Nobody Can See the Third Tier

The F-35 has the most scrutinized supply chain on earth — a dedicated program office, a bespoke risk tool built to map it, more congressional attention than any weapons system in history.

In July 2025 the Government Accountability Office reported that the officials running that effort estimate they hold country-of-origin information on less than ten percent of the suppliers providing components and raw materials.

Operational intelligence for defense supply chain risk starts from that number. If that is the visibility on the F-35, it is worth asking what the visibility is on your program — and the honest answer, for almost everyone, is: considerably less.

What is supply chain risk management for defense contractors?

Supply chain risk management (SCRM) for defense contractors is the discipline of identifying and mitigating exposures that reach a program through its suppliers rather than through its own operations — counterfeit or nonconforming parts, single-source dependencies, foreign ownership, obsolescence, and compliance failures at tiers the prime never contracts with directly. DFARS and FAR govern it; flow-down enforces it.

The problem is structural, not procedural

The instinct, on reading a number like ten percent, is to assume somebody is not doing their job. That instinct is wrong, and it is worth understanding why, because the real explanation is far less comfortable.

The Department of War’s supplier ecosystem runs to more than two hundred thousand companies. A prime contracts with its first tier. That first tier contracts with a second. The second contracts with a third — and somewhere down there is a small machine shop, or a single foundry, or a distributor of electronic components, that no contract in the chain gives anybody the authority to ask a question of.

That is not a metaphor. When the Defense Logistics Agency set out to map the supply chains for three classes of goods, it approached 63 suppliers. Thirty-seven agreed to provide information. Twenty-two declined or simply did not respond. The reason they gave was not obstruction. It was that no contractual obligation required them to answer.

No amount of engineering talent resolves an authority problem. Hiring another ten people does not grant an organization access to a tier-three supplier’s systems.

This is the structural fact that most supply chain software quietly declines to mention. A prime can build an excellent picture of the suppliers it has contracts with, because a contract is a mechanism for compelling an answer. Beyond that boundary, it is not a data problem. It is a permission problem — and permission does not yield to a bigger budget.

Which reframes the question usefully. The goal is not omniscience about a two-hundred-thousand-company ecosystem; nobody is getting that. The goal is operational disruption risk management in military supply chains that surfaces the anomaly early — the delivery that slipped, the lot that failed inspection, the distributor that appeared in the chain three months ago and nobody can quite account for.

Where operational intelligence for defense supply chain risk earns its keep

Third-party risk management solutions for government contractors tend to be sold against a generic threat picture. The defense version has four specific failure modes, and they are not interchangeable.

Vendor lock deserves a moment on its own, because it is the only one of the four that is a procurement failure rather than an operational one — and it is therefore the only one that is entirely preventable at contract time and entirely irreversible afterward.

The unifying feature of all four is timing. None of them arrives as a surprise. Each is preceded by weeks or months of signal — a supplier’s delivery performance drifting, a lot rejection rate creeping, a distributor appearing where a manufacturer used to be, an inspection finding nobody escalated. The failure is not that the signal was absent. It is that the signal was in four systems, owned by three organizations, and nobody was looking at all of it at once.

That division of labor is the point, and it is why this is a different proposition from a supplier-scoring product. A risk score is an opinion about a company. An anomaly is an event in your own receiving dock — and it is the thing you can actually act on, because it happened inside your boundary. The same real-time operational intelligence platform that reads a refinery or a portfolio reads a supply chain the same way: from the operation, not from a category.

It arrives as a cost long before it arrives as a headline

Sub-tier exposure does not usually announce itself with a grounded fleet. It announces itself in the finance review.

A qualified second source takes months and money that was not in the bid. A lot quarantined pending investigation is inventory nobody can ship. A supplier that fails its CMMC assessment is a supplier a prime may not be able to keep using, on a program with a delivery date. And when a component crosses an ocean to get there, the exposure compounds — which is the same maritime chokepoint risk that reaches a program office without anybody having seen a ship, and the same logic that turns a spares shortfall into an aircraft on the ground.

USADG is a specialized independent insurance broker. It places and structures coverage with A-rated underwriting partners across the exposures a defense supplier actually carries, and it advocates for clients on claims. Where an operational picture exists, the conversation changes: an underwriter looking at a questionnaire is pricing a snapshot, and an underwriter looking at continuous evidence of supplier discipline is pricing something else entirely. The lines are set out on the USADG coverage page.

Risk mitigation strategies for aerospace and defense suppliers work best in that order — see it, discuss it, act on it, and transfer what should be transferred. Run backward, they produce a submission form and a hope.

Nobody is going to hand you visibility into two hundred thousand companies. But the anomaly that ends your program will show up in your own receiving dock first — and that is a boundary you already own.