Recommended Free Tools
Investing in a defense technology startup requires the same scrutiny as any early-stage company—of its technology, team, customers, economics, and financing—plus a closer look at ownership and influence, security obligations, intellectual-property rights, and government contracting. A foreign relationship or government award is not automatically disqualifying; the implications depend on the company, the work, the contracts, and the rules that apply.
What makes diligence different for a defense technology startup?
Defense startups may handle sensitive technical information, seek government funding, or sell products subject to security and export rules. Those features can affect who may invest or access information, what the government can use, and how the company can sell or scale its product.
The Army SBIR/STTR program describes its review as a risk assessment intended to protect U.S. intellectual property and defense capabilities. It examines issues including foreign ownership, control, or influence (FOCI), cybersecurity hygiene, and patent risk. As Gina Sims, then director of the Defense SBIR/STTR Program, put it in a May 23, 2024, Department of Defense release: “We value the innovations and technologies derived from SBCs that enhance warfighter capabilities to support the DoD mission.” That interest in innovation does not establish that a particular startup is secure, eligible for an award, or likely to win repeat business.
For an investor, diligence is fact-finding: establish what the company owns, what it owes, who can influence it, what obligations attach to its work, and whether customers are paying for a product that can be delivered and repeated.
#1 Best Overall
Who owns or can influence the company?
Do not assess influence from the cap table percentage alone. Defense FOCI guidance treats the issue as whether a foreign entity has power to direct or influence management or operations. Influence can arise through financing, governance, affiliations, and commercial relationships as well as direct equity.
Build a map of direct and indirect ownership and control. Compare it with corporate records, investor disclosures, and representations made in government applications. Include:
- Beneficial owners, voting rights, board seats, board observers, and veto or consent rights.
- Debt covenants, side letters, financing arrangements, and obligations to foreign entities.
- Affiliations, joint ventures, subsidiaries, licensing arrangements, and material suppliers.
- People or entities with access to management, operations, technical information, or critical supply chains.
SBA policy and law require specified disclosures concerning investment and foreign ties in the SBIR/STTR context. Check the company’s actual disclosures against its ownership and relationship map. A foreign nationality or investment is not, by itself, proof of an unacceptable risk; defense guidance describes risk assessment and mitigation, not a universal ownership-percentage test.
What government awards and review obligations does the company have?
For a company with Small Business Innovation Research (SBIR) or Small Business Technology Transfer (STTR) awards, request the applications, disclosure forms, award documents, compliance correspondence, subcontracting records, and any security-risk review outcomes. Establish which entity applied, which entity performed the work, and whether the company’s present ownership and relationships match what it disclosed.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsProgram rules are time-sensitive. A May 2024 DoD release described required security-risk forms submitted with proposals. The current Department of War (DoW) Office for Small Business Innovation pages, accessed October 7, 2026, describe a Foreign Risk Evaluation (FRE) process following reauthorization in April 2026. Confirm the requirements in the current solicitation and the rules applicable to the specific award; do not rely solely on an older memo or a company summary.
DoW program materials also describe eligibility and registration requirements. Army guidance says a review can recommend denial if an unacceptable national-security risk cannot be mitigated. Request the company’s applicable eligibility records and review correspondence rather than inferring a result from the fact that it received—or applied for—an award.
Rank #3
Who owns the technology, and what rights did the government receive?
Trace each important technology asset from its origin to the company. A rights matrix should identify the asset, contributors, funding source, contract or license, ownership evidence, restrictions, and any required markings. Check founders, employees, universities, laboratories, subcontractors, prior employers, government-funded work, licensed material, open-source components, and other encumbrances.
For SBIR/STTR-derived technical data and software, match each item to the relevant award, clause, marking, and date. DFARS 227.7104 applies SBIR/STTR data-rights protections to covered data delivered, developed, or generated under covered work, including certain Phase III work. Under the standard provision, protection lasts 20 years from the contract award unless a different period is negotiated after award. After that period, the regulation provides for government purpose rights. The rule does not automatically cover every company asset: the specific work, clause, markings, and contract history matter. Have qualified counsel review the governing contract language and marked materials.
This rights review matters to the investment case because the company’s ability to license, commercialize, or restrict use of technology can depend on the rights attached to particular deliverables. A broad claim that the company “owns its IP” is not a substitute for tracing rights asset by asset.
Rank #4
- Used Book in Good Condition
Who can access the technology and technical data?
Ask how the company classifies its technology and controls access to it. Request its written export-control classification process, relevant classification or Commodity Jurisdiction correspondence, licensing history, technical-data access controls, foreign-person access controls, and training records.
The SBA’s SBIR ITAR guidance explains that classification requires analysis against relevant control lists and that disclosure of certain technical data to foreign persons may be restricted without authorization or an applicable exception. Whether a particular item is controlled—and what a particular transfer or disclosure requires—depends on the technology and transaction. A customer list or marketing description cannot establish a company’s classification or compliance status.
Does the company protect controlled information adequately?
Identify which systems and subcontractors handle controlled unclassified information, technical data, or other protected material. Then compare actual practices and evidence with the requirements in the applicable contract and solicitation.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Request implementation records, relevant assessment results, incident history, and remediation plans.
- Check how requirements flow down to subcontractors and how compliance is monitored.
- Confirm what information is stored in which systems and who can access it.
- Compare current practices with the specific requirements and dates that apply to the company’s work.
Army diligence guidance identifies cybersecurity hygiene as a review area. DoD’s CMMC Resources & Documentation page signals that policy and implementation materials can change, so verify the current, contract-specific requirements. A company’s statement that it is “CMMC-compliant” is not, by itself, evidence of its status.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is the government customer actually paying for the work?
Separate customer interest, a program pathway, a pilot, and an award from funded, accepted, repeatable revenue. For each claimed government opportunity, examine the underlying documents and ask:
- What solicitation, award, or contract supports the claim, and which entity is the contracting party?
- What amount is funded, for what period, and against which deliverables and acceptance criteria?
- Are options, follow-on phases, or future procurement steps funded commitments or possibilities?
- What termination rights, subcontract roles, and restrictions affect expected cash flow?
- Can the customer or user confirm the work, performance, and likely next step?
Test the product separately from the contract. Seek demonstrations, independent technical review, user feedback where available, reliability evidence, integration requirements, and manufacturing readiness. Distinguish prototype performance from readiness for deployment. A technically promising prototype can still face integration, production, or procurement hurdles.
Can the company turn technical success into a durable investment case?
Review the ordinary startup fundamentals alongside the defense-specific risks: team capability, financing needs, burn and runway, customer concentration, delivery costs, margins, and the time and expense required to reach production. Match revenue claims to funded work and actual customer payments; do not treat an award or government interest as proof of repeatable sales.
Free tools Windows power users keep installed
One-click scans. No signup required.
Where meaningful alternatives exist, compare them on mission performance, integration and interoperability, reliability and manufacturability, time and cost to deploy, security and export-control burden, data and IP rights, funding and follow-on potential, and customer concentration. Not every defense product has a useful commercial-market analogue, and a commercial product may not meet a defense customer’s operational requirements.
Build the investment decision around evidence and scenarios. Ask what happens if a security review requires mitigation, a customer delays procurement, production costs exceed expectations, or the company cannot use or license a particular asset as freely as it expected. These are questions to test against documents and management’s assumptions, not outcomes that should be presumed.
Quick Recap
How should an investor organize the diligence?
- Define the investment thesis. Identify the product, customer, mission need, expected procurement route, and assumptions behind growth and returns.
- Request a document set. Collect corporate and financing records, ownership disclosures, SBIR/STTR applications and awards, contracts, IP records, security and export-control materials, financials, and customer evidence.
- Reconcile claims across records. Compare investor materials with corporate documents, government submissions, award terms, technical records, and customer confirmations. Resolve discrepancies before relying on a representation.
- Assign specialist review where the documents require it. FOCI and security, export-control, government data-rights, and procurement questions may require qualified advisers familiar with the applicable rules and contracts.
- Record unresolved risks and decision conditions. Separate verified facts from management estimates, specify what evidence remains missing, and determine whether the investment case still works under plausible delays, restrictions, or cost increases.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
