Why do hidden supplier dependencies still catch my team off guard?

You already know how to rate a supplier. You built the scorecard. You check the financials, the lead times, the backup plans. And still something breaks that nobody saw — a subcontractor you never rated, one factory feeding two vendors you thought were separate. This is not bad luck. It is where your team stopped looking. Every team stops at the same place: the edge of the contract. That is where your authority ends, so that is where the map ends. But dependency does not care about your contracts. It runs through shared ports, shared software, shared people — three layers past where your risk report stops. You cannot see everything. No team can. But you can choose to look one layer further than comfort allows, and name, out loud, who on the pod owns that search this month. That choice is within your power. The surprise is not — until you make it your business to remove it.