Veridion

62% of the technologies we found never appeared on any company website. Traditional analysers read what the browser sees: HTML, cookies, scripts, headers. That's how we started Stack Lookup too. It works right up until a company has no useful web footprint, or runs its stack behind the firewall. So we pointed Orion at the surfaces that still talk about a company's stack: job postings, public Git and certificates. Across ~10k top companies: → 62% of technologies were found only beyond the website → 38% of companies had technologies their website never revealed → +41% larger known stack for those companies And we're already working on the next layer: a non-intrusive detector that identifies backend technologies from publicly exposed protocols and service fingerprints. The full story, including why 62% of the technologies we found never showed up on a website: https://lnkd.in/dRezrPaJ The internet is much bigger than the web. So is the stack we're mapping.

One thing I hope stays in 2026: 𝗿𝘂𝗻𝗻𝗶𝗻𝗴 𝘁𝗵𝗶𝗿𝗱-𝗽𝗮𝗿𝘁𝘆 𝗿𝗶𝘀𝗸 𝗿𝗮𝘁𝗶𝗻𝗴𝘀 𝘀𝗼𝗹𝗲𝗹𝘆 𝗼𝗻 𝗹𝗲𝗴𝗮𝗹 𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀. A risk view built only on registry data is hurting your product, your clients, and your chances of staying competitive. I know that in many cases, registry data is the only available source for a vendor. But that shouldn’t excuse you from constantly looking for better ways to screen third parties. One of our clients was initially skeptical about how much coverage they could find for small contractors and vendors. To their surprise, many of these contractors had better digital footprints than mid-sized businesses. These small contractors are everywhere: socials, public directories, local news outlets. So if you still think those thousands of small vendors you’re chasing with questionnaires are nowhere to be found, I’d be happy to show you what we know about them.

6 kinds of companies that pass KYB on paper. And what gives each one away. 1. The shelf company Registered in 2016. Did nothing until last month. On paper, a 10-year-old business. → the website is three weeks old, and the directors changed right before it applied. 2. The mailbox company The registered address is real. It's a mailbox shop shared with hundreds of other companies. → look the address up on Street View, then count how many companies are registered there. 3. The front company The director is real too. They're also the director of dozens of others. → search the person, not the company. Same address, same phone, across all of them. 4. The phoenix company New name, new company number. Same owners, same customers, same phone number. The old one went bust owing everyone money. → match the phone, address and directors against companies that were recently liquidated. 5. The borrowed brand Trading since the 80s, according to the reviews. The company behind the name is 18 months old. → compare the trading name with the legal entity. If the reviews are older than the company, the name probably changed hands. 6. The zombie Still "Active" on the register. Website offline since June, no new hires since 2023, phone goes to voicemail. → check whether it's trading, not whether it's filing. Website, job posts, recent reviews, last social post. Not one of these giveaways lives in the registry. They're all public. Just somewhere else. Which one did I miss?

One of the world’s biggest business data providers has a 1.1 star rating on Trustpilot. The company is Dun & Bradstreet. It has 430+ reviews, and 96% give it one star. Honestly, it’s a pretty accurate picture of where the business information industry is today. Read through the reviews and the same complaints keep coming back: - support that takes more than a month to reply - simple profile changes that take 30 days to go live - data mistakes that make a business ineligible for credit or lose it a contract, and then take weeks to fix To be fair, some legacy players in this industry are clearly working to fix all of this. D&B doesn’t seem to be one of them. And if you’re buying data from them, this clearly affects your business. The records these companies are struggling to fix are the same records D&B sells to its clients. Every 30-day delay means 30 days of decisions made on outdated data. And the errors nobody reports probably stay in the data even longer. Some examples of what that looks like for D&B’s clients: Google Since 2023, any organization that wants to publish an app on Google Play needs a D-U-N-S number. One reviewer waited more than 30 working days to get theirs. That company can’t ship its app, and it blames Google’s onboarding for the wait. Apple requires the same number for its Developer Program, so iOS teams end up in the same queue. The US government For more than 40 years, the government identified every federal contractor with a DUNS number. GSA’s yearly cost for the D&B contract went from about $1M in 2002 to $19M in 2012, and the government didn’t even own the identifier. In April 2022, it replaced DUNS with its own Unique Entity ID in SAM.gov. Every team making decisions on D&B records A record changes only when the company reports it and D&B processes it, which can take weeks. Until then, every client uses the same outdated version in its credit, onboarding, and underwriting decisions. Because buyers can’t see what’s outdated, errors spread unnoticed. If your decisions run on one provider’s records, that provider’s support queue becomes your support queue.

These days anyone can check your data in under a minute, and it barely takes any effort. D&B data wasn't built for this era. Relying on it now is like expecting a '70s American V8 to match a plug-in hybrid on fuel economy. In client files I keep finding suppliers that closed months ago and are still active in the product. Usually next to: - parents that changed last year --> wrong group exposure - "manufacturers" that are basically resellers - registered in one country / operating in 4 --> wrong country risk - industry codes from 2015, so the wrong checks run Most of this is public long before it reaches the record: website, news, job posts, the same places your client checks. And you can't fix a D&B record yourself. Because of how their data is collected, sometimes they can’t either.

Yeah, most of the time, supply chain mapping is quite boring and simple. And I think many people looking for solutions in this space get blinded by shiny promises that, most of the time, fall apart without a solid, “boring” data foundation. To do any complex, AI-enabled SC analysis, you first have to answer simple questions with high confidence, traceability, and at scale. It all starts with a simple, "boring" data foundation that can tell you who your suppliers are, where they actually operate, who their suppliers are, and what other entities are linked to them (parent companies, joint ventures, country-level legal entities...). Then the other capabilities and sci-fi-looking scenarios are easy to solve. Need disaster scenario modeling? Add GDACS alerts, NASA FIRMS wildfire data, and WRI Aqueduct flood risk on top. Need alternative suppliers? Add bill-of-lading data, UN Comtrade trade flows, and IAF CertSearch certifications. Need geopolitical risk scoring? Add sanctions lists (OFAC, EU, UK), ACLED conflict data, and World Bank governance indicators on top.