Black Kite Brings Third-Party Risk Intelligence Into CrowdStrike Falcon Next-Gen SIEM

Closing a blind spot in the SOC

Black Kite says Security Operations Centers face a critical blind spot: the risk posed by third-party vendors and suppliers. Even though SOC teams handle tens of thousands of inbound signals every day, the company argues they lack the visibility to detect third-party ransomware risk in real time. They also lack the tooling to act on third-party incidents and vulnerabilities within their existing workflows.

According to Black Kite, the result is delayed incident response, manual remediation and supply chain exposure that goes unaddressed until it is too late. The new integration is meant to address this by unifying first- and third-party data, native threat intelligence, AI and workflow automation inside the Falcon platform.

Black Kite also cites figures for the SIEM itself: Falcon Next-Gen SIEM delivers up to 150x faster search performance than legacy SIEMs and solutions positioned as SIEM alternatives, at an 80% lower total cost of ownership over three years.

What the integration includes

Black Kite lists three main capabilities:

• Detection context: AI-powered detections enriched with Black Kite data, including real-time Ransomware Susceptibility Index (RSI) scores, FocusTags and aggregated vendor cyber ratings across technical, financial and compliance dimensions.
• Faster deployment and response: streamlined Black Kite data onboarding, SOAR playbook automation for third-party vulnerability investigation, and vendor outreach via The Bridge. The company says this reduces third-party incident response times by 5x.
• Unified data and workflows: third-party risk monitoring, vulnerability management and remediation reporting in a single pane of glass inside Falcon Next-Gen SIEM.

An automated vulnerability workflow

The integration provides a fully automated Third-Party Vulnerability Management process. Black Kite escalates third-party vulnerabilities into Falcon Next-Gen SIEM based on criticality, confidence and EPSS scoring. There, Charlotte Agentic SOAR playbooks enrich and investigate each finding.

Remediation requests go directly to vendors through The Bridge. Ticket status and operational metrics, including vendor registration rates, FocusTag resolution time and average days to close critical findings, are fed back into the SIEM dashboard for continuous reporting and ROI measurement.

Joint customers also get a centralized view of aggregate third-party risk across cyber posture, ransomware susceptibility (RSI), data breach indicators (DBI) and FAIR-based financial risk. Black Kite says this helps security leaders demonstrate the measurable impact of their third-party risk program to stakeholders.

Availability and what it means for security teams

Chuck Schauber, Chief Product Officer at Black Kite, said that "third-party breaches account for a significant share of the incidents our customers respond to, yet most SOC workflows have no mechanism to surface that risk until it's an active incident." He added that the integration lets teams handle third-party exposure "the same way they handle any other threat: fast, automated, and at scale."

The integration is available today in the CrowdStrike Marketplace. For organizations that already run their SOC on Falcon Next-Gen SIEM, it means vendor risk signals can be reviewed and acted on in the same environment as other security data, rather than in a separate tool.