Strengthening the Aerospace and Defense Supply Chain: A Conversation With Verify’s Kathleen Boyle

On The Factory Doctor Podcast, Alex Krutz speaks with Kathleen Boyle about supplier performance, cybersecurity, artificial intelligence, leadership, and the investment needed to strengthen America’s industrial base.

Introducing Verify

Alex Krutz: Welcome to The Factory Doctor Podcast. I’m here with Kathleen Boyle, CEO and president of Verify. Welcome to the show, Kathleen.

Kathleen Boyle: Hi, Alex. Thank you so much for having me. I’m delighted to be here.

Alex: For our listeners, I’ve known Kathleen for quite a few years. We would always bump into each other at conferences and industry events.

We’re both service providers. Patriot focuses on operations consulting, while Verify works in quality and supplier performance management, including inspections and the insights that come from that work.

Kathleen, tell us a little about the business.

Kathleen: Verify was founded on August 9, 1976, so we recently celebrated our 50th anniversary. Initially, the company focused exclusively on supplier quality, primarily source inspections, audits, and surveys.

We’ve evolved over those 50 years, particularly during the last 25. We expanded into supplier performance management, supplier improvement, requirements flowdown, first article inspections, and supplier recovery.

Shortly before COVID, we also launched supply chain risk management support. The original intent was to help restart the 737 MAX supply chain, but that quickly changed with COVID. Since then, there has been greater demand for that support, including within the defense industrial base.

Alex: There aren’t many companies that have been around that long and remain privately held. Tell us about your career at Verify and how that experience has shaped your leadership.

Kathleen: My dad founded the business in 1976 when I was little. He was an aerospace engineer from Ireland who came through the British aerospace industry and attended graduate school in England.

During the Vietnam War, engineers were being recruited to Philadelphia. He came over to work at Vertol, which is now part of Boeing’s helicopter business. He also spent time in Florida, where he met my mom.

A few years later, they moved to California. He became a quality manager and quality director at a wire harness facility in Hawthorne. He saw a need for a business that could supplement and augment supplier quality resources, and that’s how Verify began.

I loved spending time with my dad. He worked all the time, so I would go to the office with him as a child. The day after I graduated from high school, I was asked to come in and work for the summer. I continued working there throughout college.

I had planned to do something different, but then someone went on maternity leave, and someone else had a medical event. The requests kept coming: “Can you stay for six months? Can you go to New Jersey for two years to support a new contract?”

I kept saying yes.

Once you get involved in aerospace and defense, it can be hard to leave, especially when you’re passionate about the work. Our work in quality and safety helps protect the warfighter and keep the flying public safe. That’s incredibly meaningful.

I’ve had the opportunity to work in nearly every aspect of the business, and over the last decade or so, I’ve been in leadership.

Alex: Those years of saying yes to the next opportunity have brought you to leading a fantastic business. Tell us about your team and how the business is structured.

Kathleen: We’re small but mighty. We have fewer than 100 corporate team members, supported by a technical workforce of approximately 1,000.

That includes our dedicated technical engineers, inspectors, auditors, and improvement specialists, along with an on-demand team of consultants. Some want to work on a particular project or only work part time, so it’s a mix.

We have the privilege of visiting approximately 7,000 to 8,000 suppliers annually in more than 45 countries. We work on behalf of many of the primes and tier-one companies and reach deep into the supply chain.

Across that work, we have more than half a million individual activities in the supply chain involving quality, delivery improvement, supply chain risk management, and related support.

Building a Career Through Experience

Alex: Before we get into the industry discussion, what stands out as one of the most interesting experiences in your career?

Kathleen: Moving to New Jersey was a great experience. At first, I thought, “How quickly can I get back?” But being in my early 20s, fresh out of UCLA, and experiencing a different culture turned out to be valuable.

I could visit college friends in New York, Washington, D.C., and Boston, but I also wanted to become involved in the community where I was living outside Philadelphia.

I joined a running club with my Lockheed Martin customers. It was a great opportunity to have what were essentially mini program reviews once a week while we ran around town.

On the other hand, being young, female, and from California, I discovered that some people had biases against one or more of those things.

Some of the customers I worked with were later in their careers and were tough on me. I heard comments like, “You Californians are lazy.” My reaction was that it would motivate me to work even harder.

When it was time to return to the West Coast, the praise from some of those toughest customers meant more than anything. They told me, “You proved us wrong. You helped us solve complex problems, and you’ve been great.”

That was a special experience.

The Supply Chain Issues That Need More Attention

Alex: You interact with a lot of companies, both through your services and through broader industry relationships. What isn’t the industry talking about that it should be?

Kathleen: Verify has a unique perspective because we work at so many levels of the supply chain.

Our supply chain risk management assessments go beyond quality. We look at capability, capacity, human capital management, financial health, infrastructure, and other factors. That creates opportunities to speak directly with business owners and leaders.

Many are smaller businesses, particularly in the submarine and maritime industrial bases. We’re a small business ourselves, so we appreciate some of their challenges.

I’m sometimes asked to speak with people in Congress or at the Pentagon as a voice for smaller businesses. That perspective comes not only from our experience, but also from the hundreds of companies that share feedback with us.

Three issues stand out.

First, OEMs continue to push for what suppliers consider unrealistic affordability, sometimes to the detriment of supply chain performance and quality.

That isn’t new, but it becomes particularly challenging when both commercial aerospace and the defense industrial base are trying to ramp production.

Second, there is the flowdown of Cybersecurity Maturity Model Certification, or CMMC, requirements and the associated cost and process impacts.

Primes and tier-one companies are generally better capitalized and better able to absorb those requirements. It becomes much more difficult at the middle and lower tiers.

Those companies must meet compliance obligations to maintain their participation in the defense industrial base. The same requirements can also affect companies considering entering the market.

Third, we’re hearing concerns about OEMs accepting first article inspection delinquencies. There are many outstanding inspections as the industry works to increase production.

At the same time, some approaches to catching up involve using lower-cost environments where aerospace and defense experience may be less prevalent. There are also concerns about whether all duties and obligations are being followed, particularly on defense work.

Cybersecurity Risks Below the Surface

Kathleen: A related concern is the vulnerability of the subtier software supply chain and the potential weaponization of open-source software.

The industry is focused on missiles, hypersonics, satellite swarms, and AI-enabled drone fleets. But increasingly, the operation and maintenance of those platforms depend on embedded software and related technologies.

That creates vulnerabilities. Small teams, potential backdoor access, and environments with inadequate cybersecurity controls can all introduce risk. My concern is the continued use of these technologies without sufficient visibility and control.

Alex: Let me make sure I understand. Are you talking about risks at smaller software companies and the open-source architecture being used?

Kathleen: It includes manufacturers, too. It isn’t necessarily limited to software companies.

A prime or tier-one company may be rigorously maintaining its cybersecurity controls and protecting its systems. But there can still be blind spots where malicious actors have opportunities to introduce code.

There’s also what I would call an agility trap. If the Pentagon pushes primes, partners, and subtiers to develop software at commercial technology speed, gaps may emerge if protections don’t keep pace.

Then there’s the legacy software issue. Defense platforms may run on older systems with software that is difficult to update. If underlying code remains unpatched, vulnerabilities can become difficult for the Pentagon, defense primes, or suppliers to address.

Alex: You’ve also been a resource for policymakers trying to understand these supply chain issues.

Kathleen: Yes, although I haven’t testified before Congress. My involvement has been more conversational.

Alex: That distinction is important. People on Capitol Hill and elsewhere use you as a resource to understand what’s happening in the supply chain.

The Cost of Cybersecurity Compliance

Alex: Let’s spend a little more time on CMMC. There has been discussion about a pause or review of certain requirements. Some small and medium-sized businesses have already spent significant amounts preparing for assessments and compliance.

Can you talk about the challenge for those businesses?

Kathleen: CMMC—the Cybersecurity Maturity Model Certification—isn’t a new conversation. We were discussing it before COVID.

Early on, some people described it as something that should be quick and cost only a few thousand dollars. But it isn’t simply a matter of hiring someone to conduct an assessment.

Companies also have to maintain an internal environment capable of managing controlled unclassified information, or CUI. That is where costs can become significant.

It can involve software licenses, secure enclaves, and the systems and controls needed to protect that information.

If you want to participate in the defense industrial base, you have to find a way to afford those obligations. That becomes difficult when the costs weren’t accounted for in a fixed-price or multiyear contract.

Depending on the company and the work required, the overall costs discussed can reach hundreds of thousands of dollars or more when assessments, preparation, secure environments, and ongoing obligations are included.

About five years ago, a customer asked us to implement requirements and flow them down to everyone working on a particular contract. At the time, we calculated that the cost would exceed $700,000.

That exceeded the gross margin on the work, let alone the net margin. We would have been losing money on a program with one of our largest customers.

There has been a lot of analysis and change since then. But the underlying need for cybersecurity controls isn’t going away.

People who have been around for decades will point out that many of these expectations build on longstanding NIST standards. What changes is the assessment framework and the technology required to manage controlled unclassified information.

I’ve also heard discussions about whether there could be support for smaller companies. Rather than relying entirely on a stick, could there be a carrot? Tax incentives, rebates, or other funding mechanisms might help ease the burden.

Those discussions are encouraging, but companies still need to prepare.

Alex: That’s a good point. In broader government discussions, including some I helped with at Commerce, the question was how to incentivize the right behavior instead of always penalizing the wrong behavior.

Kathleen: Absolutely.

Alex: The underlying message is that a pause doesn’t mean the cybersecurity challenge disappears. Companies still need to understand their obligations and prepare their systems.

Leading a Business Where People Are the Infrastructure

Alex: Let’s move to people, product, and process. How do you lead your people and align them with your business objectives?

Kathleen: We’re a service business. We spend a lot of time in factories supporting manufacturing customers, but we don’t have traditional factories or physical inventory ourselves.

Our people are our primary infrastructure.

Our revenue and success depend on the collective discretionary effort, skills, and alignment of our workforce. Our people are everything.

When someone joins Verify, I want them to understand our values. We have a “Welcome to the Family” session where I explain our five values: integrity, teamwork, respect, accountability, and innovation.

Integrity means doing the right thing when nobody is watching. Teamwork means recognizing that we have to work together.

Respect applies to our teammates, customers, business partners, and the work itself.

Accountability means meeting our obligations to each other and our customers.

Innovation means continually looking for ways to improve.

I use the phrase “I try” to help make those values memorable. Every day, I try to act with integrity. I try to be the best teammate. I try to be respectful, accountable, and innovative.

Innovation is particularly important because being process driven and doing the right thing doesn’t mean continuing to do everything the same way forever.

My dad used to ask, “Do you have 30 years of experience, or do you have one year of experience 30 times?”

You have to keep asking what needs to change, how you can better help your customers, and what the industry needs.

We reinforce that from someone’s first day through their first week, month, year, and beyond.

We also encourage teams to work within their functions and across functions. That helps eliminate internal friction, speed up decision-making, and create accountability.

We win or lose together. Transparency and alignment are essential to satisfying our customers and exceeding their expectations.

Alex: Aligning interests and outcomes is huge. I also love your dad’s question about whether someone has 30 years of experience or the same year of experience repeated 30 times. That gives leaders a lot to think about.

Finding the Hidden Factory in a Service Business

Alex: As a service provider, you need robust processes. How do you improve productivity, delivery, and customer satisfaction?

Kathleen: Our roots are in aerospace, engineering, and quality, so we’re very process driven.

But that doesn’t mean we can define a workflow and assume it should never change.

In a traditional factory, you can often see waste or delinquent work on the floor. In a service business, the scrap can be silently hiding in email inboxes, scattered software tools, and unrecorded employee habits.

Alex: Tribal knowledge.

Kathleen: Exactly—tribal knowledge and hidden factories.

We try to create an environment where people feel comfortable bringing forward ideas. During onboarding, I tell people that if they learned something useful in a previous role, they should share it.

Talk to your supervisor, send it to HR, or come to me. Just because we’ve done something a certain way doesn’t mean it always needs to stay that way.

We’re also involving our teams in AI adoption. We have policies, training, and guardrails, but we want employees to help develop the use cases.

We encourage them to experiment in safe environments and identify what could work better.

These tools can help us operate more predictively and execute rules-based tasks more quickly. We still need people, but our customers expect greater efficiency, effectiveness, speed, quality, and delivery performance.

People are having fun identifying ways to improve their work, their functions, our collaboration, and how we serve customers and stakeholders.

Helping Smaller Suppliers Get Started With AI

Alex: Let’s stay with technology. What are you seeing companies do with AI? What’s working, and where are the opportunities?

Kathleen: We’ve partnered with people who have deep AI expertise. They helped us establish guidelines and are helping our internal teams move forward.

But given our perspective across thousands of aerospace and defense companies, particularly small and medium-sized suppliers, my simple answer is that many aren’t doing enough.

Large, well-capitalized companies can bring in consultants and draw on deep internal expertise. Some are doing very interesting things.

At smaller companies, there can be fear and uncertainty. People worry about putting information in the cloud, losing control of intellectual property, or exposing assets that are central to their business.

Some are effectively paralyzed. They could be doing more, but they don’t know where to start.

We’re beginning to help smaller companies approach this the way we did: start with manageable pieces, learn, improve, and bring the team along.

Everyone needs to understand the value and how the tools can help them work better together.

Alex: Done well, AI implementation could become a significant part of your business.

Kathleen: There’s a short window. Companies that insist on building the same widget the same way they always have risk being left behind.

I think the next one to three years will be transformational.

There are accessible places to start, but people have questions. What do the tools cost? Is implementation manageable? How do we use them safely?

We’re enjoying that learning process internally, and it’s rewarding to help others in the supply chain work through it as well.

Alex: The use cases and implementation within manufacturing operations are going to be important over the next few years.

Rebuilding Industrial Capacity Requires More Than Ambition

Alex: I like to close with industrial policy. What are your thoughts on reshoring and reindustrialization?

Kathleen: You know I love policy. We could spend all day discussing commercial trade, export controls, and defense.

If we focus on rebuilding defense-related industrial capacity, there’s definitely an appetite for progress. I would look at four areas.

First, advanced microchips. There has been meaningful effort and support, although building domestic capacity is expensive and slow.

Constructing a fabrication facility takes years and substantial capital. The technology also has a short life cycle, which makes execution challenging. Still, I’m encouraged by the push to build that capability.

Second, autonomous systems and drones. Commercial technology adoption has been scaling rapidly.

We have emerging “neo-primes”—newer companies taking on roles traditionally associated with established defense primes. We also have smaller, agile businesses that can compete in these markets. Those are positives.

Third, munitions and missiles. Multiyear contracts can help drive expansion, but there are still gaps in raw materials and chemical sourcing.

Companies also have to ask whether the demand will last. Do they invest in capacity for a production ramp, only to see that demand disappear?

Fourth, naval and shipbuilding capacity. That is critical, but decades of insufficient supply chain investment and support have contributed to the difficulties facing the maritime and submarine industrial bases.

The cost of capital, the cost of compliance, and predictability across program life cycles all matter.

There’s also a broader question: When capacity is built through reshoring, nearshoring, or friendshoring, will it be available to the defense industrial base?

Some of that capacity could move toward industries with clearer demand signals.

For example, castings and forgings may support commercial or military jet engines, but they may also serve turbines for energy infrastructure and data centers.

If we want to rebuild defense capacity, we need clear demand signals and the infrastructure to make that investment worthwhile. Companies need confidence that the opportunity won’t disappear with a change in administration or policy.

Investment Starts With Demand

Alex: That’s a point we both agree on: investment has to start with demand.

Multiyear contracts and programs of record matter. So does the ability of Congress to pass annual budgets.

Regardless of the administration, relying continuously on continuing resolutions makes long-term planning difficult. It doesn’t provide the funding certainty companies need to invest.

Kathleen: We also need to pay attention to reauthorizing the Export-Import Bank. It matters for exports, trade, and the companies supporting those activities.

Alex: Agreed. It supports companies that want to create exports, too. I had the opportunity to work with the organization last year, and that reauthorization is important.

Continuing the Conversation

Alex: Kathleen, this has been a fantastic conversation. We covered cybersecurity, CMMC, the defense industrial base, and the challenges of reshoring, nearshoring, and friendshoring.

Do you have any final thoughts for our audience?

Kathleen: This has been so much fun. Thank you for your service to our nation. It’s great to have you back in industry.

We both love helping this industry become healthier, stronger, and more successful. Thank you for having me.

Alex: If someone wants to learn more about Verify or connect with you, where should they go?

Kathleen: Visit verifyglobal.com to learn more about the business.

You can also find me on LinkedIn and follow Verify there. Please reach out.

I’m frequently at air shows, trade shows, and other industry events. If you see me, come say hello. I would love to continue the conversation.

I’m passionate about supporting and advancing aerospace and defense.

Alex: Thank you, Kathleen, for joining me. And to everyone listening, we’ll see you next time on The Factory Doctor Podcast.

Kathleen: Take care, Alex. Thank you.