[cogman10]

All the more reason to bring such initiatives inhouse and not outsource them.

You can hope that a defense company is doing the right things in terms of supply chain attacks, but that's a pretty lucrative corner to cut. They'd not even need to cut it all the time to reap benefits.

The only other alternative is frequent audits of the defense company which is expensive and wouldn't necessarily solve the problem.