Vendor Vetting Recommendations: Intelligence Sharing to Expose Adversarial Capital

Federal teams responsible for vendor vetting, from innovation programs like SBIR, AFWERX and DIU to acquisition offices, face a shared threat: adversarial capital in the U.S. Defense Industrial Base. These small, resource-limited teams rarely share what they learn. The result is redundant effort, missed risk signals, conflicting assessments and agencies working at cross-purposes. This paper summarizes discussion from the second Convergence event, co-hosted by Quantifind and Deloitte in June 2024. It builds on earlier Convergence work defining Foreign Ownership, Control and Influence (FOCI). It presents six recommendations for a loosely coupled sharing framework, one that lets agencies exchange contacts, facts and reports while preserving each mission’s authority to make its own risk decisions.

• A single risk score would fail across agencies. Risk decisions depend on mission context, and one agency’s red flag can be another’s operational requirement.
• Sharing facts beats sharing verdicts. Agencies benefit most from exchanging objective vendor attributes with clear data provenance, then applying their own models.
• Concealment is easier to prove than intent. Evidence that a vendor is hiding ownership or misrepresenting itself is an objective, actionable signal.
• Open-source data enables the widest sharing. Publicly and commercially available information (PAI and CAI) can move across agencies more freely than classified findings.