Supply Chain Intelligence (SUPPLYINT): Intelligence Discipline Guide

You do not have one supply chain. You have a tree of dependencies you have never enumerated, and your real exposure sits three tiers down at a supplier you have never heard of.

What Supply Chain Intelligence is as a discipline

Supply chain intelligence maps the network of suppliers, subcontractors, components and dependencies behind a product or organisation, and assesses that network for concentration, integrity and legitimacy risk. It differs from logistics intelligence by focusing on relationships and dependencies rather than the movement of individual consignments. Practitioners reconstruct supplier tiers from disclosures, procurement records, certifications and technical artefacts, then evaluate where a single facility, material, jurisdiction or firm constitutes a chokepoint, and where counterfeit or tampered inputs could enter.

Sub-methods include multi-tier supplier discovery, chokepoint and concentration analysis, software bill of materials and component provenance analysis, counterfeit and grey market detection, and responsible sourcing screening for forced labour and conflict minerals. In the cycle it is largely an analysis and warning discipline, converting scattered supplier facts into dependency models that support resilience decisions and procurement policy.

Why it matters

Only supply chain intelligence answers where your organisation is genuinely single-sourced without knowing it, and which upstream firm sits behind multiple apparently independent suppliers. It answers whether a component is authentic and traceable to its authorised distribution channel, which suppliers are exposed to sanctions, export controls or forced labour findings, and how a disruption at one facility propagates through tiers. It also identifies which of your software dependencies are maintained by a single unpaid individual.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Tier-two and tier-three supplier relationships disclosed in customer filings, certifications, quality audits and supplier awards
Geographic and facility concentration where multiple nominally distinct suppliers depend on one plant or one materials source
Software bill of materials entries revealing transitive dependencies, maintainer concentration and unsupported components
Component authorised distributor status versus grey market brokers, a primary indicator of counterfeit risk in electronics
Certification and audit records showing quality system scope, exclusions and lapses at specific supplier facilities
Ownership changes at suppliers, including acquisitions that place a critical input under a newly adverse jurisdiction
Public procurement award records exposing who actually delivers to an organisation despite prime contractor branding
Enforcement listings for forced labour, sanctions or export control violations affecting entities in the supplier tree

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

SEC EDGAR — Customer and supplier concentration disclosures, risk factors and material contracts naming key counterparties
USAspending and FPDS — Free US federal contract and subaward records exposing prime and subcontractor relationships and delivery values
SAM.gov — Registered US federal contractors with entity identifiers, exclusions and ownership information
EU TED and national procurement portals — Public tender notices and awards revealing supplier relationships and contract scope across Europe
Open Supply Hub — Free open database of production facilities and their affiliations, valuable for apparel and consumer goods tiers
GLEIF Legal Entity Identifier data — Free authoritative entity identifiers with parent relationships, enabling reliable supplier entity resolution
CBP UFLPA Entity List and sanctions lists — Entities subject to import prohibitions or designations, screened against every tier of the supplier tree
NIST NVD and OSS package registries — Vulnerability and dependency metadata for software components, including maintainer and release activity signals

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Define criticality first — Identify which products, systems and services actually matter, since mapping every supplier equally wastes effort and obscures real exposure.
Enumerate tier one authoritatively — Start from internal procurement and contract records, resolving each supplier to a legal entity identifier rather than a trading name.
Push upstream — Discover deeper tiers through filings, procurement awards, certifications, technical documentation and supplier questionnaires, recording confidence for each inferred link.
Find the chokepoints — Collapse the tree by facility, material and jurisdiction to reveal hidden single points of failure behind apparently diversified sourcing.
Assess integrity — Check component provenance and distribution channel, and analyse software bills of materials for unmaintained or single-maintainer dependencies.
Screen every tier — Run sanctions, export control, forced labour and adverse media screening across the whole tree, not only direct suppliers.
Monitor and re-baseline — Set alerts on ownership change, enforcement listing and disruption events, and re-run the map on a scheduled cadence as sourcing shifts.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

Operates on these data points

Company / Organization — A legal entity — corporation, LLC, NGO, or business.
Shipment / Bill of Lading — A consignment record linking shipper, consignee, goods, and route.
Person / Name — A named individual — the subject of identity resolution and profiling.
Facility / Site — A physical installation — plant, base, port, data centre — with a fixed footprint and function.
Court Case / Docket — A filed legal proceeding — the authoritative record of disputes, judgments, and enforcement.
Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.

Related disciplines

Aviation Intelligence — Aircraft, Flights, and the Aviation Domain
Logistics Intelligence — Cargo, Freight, and Physical Movement
Maritime Intelligence — Vessels, Shipping, and the Maritime Domain
Vehicle Intelligence — Vehicles, Registration, and Movement

Inside the platform: where Supply Chain Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

discipline.php?d=SUPPLYINT — Discipline hub
source-catalog.php?disc=SUPPLYINT — Source catalogue filtered to this discipline
search.php — Company / Organization profile
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Auto-Collect Feeds
Enrichment → Local
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Define criticality first is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Push upstream turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Monitor and re-baseline feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Supply Chain Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence users map the industrial base behind a platform or programme: which firms supply which subsystems, which materials and processes have no alternative source, and which tiers sit in jurisdictions that could interrupt supply. Analysts also assess adversary dependency, identifying where an opponent's production is constrained by a single foreign input. Products feed acquisition risk assessments, programme resilience reviews, sustainment planning and counter-proliferation work. Constraints include the confidentiality of prime contractor supplier data, classification of programme dependency findings, and the fact that supplier disclosure obligations vary sharply, so the deepest tiers are usually inferred rather than documented.

🕵 National intelligence

National intelligence uses supply chain analysis to identify chokepoints that create leverage, to trace procurement networks supporting sanctioned programmes, and to assess the resilience of critical national infrastructure. Requirements typically ask which firms sit behind an apparent diversity of suppliers, and where a foreign state could interrupt supply at low cost. Because much of the evidence is commercial, findings can be shared with industry and regulators. Handling matters where supplier data was obtained under contract or from a company in confidence, since misuse damages the relationships that make future collection possible.

👮 Law enforcement

Law enforcement uses supply chain intelligence in counterfeiting, forced labour import enforcement, export control and procurement fraud cases. Tier mapping identifies where counterfeit or diverted components entered an authorised distribution channel, which is the pivot point for a prosecution. Evidentially, purchase orders, customs entries, certificates of conformity and distribution records obtained under production order are what carry weight; supplier questionnaires and public disclosures are leads. Forced labour cases in particular require documentation that a specific facility contributed to a specific consignment, which is a demanding evidential standard the intelligence work must be built to meet.

🔍 Private investigation and corporate security

This is core corporate work: third party risk, supplier due diligence, resilience mapping and responsible sourcing assurance. Analysts enumerate tiers, find hidden concentration, assess component authenticity and screen the whole tree against sanctions and forced labour regimes. Constraints are contractual and competitive: supplier data received under contract is confidential and cannot be redistributed, competition law limits how supplier and pricing information can be shared between competitors including through industry consortia, and personal data on supplier staff remains protected. Findings that trigger statutory reporting duties must be routed to compliance rather than kept commercial.

📰 Journalism and OSINT media

Journalists use supply chain intelligence to connect consumer brands to labour abuse, environmental harm, sanctioned entities and conflict financing. Verification requires establishing that a specific facility supplied a specific buyer, which usually means customs records, corporate disclosure, certification databases or worker testimony rather than inference from geography. Give every named company a meaningful right of reply, since brands frequently do not know their deeper tiers. Protect worker sources absolutely, because retaliation is routine, and be careful that exposure does not simply cause a brand to exit and leave workers unemployed without remedy.

🌍 NGO, humanitarian and human rights

Labour rights, environmental and anti-slavery organisations use tier mapping to hold brands accountable and to support remediation. Practice must be worker-centred: workers hold the evidence and bear the risk, so documentation should be gathered with informed consent, secure handling and a plan for their protection. Do no harm includes anticipating cut-and-run responses from buyers and pressing for remediation rather than disengagement. Documentation should support statutory mechanisms such as import bans and due diligence litigation, which means preserving facility-to-buyer links with dates and provenance rather than general allegations.

🎓 University and research

Researchers study supply network structure, resilience, cascading failure and responsible sourcing. Methodological care centres on the invisibility of deeper tiers: most public datasets capture tier one only, and inferred links carry uncertainty that must be modelled rather than ignored. Firm-level data obtained from companies usually comes with confidentiality conditions that constrain publication, so negotiate release terms before collection. Ethics review applies where worker testimony is involved. Reproducibility requires publishing inference rules, data sources with extraction dates, and the confidence assigned to each inferred relationship rather than presenting a network as observed fact.

Playbook: working Supply Chain Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define criticality before mapping

Identify which products, services and systems actually matter to the organisation or the question, using revenue, safety, mission or regulatory consequence. Mapping every supplier equally consumes the budget and buries real exposure. A good output is a short criticality list with the consequence of failure stated per item. Stop when the list is small enough to map deeply rather than broadly, because a shallow map of everything is worth less than a deep map of the few things that matter.

Phase 2 — Enumerate tier one authoritatively

Start from internal procurement, contract and payment records rather than from a supplier list someone maintains manually, and resolve every supplier to a legal entity identifier rather than a trading name. Include services, software and logistics providers, which are routinely omitted. A good output is a tier one register with legal entity, site addresses, spend and the products supplied. Stop when the register reconciles to accounts payable, which is the only reliable completeness check available.

Phase 3 — Push upstream with evidence grading

Discover deeper tiers through supplier disclosures, regulatory filings, procurement awards, certification and audit databases, technical documentation, shipping records and structured supplier questionnaires. Record how each link was established and how confident you are. A good output is a tiered network where every edge carries a source and a confidence level. Stop when the next tier consists only of inferred links you cannot corroborate, and mark that boundary explicitly rather than letting inference blend into fact.

Phase 4 — Collapse the tree to find chokepoints

Re-aggregate the network by facility, by material, by process and by jurisdiction rather than by supplier name. Apparent diversification frequently collapses into one plant, one refiner, one certification body or one country. A good output identifies each hidden single point of failure with the products it affects. Stop when the collapse has been done on all four axes, since concentration hides in whichever axis you did not check.

Phase 5 — Assess substitutability, not just presence

For each chokepoint, establish how quickly an alternative could be qualified: is the constraint a scarce material, a specialised process, a regulatory approval, tooling, or simply a commercial relationship. Qualification time is the number that matters for resilience. A good output states, per chokepoint, the realistic time and cost to substitute. Stop when substitution timelines are evidenced by qualification records or engineering judgement rather than assumed from market availability.

Phase 6 — Analyse component and software provenance

For hardware, verify authorised distribution channels, check for grey market and counterfeit indicators, and require traceability documentation. For software, obtain or generate a bill of materials and identify components that are unmaintained, single-maintainer or carrying known vulnerabilities. A good output is a provenance and integrity assessment per critical component. Stop when the components that could compromise safety or security are covered; exhaustive coverage of commodity parts is rarely justified.

Phase 7 — Screen every tier against restrictions

Run sanctions, export control, entity list, forced labour and adverse media screening across the whole tree, not only direct suppliers, and repeat screening on a schedule since designations change. Include owners and parent companies, not just the trading entity. A good output is a screening record with list versions, dates and disposition per hit. Stop when the screening covers ultimate parents, because a clean subsidiary of a designated parent is a common and consequential miss.

Phase 8 — Assess labour and human rights risk

Combine sector and geography risk indicators with facility-level evidence: audit findings, worker testimony, recruitment fee practices, migrant labour proportion, and import ban listings. Treat audits as weak evidence, since announced social audits routinely miss forced labour. A good output ranks facilities by evidenced risk with the basis stated. Stop before treating certification as assurance, and prefer worker-sourced evidence gathered safely through partners over documentary compliance.

Phase 9 — Model disruption propagation

Simulate the effect of losing each chokepoint: which products stop, after how long given inventory, and which customers or missions are affected. Include correlated failures where several suppliers depend on the same upstream facility or corridor. A good output is a set of scenarios with time to impact and mitigation options. Stop when the scenarios cover the concentrations you found rather than a generic set of hazards, since scenario theatre without mapping is common and useless.

Phase 10 — Design and cost mitigations

Convert findings into decisions: dual sourcing with a qualification plan, strategic inventory for long-lead items, contractual disclosure and audit rights, redesign to remove a scarce component, or exit from a supplier. Each has a cost and a lead time, and mitigation choices belong to the business rather than to the analyst. A good output presents options with cost, lead time and residual risk. Stop before recommending disengagement from a supplier where remediation would better serve affected workers.

Phase 11 — Instrument continuous monitoring

Set alerts on ownership change, designation, insolvency, enforcement action, industrial dispute, natural hazard exposure and adverse media across the mapped entities, and require suppliers to notify changes contractually. A good output is a monitoring system with named owners, thresholds and an escalation path. Stop adding monitored entities when alert volume starts being ignored, and tighten to the entities whose failure actually matters.

Phase 12 — Re-baseline on a schedule

Supply networks change constantly through sourcing decisions, mergers and supplier failure, so a map decays within months. Re-run the mapping on a fixed cadence, comparing against the previous baseline and reporting what changed rather than reissuing the whole picture. A good output is a change report with new concentrations and resolved ones. Stop treating the map as an artefact to be completed, since the value is in the differencing rather than in the map itself.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
SEC EDGAR	Open	US securities filings including risk factors, customer and supplier concentration disclosures, material contracts and conflict minerals reports	Discloses supplier and customer concentration that companies are legally required to reveal to investors
USAspending and federal procurement data	Open	US federal contract awards with recipients, subawards, place of performance, product codes and parent entity linkage	Reveals prime and subcontractor relationships in defence and government supply chains
SAM.gov	Registration	US federal entity registration with unique entity identifiers, ownership, exclusions and representations	Authoritative entity resolution for US government suppliers, including exclusions screening and unique entity identifiers
EU Tenders Electronic Daily	Open	EU public procurement notices and award notices with contractor names, values, subject matter and framework details	Maps supplier relationships in European public sector and utility supply chains
Open Supply Hub	Open	Open database of production facilities with names, addresses, associated brands and contributed supplier lists	Facility-level identification linking named production sites to buying brands and contributed supplier disclosure lists
GLEIF Legal Entity Identifier data	Open	Global register of legal entity identifiers with legal names, addresses and direct and ultimate parent relationships	Resolves suppliers to legal entities and exposes shared parents behind apparently separate firms
US Customs and Border Protection UFLPA entity list and withhold release orders	Open	Entities whose goods are presumed made with forced labour, plus enforcement actions and detention statistics	Determines whether any mapped facility triggers an import prohibition in the United States
NIST National Vulnerability Database	Open	Catalogued software and hardware vulnerabilities with product identifiers, scoring and references	Assesses risk in software bill of materials components identified in the technology supply chain
Open Source Insights and package registries	Open	Dependency graphs, maintainer counts, release cadence and licence data for open source software packages	Identifies single-maintainer and unmaintained dependencies that constitute hidden software chokepoints inside technology supply chains
OpenCorporates	Registration	Company registry aggregation covering officers, addresses, status and corporate structure across jurisdictions	Resolves supplier ownership and detects common control behind nominally independent vendors
OpenSanctions	Open	Consolidated sanctions, export control and politically exposed person data with entity matching and bulk access	Single-pass screening of an entire supplier tree across multiple national regimes
ILO and ITUC labour rights resources	Open	International labour standards, country compliance reporting and trade union documentation of workplace conditions	Contextual risk indicators and standards against which facility conditions are assessed
OECD due diligence guidance and reporting	Open	Sector guidance for responsible supply chains including minerals, garments and agriculture with national contact point cases	The recognised due diligence methodology regulators and courts expect firms to have followed
Responsible Minerals Initiative and conflict minerals reporting	Open	Smelter and refiner lists, assessment status and reporting templates for tin, tantalum, tungsten, gold and cobalt	Identifies the refiner chokepoint layer where minerals supply chains actually converge
UN Comtrade and national trade statistics	Registration	Bilateral trade flows by commodity and partner used to infer sourcing geography and dependency	Quantifies national-level dependency on specific origins for materials with concentrated production
USGS Mineral Commodity Summaries	Open	Annual assessment of production, reserves, trade and import reliance for mineral commodities by country	Authoritative baseline for material-level concentration and import reliance in critical minerals

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Supply Chain Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

Neo4j or graph databases — Stores multi-tier supplier networks with typed, confidence-weighted edges; scales well, and demands disciplined entity resolution before loading.
OpenRefine with GLEIF reconciliation — Harmonises supplier names to legal entities; effective for registered firms, weaker for small private facilities and partnerships.
Syft, CycloneDX and SPDX tooling — Generates software bills of materials from images and repositories; only as complete as the metadata in the artefacts scanned.
Dependency-Track or equivalent — Continuously matches software components against vulnerability data; needs curation to avoid alert fatigue on low-impact findings.
Screening platforms against consolidated lists — Automates sanctions and entity list checks across a supplier tree; fuzzy name matching generates false positives requiring review.
QGIS — Maps facility locations against hazard, port and corridor data to expose geographic correlation; requires reliable facility geocoding.
Python with pandas and networkx — Computes concentration metrics and simulates node removal across the network; results depend on the completeness of the mapped tiers.
Supplier questionnaire and portal platforms — Collects tier disclosure contractually; response quality varies enormously and self-reported data needs independent corroboration.
Trade data platforms — Infers supplier relationships from shipment records where manifest data exists; coverage is limited to a handful of reporting countries.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Concentration hides in the collapse. Ten suppliers can be one plant, one refiner, one certification body or one export corridor. Always re-aggregate the network by facility, material, process and jurisdiction, because supplier count is a comfort metric that conceals real exposure.
Tier one is a solved problem and rarely where the risk is. The interesting exposure sits at tiers two to four, where nobody has contractual visibility, which is why disclosure obligations, technical documentation and shipping records matter more than supplier questionnaires.
Substitutability is the real measure, not sourcing count. A component available from one plant that could be qualified elsewhere in six weeks is a different risk from one requiring two years of regulatory requalification. Report qualification time, not supplier numbers.
Audits are weak evidence for labour conditions. Announced social audits systematically miss forced labour, debt bondage and recruitment fee abuse. Worker-sourced evidence gathered safely through trusted partners outperforms any certificate, and certification should never be reported as assurance.
Software has chokepoints too, and they are people. A dependency maintained by one unpaid individual is a single point of failure in exactly the sense procurement understands, and it will not appear in any supplier register.
Screen ultimate parents, not just trading entities. Designations attach to groups, and a compliant-looking subsidiary of a listed parent is one of the most common and most consequential screening misses in practice.
Exposure without remediation harms workers. When a labour finding leads a buyer simply to exit, the workers lose income and gain nothing. Frame findings to support remediation and continued engagement wherever that serves the affected people better than disengagement.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Supply Chain Intelligence is producing anything, and they are worth baselining before you change process or tooling.

Share of critical products with mapped tiers to at least tier three, with confidence recorded on every inferred link.
Number of previously unknown single points of failure identified per mapping cycle, which measures whether the mapping is finding anything.
Median qualification time for identified chokepoints, tracked as the organisation's real resilience measure rather than supplier count.
Screening coverage, expressed as the proportion of mapped entities screened including ultimate parents within the current list version.
Time from a designation, enforcement action or insolvency affecting a mapped entity to internal notification and disposition.
Proportion of labour risk findings that resulted in a documented remediation plan rather than supplier exit.
Map decay rate, measured by the share of tier one relationships that changed between baseline refreshes.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Mapping only tier one, which leaves the concentration risk that actually causes outages entirely invisible
Treating supplier diversity as resilience when several suppliers depend on the same upstream plant or material
Relying on supplier self-declaration without independent corroboration from filings, procurement records or facility data
Resolving suppliers by name, which fragments across subsidiaries, trading names and transliterations and understates concentration
Ignoring software and service dependencies, which now cause as many disruptions as physical component shortages
Letting the map go stale, since sourcing changes quarterly and an outdated dependency model creates false confidence

Legal and ethical considerations

Supplier data obtained under contract is usually confidential and cannot be redistributed; keep commercially sensitive information properly controlled. Screening obligations under sanctions, export control and forced labour import regimes are mandatory for many organisations and carry documentation requirements. Human rights and modern slavery reporting duties may compel disclosure of what you found. Competition law limits how supplier and pricing information can be shared between competitors, including through industry consortia. Personal data on supplier personnel remains protected.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Supply Chain Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 data points, 2 mission domains, 4 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

How deep do I actually need to map?

Deep enough to reach the concentration. For most manufactured goods that is tier three or four, where a common material, refiner, foundry, coating process or certification body sits behind many apparently independent suppliers. For software it is the transitive dependency graph, which can run far deeper. Map deep only for products on your criticality list; for the rest, tier one screening is proportionate. The signal that you have gone far enough is that further tiers introduce no new concentration, no new restricted parties and no new jurisdictional exposure.

Suppliers refuse to disclose their own suppliers. What now?

Use contractual leverage where you have it, and inference where you do not. Build disclosure obligations into contracts at renewal, including notification of ownership change and the right to audit. Meanwhile infer tiers from technical documentation, certification and approval databases, customs and shipping records, procurement awards, published case studies, job advertisements at facilities, and industry association membership. Mark every inferred link with its confidence and evidence. Where a critical supplier refuses disclosure entirely, that refusal is itself a risk finding to report to the business.

Are social audits sufficient evidence of labour standards?

No, and treating them as assurance has repeatedly failed. Announced audits, short site visits, management-selected worker interviews and document review are all easily managed by a facility, and forced labour indicators such as recruitment fees, document retention and debt bondage typically sit upstream in labour brokers rather than at the audited site. Use audits as one weak input. Weight worker voice channels, trade union reporting, migrant recruitment corridor analysis and unannounced verification much more heavily, and always check facilities against import ban listings.

What is the fastest way to find hidden concentration?

Collapse by facility address and by material rather than by supplier name. Geocode every known site and look for clustering; then trace the critical materials to their refining or processing step, which is almost always more concentrated than fabrication. In electronics that means foundries, substrates and specific chemicals; in minerals it means refiners; in pharmaceuticals it means active ingredient plants. This exercise routinely reveals that a carefully dual-sourced product depends on one facility two tiers up that neither supplier mentioned.

How do I handle supplier data confidentiality?

Treat it as the supplier's commercial property. Data received under contract normally cannot be shared outside the agreed purpose, and aggregating it into products for third parties can breach the agreement and destroy the relationship. Competition law adds a separate constraint: exchanging supplier, pricing or capacity information between competitors, including through industry consortia and benchmarking exercises, can constitute unlawful information sharing. Segregate confidential supplier data, define who may see it, and take competition law advice before participating in any industry data pooling.

Does a software bill of materials solve software supply chain risk?

It makes the problem visible, which is a necessary first step and not a solution. A bill of materials tells you which components are present and lets you match them against known vulnerabilities. It does not tell you whether a component is well maintained, whether the maintainer is a single unpaid individual, whether the build pipeline is secure, or whether a dependency was compromised upstream. Use it as an inventory, then assess maintenance health, provenance of the build, and update capability, which is where the real exposure sits.

What obligations follow from a forced labour finding?

That depends on jurisdiction and can be immediate. US import prohibitions create a rebuttable presumption against goods from listed entities and regions, and detained shipments require documentary proof of an unconnected supply chain. EU and national due diligence and modern slavery regimes impose disclosure, assessment and, increasingly, remediation duties. Practically, involve legal and compliance immediately, halt affected shipments, and design a remediation plan with worker representatives. Exiting quietly may satisfy legal exposure while leaving workers worse off and is increasingly criticised by regulators as insufficient.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

ISO 28000 on security management for the supply chain, which frames assessment and control of supply chain security risk.
NIST SP 800-161 on cyber supply chain risk management, the reference framework for technology supplier and component risk.
OECD Due Diligence Guidance for Responsible Business Conduct and its sector supplements, which define the expected due diligence process.
UN Guiding Principles on Business and Human Rights, which establish the corporate responsibility to identify, prevent and remediate human rights harms.
Uyghur Forced Labor Prevention Act and equivalent import prohibitions, which create rebuttable presumptions and evidentiary requirements for affected goods.
EU Corporate Sustainability Due Diligence and reporting directives, which impose mapping, assessment and disclosure obligations across value chains.
Dodd-Frank Act section 1502 conflict minerals reporting, which requires smelter-level supply chain disclosure for specified minerals.
SPDX and CycloneDX software bill of materials specifications, which standardise component inventory exchange between suppliers and customers.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

EDGAR corporate filings — US Securities and Exchange Commission. Disclosures including supplier and customer concentration, risk factors and conflict minerals reports
USAspending federal award data — US Department of the Treasury. Prime and sub-award records revealing contractor relationships in government supply chains
Open Supply Hub facility database — Open Supply Hub. Open registry of production facilities linked to buying brands and contributed supplier lists
Legal Entity Identifier reference data — Global Legal Entity Identifier Foundation. Open register of legal entities with direct and ultimate parent relationships
Forced labour enforcement and entity listings — US Customs and Border Protection. Import prohibition listings, withhold release orders and enforcement statistics
Cyber Supply Chain Risk Management practices, SP 800-161 — US National Institute of Standards and Technology. Framework for technology supplier, component and provenance risk management
Due Diligence Guidance for Responsible Business Conduct — OECD. The recognised methodology for supply chain human rights and environmental due diligence
UN Guiding Principles on Business and Human Rights — UN Office of the High Commissioner for Human Rights. Framework establishing corporate responsibility to identify and remediate human rights harm
Mineral Commodity Summaries — US Geological Survey. Annual data on production, reserves and import reliance for mineral commodities by country
Responsible Minerals Initiative smelter and refiner lists — Responsible Business Alliance. Assessment status of smelters and refiners at the convergence point of minerals supply chains

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: builds multi-tier supplier graphs with chokepoint analysis and continuous screening across every tier. Explore the platform, or browse the rest of the library by following any tag above.