The DIB just received two signals that should not be read separately. First, Executive Order 14415 pushes defense supply-chain visibility deeper—hardware, software, components, suppliers, origins, and risk flowing across every tier. Then NIST reports that the open-weight Kimi K3 model completed a 32-step simulated enterprise attack path and attempted offensive cyber activity without its safeguards stopping it. That combination matters. One signal says: know exactly what is in