Ransomware's victim list barely moves: 73% of disclosed hits landed on mid-market firms

The stable number is the one worth acting on. Black Kite's mid-market share sat inside a three-point band for the entire 42-month window ^[4][13], which makes it a base rate rather than a trend. Applied to the sample, 73% of 13,336 comes to roughly 9,735 mid-market victims ^[14], about 232 disclosed a month across the period ^[15].

What that share does not measure is risk per company. The count covers publicly disclosed ransomware and extortion incidents with known revenue ^[2], and the revenue band it uses runs from $10 million to $1 billion, a hundredfold spread ^[12]. Nothing in the published summary normalises by how many firms sit in each band, so the defensible reading is that this is where disclosed incidents land, not proof that a $40 million manufacturer is individually likelier to be hit than a $4 billion one. The distribution inside the band survives that caveat: more than 4,800 of those incidents fall in the $10 million to $50 million slice ^[19], and manufacturing alone accounts for more than 2,400 ^[6][20].

The entry conditions are measurable and dull. Of the 120,000-plus mid-market organisations Black Kite assessed, 54.7% had at least one significant patch-management problem on a public-facing system ^[7], which is more than 65,000 companies carrying a fixable gap at the internet edge ^[16]. More than a quarter had a vulnerability already known to be exploited in the wild ^[8], another 30,000 or so with a bug attackers have demonstrably used ^[17].

A programme built around adversary sophistication does not reach that list. Black Kite's own prescription is prioritisation, and its own figures show what prioritisation is up against: the typical vendor-risk team it describes is two people responsible for more than 300 suppliers ^[10], 150 each ^[18], with some software and services sitting outside the formal vendor inventory altogether ^[21]. Regulation pushes the same work downhill, with NIS2, NYCRR 500 and HIPAA all reaching supplier risk ^[11].

The weakest part of the analysis is the AI section. The framing is symmetrical: faster vulnerability discovery for defenders and attackers alike ^[22]. Symmetry is not a finding, and nothing in the incident data ties the 73% to automated discovery. The exposure figures suggest attackers have not needed the help. What the numbers describe is a target set selected by what is reachable and unpatched, which is a purchasing spec rather than a threat briefing.