Defence and industrial groups typically operate with robust compliance frameworks. Export control procedures, supplier audits, KYC processes - large organisations have dedicated teams and established tools.
And yet, the incidents that eventually reach senior leadership - reputational exposures, undetected conflicts of interest, partners that became liabilities - rarely come from where those processes look. They come from the blind spots.
Here are the three we encounter most frequently.
1. The local distributor introduced through a trusted intermediary
In an international deployment or export context, defence groups frequently rely on local partners - commercial agents, regional distributors, country representatives - to access markets they cannot cover directly.
These intermediaries almost always arrive through referral: a contact who knows a contact, a longstanding relationship in the region, a "trusted" partner in the most literal sense. And it is precisely this mechanism that creates the blind spot.
The trust extended to the recommending intermediary transfers automatically to the person being recommended, without anyone genuinely verifying what lies behind them. Who is this distributor? What are their actual affiliations in-country? Do they have links - direct or indirect - to structures under regulatory scrutiny, sanctioned entities, or politically exposed individuals in their jurisdiction?
This information does not appear in the documents the distributor provides themselves. It sits in the cross-referencing of open sources - local registries, international databases, press archives, professional networks - that no one takes the time to search systematically.
2. The strategic partner whose profile was accepted on the strength of documents alone
The second blind spot is more subtle. It concerns partners or suppliers with whom a relationship is already established - sometimes for several years - but whose actual profile has never been independently verified.
The documents exist: signed contracts, certifications, commercial references. But documents describe what a partner chooses to show. They do not reveal a judicial history in another jurisdiction, a previous company dissolved under problematic circumstances, or operational ties to entities the group would not want in its supply chain.
In sectors like defence, where the value chain is long and subcontractors numerous, this type of exposure can remain dormant for years - until it surfaces in the worst possible context: an external audit, a sensitive tender, a legal proceeding, or an investigative report.
The right question to ask is not "does this partner hold the required certifications?" but "if someone wanted to destabilise our group by starting from our subcontracting chain, what would they find?"
3. Senior hires made under time pressure
The third blind spot is the one that surprises most people, because it concerns internal decisions.
In a defence environment, recruiting a senior executive - head of operations, export director, subsidiary CEO - often happens under time pressure: a position to fill quickly, a project starting, a reorganisation underway.
Standard HR processes verify qualifications, professional references, and sometimes criminal records through applicable regulatory frameworks. What they do not verify is the candidate's digital footprint and public affiliations - their positions on sensitive topics, past associations, links to organisations or individuals that could create reputational exposure for the group.
A subsidiary director whose public statements contradict the group's stated ethical commitments. An export manager whose previous affiliations create a conflict of interest risk on specific target markets. These elements are accessible - they are public, by definition - but they do not surface through a standard recruitment process.
What independent verification delivers in practice
In all three cases described above, the problem is not an absence of information. The information exists and is legally accessible. The problem is that no one retrieves it in a structured, cross-referenced and documented way before the decision is made.
This is precisely what we do at YMV & Co.: independent verification through OSINT - open source intelligence - conducted before commitment, with a structured Go / No-Go / Monitor deliverable designed to remain defensible at board level if a decision is ever questioned.
We do not replace existing compliance teams. We operate where their processes stop - on people and relationships rather than on entities and documents.