For twenty years the answer to supply-chain security was inspection. Ask the vendor for a bill of materials, scan the dependencies, review the findings, sign the exception. The method assumed the thing being bought could be opened and looked at, and for a while that was roughly true.
It is no longer true of most of what an enterprise buys. A network appliance arrives as a sealed device running firmware nobody outside the manufacturer has read. A managed service is a contract for an outcome, not a codebase. A model is weights. In each case the buyer is not declining to inspect; there is nothing available to inspect, and the security questionnaire that asks anyway is collecting assurances rather than evidence.
The question moves upstream
What is replacing inspection is not a better scanner. It is a different question, asked earlier, by a different department. Instead of is this software secure, buyers increasingly ask who owns this company, in which jurisdictions does it build and operate, who can compel it to act, what would it be obliged to tell us, and how quickly. Those questions have verifiable answers. They are matters of corporate registry, contract and law rather than of code, and they can be answered before a purchase order rather than after an incident.
This is a real change in where security lives. It moves out of the security review, which happens late and can only recommend, and into sourcing, which happens first and decides. A control that sits in procurement can say no in a way a control that sits in a post-selection review effectively cannot.
The pattern is already visible in the places where the stakes are highest. The federal order barring foreign-made bulk-power equipment is a procurement instrument, not a technical one — it governs who may sell rather than what the equipment must do, precisely because the installed base cannot be inspected fast enough to govern any other way. The same logic explains why firmware remains the part of the supply chain nobody audits: the layer is real, the risk is real, and the inspection route was never available, so the only lever left is the choice of supplier.
Enterprise buyers have arrived at the same place from a different direction. The standardisation of model procurement terms is a sourcing answer to a technical problem — nobody can evaluate a frontier model's behaviour exhaustively, so the contract carries what the evaluation cannot: notice periods, disclosure duties, audit rights, and liability that attaches to the vendor rather than the deployment.
There is a cost to this, and it is worth naming rather than pretending away. Sourcing controls are blunt. They discriminate by jurisdiction and ownership rather than by demonstrated behaviour, which means they will exclude competent suppliers and admit incompetent ones that happen to be incorporated in the right place. That is a genuinely worse instrument than inspection would be, if inspection were available.
It is not available, and the honest position is that buyers are choosing the best control they can actually operate rather than the best control in principle. The organisations doing this well have stopped treating the questionnaire as evidence and started treating the supplier relationship as the thing being purchased. The software is what arrives. The company is what you are buying.
