The audit caught it. The contract did not.

Hardware supply-chain integrity in a Western defense buyer is not won at procurement. It is won, when it is won, at the next routine test. The Daily Telegraph, via Tom's Hardware, reported that a routine cyber vulnerability assessment of the Royal Navy's K3 Scout sea drones caught a Chinese-made camera checking in with servers in China, and the catch itself is the proof of where the defense actually lives.

The reusable category is "audit-grade trust." A vendor selling a sealed sub-component ships its security assurance with the contract. The buyer inherits the assurance, not the audit. The only thing the buyer owns is the right to test, and the test is what turns a quiet unknown into a known one. Kraken Technology Group sourced the cameras from a third party. The assurance traveled with the contract. The test, run separately, found the heartbeat.

The MoD's "heartbeat communications" line is a payload defense, not a defense of the sub-component's autonomy. Liveness pings confirm the device is online — which is the kind of pre-activation confirmation a sophisticated operator might require before activating a richer channel. Reading the line as a dismissal mistakes the existence of a transmission for the content of one. No independent technical source confirms the actual scope of what was transmitted. The Ministry of Defence's own action, cutting camera internet connectivity, concedes the architecture was reachable.

Western pushback on Chinese components in critical infrastructure has run the same arc on Huawei, ZTE, and Taiwanese drones: a security review, a partial ban, a residual dependence admitted after the fact. The audit caught this one earlier, which defends the testing regime and indicts the procurement regime that needed it.

The buyer can outsource the part. It cannot outsource the test.