How AI Reveals Hidden Supplier Risks in Wartime

The first useful lesson from the Russia-Ukraine war was not that tier-1 supplier screening failed. It was that tier-1 screening looked clean enough to keep teams calm while the real exposure sat several layers down. In February 2022, Interos reported that more than 2,100 U.S. firms had direct tier-1 suppliers in Russia, but more than 190,000 U.S. firms and 109,000 European firms had Russian or Ukrainian suppliers at tier 3.[1] That date matters: supplier networks have changed since the invasion. The procurement lesson still holds because the gap between visible direct exposure and hidden sub-tier exposure is exactly where wartime disruption becomes a purchase-order problem.

A normal supplier master file can tell a category manager who is approved, who owns the contract, which certificates are current, and whether the tier-1 supplier passed onboarding. It rarely proves where the tier-1 supplier’s critical castings, specialty chemicals, electronic components, packaging inputs, or logistics dependencies originate. In peacetime, that blind spot is inconvenient. Under war conditions, it can turn a qualified-part list into a false assurance document.

That is the practical case for AI for supply chain risk management under war: not a grand claim that software can neutralize conflict, but a narrower claim that continuous supplier-graph monitoring can reveal exposed nodes before a shortage, sanctions change, transport closure, or financial shock reaches the buyer’s dock.

The Exposure Is Usually Below the Contracting Line

Procurement systems are built around commercial control. They know the supplier that signs the contract. They know the approved manufacturer. They may know nominated sub-suppliers for regulated categories. They do not automatically know the full chain of companies, plants, lanes, banks, ports, and intermediaries that support delivery.

That distinction is why the Interos Ukraine figures were so uncomfortable. A buyer with no direct Russian supplier could still depend on a tier-3 manufacturer, processor, or material source in Russia or Ukraine. The procurement record would show a domestic or allied-country tier-1 supplier. The disruption would behave as if the buyer had conflict-zone exposure anyway.[1]

The same pattern is not limited to the first months of the Ukraine war. GEP’s analysis of the U.S.-Israel-Iran conflict framed the 2026 supply-chain problem around stress to global flows, energy-linked costs, and supplier-risk visibility rather than a simple direct-supplier checklist.[2] The procurement issue is not whether every company has a named supplier inside a conflict zone. It is whether a conflict can interrupt the sub-tier source, transport lane, energy input, or financial counterparty that keeps the approved supplier performing.

That is where many supplier-risk programs still overstate their own coverage. They collect annual questionnaires, ask suppliers to attest to business-continuity plans, and refresh risk ratings on a schedule. Those controls are useful. They are also too slow for a conflict environment in which a port, border crossing, insurer, raw-material source, or bank can become the constraint before the next review cycle begins.

What AI Risk Scoring Actually Adds

The useful version of AI supplier risk scoring starts with a graph, not a score. The platform tries to connect companies, facilities, products, trade flows, ownership records, shipping activity, financial signals, operational events, and geopolitical alerts into a living map of dependency. The score is only the visible output. The hard part is deciding which hidden relationship is strong enough to matter for a buyer’s part, plant, or revenue stream.

A wartime signal by itself is rarely enough. “Escalation near a region” is not yet a procurement action. The platform has to ask whether the region contains a supplier node, whether that node is connected to an approved supplier, whether the material is substitutable, whether inventory buffers exist, whether transportation can reroute, and whether the affected item supports a high-margin or safety-critical product. Good scoring turns a broad conflict alert into a ranked work queue.

Interos is often discussed in this context because its Ukraine analysis made sub-tier exposure visible in procurement terms. Altana’s Atlas is another example of the graph approach, with an emphasis on mapping trade relationships and conflict-exposed nodes at large scale.[3] Everstream Analytics and JAGGAER are more often framed around predictive risk and procurement workflow. GEP connects the risk discussion to sourcing and supplier-management decisions in current conflict contexts.[2][4] C3 AI appears in a related but distinct lane, where supply-network risk and contested logistics are relevant to defense and mission-oriented supply chains.[5]

Those examples should not be read as a shortlist. They illustrate the capability categories a procurement team has to separate during evaluation: sub-tier graph construction, trade-network intelligence, predictive disruption scoring, workflow integration, and operational response support. A product that is strong in one category may still be weak in another.

The 2-4 Week Claim Is Valuable, but It Needs Handling

The most commercially important claim in this market is lead time. JAGGAER cites Huang 2025 as finding that AI supplier-risk detection predicted high-impact disruptions 2-4 weeks in advance with 89% accuracy.[4] That is a serious claim because two weeks can be the difference between a controlled allocation decision and an emergency buy. Four weeks can be enough to qualify an alternate, reserve freight, adjust production sequencing, or ask engineering to approve a temporary deviation.

It should also be handled carefully. The figure comes from Huang 2025 as cited by JAGGAER; the underlying methodology and sample size still need independent validation before a buyer treats 89% as a universal benchmark.[4] Accuracy can mean different things depending on the event definition, category mix, geography, time horizon, and cost of false positives. A model that performs well for high-volume electronics may not perform the same way for specialty materials, defense-qualified parts, or food ingredients.

The stronger operational question is not “Is the model always 89% accurate?” It is “When the system flags a high-impact disruption risk, can the organization act before the supplier fails?” Earlier detection only matters if the alert lands with the right owner, part number, supplier relationship, exposure explanation, and escalation path. Otherwise, the company has purchased a faster way to watch the same disruption arrive.

That distinction also separates AI detection from agentic AI response. Detection systems identify and prioritize risk. More advanced workflows may draft alternate-sourcing events, recommend suppliers, or trigger approval steps. The second category is less mature and more vendor-specific. In a wartime setting, full automation is usually not the near-term goal. A defensible decision window is.

From Alert to Action: What Has to Happen Inside the Window

A conflict-exposure alert should not stop at “red.” It should produce a short list of affected suppliers, the suspected sub-tier dependency, the relevant products or facilities, the confidence level, the business impact, and the recommended response owner. A category manager cannot defend a cost premium or a sole-source exception with a heat map. She needs a record that connects the risk to a sourcing decision.

In practice, the work often looks like this: confirm whether the exposed node is real; ask the tier-1 supplier to validate the dependency; check open purchase orders and inventory coverage; identify alternate suppliers already in the approved list; estimate qualification time for new suppliers; decide whether to reserve capacity or freight; and escalate if engineering, legal, finance, or the business unit must accept cost, specification, or service tradeoffs.

• If the part is already multi-sourced, the action may be allocation: shift volume before the constrained supplier misses delivery.
• If the part is technically single-sourced, the action may be qualification: start the alternate approval path before the current supplier fails.
• If the constraint is logistics, the action may be lane redesign: reserve capacity, change routing, or pre-clear documentation.
• If the exposure is financial, the action may be commercial: adjust payment terms, monitor liquidity, or prepare a supplier-support decision.
• If the exposure is sanctions or legal restriction, the action may be compliance-led: freeze new awards, review counterparties, and document exceptions.

This is where the 2-4 week window becomes concrete. The first week can disappear in validation if the supplier relationship owner is unclear. The second can disappear in engineering review. Freight reservations, tooling questions, quality documentation, and customer approvals each take time. AI does not remove those steps. It can start them earlier and with a better explanation of why the work is necessary.

The economics explain why the work receives attention even when the alert is imperfect. Everstream cites McKinsey’s estimate that supply-chain disruptions cost 45% of one year’s profits over a ten-year period.[6] JAGGAER cites Marsh Sentrisk as finding that more than 90% of organizations have exposure to a high-risk geopolitical country or active conflict zone.[4] Those are broad figures, not category-level proof for a specific buyer, but they are enough to make passive annual screening look thin for critical supply.

Why Sub-Tier Visibility Still Breaks Down

The hard part is not drawing a network diagram. It is maintaining a network that procurement trusts enough to use. Supplier data is fragmented across ERP records, contracts, quality systems, logistics files, customs records, third-party databases, and spreadsheets owned by business units. Suppliers may not know their own lower-tier dependencies with confidence, or they may resist disclosing them. Even when the platform infers a relationship, procurement still has to decide whether the inference is actionable.

GEP, citing Procurement Leaders, reports that 70% of procurement leaders identify insufficient visibility into tier-3 suppliers as the primary cause of supply-chain risks.[2] That number tracks with what many teams experience during a disruption: the first meeting is not about solving the shortage. It is about finding out who knows where the shortage actually starts.

There is also an adoption gap. JAGGAER cites Inspectorio 2025 as finding that only 27% of companies have introduced AI into procurement or supply-chain functions.[4] JAGGAER also cites Deloitte’s 2025 third-party risk management survey, where 42% of risk leaders said AI could reduce third-party financial exposure by at least 20%.[4] The contrast is useful: executives increasingly expect AI to reduce exposure, while most organizations have not yet put it into the operating fabric of procurement.

That gap is not only a budget issue. It is a design issue. A risk platform that sits outside sourcing events, supplier onboarding, contract renewal, and business-continuity planning will create parallel intelligence. Parallel intelligence is easy to admire and easy to ignore. The alert has to change a decision: whether to award, renew, dual-source, increase inventory, reserve capacity, or escalate an exception.

Where the Platform Should Sit in the Procurement Workflow

The most useful implementation pattern is to place AI risk scoring at decision points where procurement already has authority. New supplier onboarding is one point: the buyer can require sub-tier disclosure, run graph checks, and classify conflict-zone exposure before the supplier enters the approved base. Strategic sourcing is another: the risk score can influence award scenarios before price becomes the only comparable field. Contract renewal is a third: the system can identify whether a supplier that looked acceptable three years ago now depends on a conflict-exposed node.

During active disruption, the same system should feed a smaller response room. The category owner needs the commercial options. Supply planning needs inventory and demand exposure. Logistics needs route options. Legal and compliance need sanctions or counterparty risk. Finance needs working-capital and cost impact. Engineering or quality may need to approve substitutions. The platform’s job is to keep those people arguing over options, not over which spreadsheet is current.

Readers comparing this use case with broader geopolitical monitoring may find the adjacent pattern familiar: AI can operate as an early-warning layer for geopolitical disruption, but procurement value appears only when warning becomes a prepared response. The same risk-detection logic also appears in non-war hazards, such as wildfire disruption monitoring, though the signal types and response windows differ.

For defense or mission-critical supply chains, contested logistics adds another layer. C3 AI’s work in contested logistics and supply-network risk is relevant because the question is not only whether a commercial supplier can deliver, but whether the network can perform under adversarial or constrained conditions.[5] That is a different operating environment from consumer goods or industrial manufacturing, but the procurement discipline is recognizable: map dependencies, monitor change, and connect alerts to executable alternatives.

A Rollout Sequence That Avoids the Dashboard Trap

The wrong rollout starts with a broad dashboard and waits for users to find value. The better rollout starts with the suppliers that can hurt the business fastest: the top 10-15% by spend, revenue dependency, technical criticality, regulatory constraint, or replacement difficulty. That first scope is small enough to validate data quality and large enough to expose the weaknesses in current supplier visibility.

This sequencing also makes vendor evaluation more honest. A platform demo can show an impressive global map. A pilot should show whether the system can identify a real hidden dependency, explain why it matters, and push a usable action into the sourcing or supplier-management workflow. Buyers evaluating supply-chain AI software should test the operating handoff as much as the model output, and should distinguish AI-native graph intelligence from AI features added to a legacy workflow.

The improvement does not have to be theoretical. Sensos cites Gábor and Szentesi 2024 in reporting that companies co-investing in visibility tools reduce crisis recovery time by 63%.[7] That finding should not be stretched into a guarantee for every wartime disruption. It does support a more grounded point: visibility tools work best when they are paired with operating investment. Software identifies the exposure; people, contracts, approvals, and capacity reservations determine how fast the company recovers.

AI supplier risk scoring is credible enough to evaluate seriously for wartime disruption management. The Ukraine war showed why standard supplier screens miss too much below tier 1. Current conflict pressure keeps the problem active. The buying decision should not be framed as whether a vendor can show hidden red nodes on a map. It should be framed as whether the organization can turn a sub-tier warning into a sourced, approved, and funded response before the disruption reaches production.

References

1. Supply Chain Disruption from the Russian Invasion of Ukraine, Interos, February 2022.
2. U.S.-Israel-Iran War Is Stress-Testing Global Supply Chains, GEP.
3. Altana Atlas, Altana.
4. Predictive Risk Management Framework, JAGGAER, 2025.
5. Contested Logistics / Supply Network Risk, C3 AI.
6. AI Risk-Optimized Procurement, Everstream Analytics.
7. Gábor & Szentesi 2024 visibility tools finding, Sensos, 2024.