remediation problem, not a discovery problem. The article’s core finding is that tooling can now surface more flaws than the ecosystem can absorb. That shifts governance from finding weaknesses to proving that suppliers can actually remediate them at useful speed. For identity programmes, the same lesson applies to delegated access and third-party credentials: discovery without lifecycle control does not reduce exposure.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: Should security teams prioritise shared dependencies over isolated vendor findings?
A: Yes, when the same library or integration sits inside multiple suppliers and supports business-critical flows. Shared dependencies create concentration risk, so one unresolved flaw can affect several services at once. That makes them higher value than isolated issues with little downstream reach.
👉 Read our full editorial: Mythos disclosure outpaces third-party patching, widening supply chain risk
This post was modified 4 days ago by NHI Mgmt Group