In the last two decades, Western states have frequently worked with non-state or substate armed groups to confront security threats, whether as part of global counter-terrorism operations or as de facto security providers in stabilisation and peacebuilding contexts. But while these forces may be quick and easy to mobilise, they often come with substantial risks or drawbacks. Many have a reputation for abuses, may be linked to warlords, criminal networks, or terrorist groups, or present other political conflicts of interest. The greater frequency of such partnerships has sparked interest in how states might mitigate some of these risks, and what due diligence measures or accountability mechanisms should be adopted in dealings with nonstate or substate partners. To better understand this emerging challenge, this paper considers how the US applied a series of due diligence or risk mitigation measures in seven partnerships with local, substate and non-state forces in Afghanistan, Syria and Iraq. The conclusions suggest practical lessons about the effects and limitations of such measures, but also some larger unintended consequences, particularly where technical approaches to these issues obscured larger risks and skewed decision-making choices.