Vendor concentration risk: when many vendors share one provider

Vendor concentration risk is the risk that too many of your critical services depend on the same provider, location or technology, so that a single failure disrupts several of them at once. It rarely comes from one decision. It builds up contract by contract, and it often sits one level down, in the providers your vendors share.

This post covers the main types of concentration, how to measure it across your vendor portfolio, how to test it with blast-radius scenarios, what regulators expect, and what you can do about it.

What is vendor concentration risk?

Every vendor relationship creates some dependency. Concentration risk appears when those dependencies overlap. Your core banking platform, your fraud screening tool and your customer messaging service may each look moderate on its own. If all three run in the same cloud region, one regional outage becomes three incidents, landing on the same incident team at the same time.

That is why a vendor-by-vendor view cannot show concentration. You have to look across the portfolio, and often past your direct vendors to their fourth parties. A provider you never contracted with can still be the single point of failure under a third of your critical services.

What types of concentration should you track?

Concentration has several dimensions, and each needs its own measure.

Group related entities together. Two providers owned by the same parent, or two services from the same cloud company, are one concentration for this purpose.

How do you measure concentration across the portfolio?

Start with a clean dependency map: one record per provider, linked to every vendor that relies on it, with the source and a confidence level on each link. Then measure.

• Count of critical vendors relying on a provider. How many of your highest-tier vendors depend on this provider, directly or through a subservice organization?
• Share of critical services. What proportion of your critical services would be affected if the provider failed? A count of vendors can understate this when one vendor supports several services.
• Substitutability. How long would it take, and what would it cost, to move each affected service elsewhere?
• Confidence. How many of the links are confirmed by contracts, disclosures or SOC reports, and how many are inferred from outside-in signals?

Set thresholds that fit your risk appetite. For example, a program might flag any provider that supports more than a quarter of its critical services, or that sits beneath three or more Tier 1 vendors. These numbers are illustrative; the right ones depend on your size, sector and tolerances. High concentration is also a reason to look again at a vendor's tier, since a vendor that shares a critical provider with others may matter more than its own profile suggests.

What is blast radius, and how do you test it?

Blast radius is everything affected when one provider fails: the vendors, critical services and business processes that depend on it. Measuring concentration tells you where risk clusters. Blast-radius analysis tells you what happens when it lands.

Test it with severe-but-plausible scenarios. Pick one provider and trace every dependent path.

1. A hosting region used by several critical vendors is unavailable for a day.
2. A widely used processor, which some vendors use as a subservice organization, discloses a breach.
3. A common file-transfer or remote-access product is compromised across the industry.
4. A key supplier enters insolvency and stops service with little notice.

For each scenario, list the affected services, compare the expected disruption with your tolerance for each, and check whether you have tested failover or exit evidence on file. Where the gap is large, you have found a concentration that needs action.

What do regulators expect about concentration risk?

Concentration has moved from good practice to explicit expectation in several regimes.

• DORA Article 29 requires financial entities, before contracting for ICT services that support critical or important functions, to consider whether the arrangement would mean relying on a provider that is not easily substitutable, or holding multiple arrangements with the same or closely connected providers, and to weigh alternatives.
• OSFI Guideline B-10 describes concentration as overreliance on a single third party, subcontractor or geography for multiple activities, and expects it to be assessed across dimensions including geography, supplier and subcontractor.
• APRA CPS 230 requires an assessment of risks from the geographic location or concentration of service providers, or the parties they rely on, and business continuity testing with severe but plausible scenarios that include disruption at material service providers.
• The US Interagency Guidance on Third-Party Relationships asks banking organizations to consider the geographic location of subcontractors and dependency on a single provider for multiple activities.

Each organization remains responsible for meeting the rules that apply to it.

What can you do about vendor concentration risk?

Concentration is not always avoidable. Some markets have few credible providers. The goal is to make it a choice you have made deliberately, with a plan.

• Exit plans. For each critical service on a concentrated provider, document how you would leave or transition it, how long it would take and who decides.
• Alternatives. Identify a second provider, a different region or an in-house fallback, and test it for the services that matter most.
• Contract terms. Require notice before a vendor changes key subcontractors, rights to object, data return on exit, and transition support. Ask for evidence of the vendor's own resilience testing.
• Diversify new contracts. Check concentration before you sign, not after. A new vendor on an already crowded provider deserves extra scrutiny.
• Report and accept. Where you choose to keep a concentration, record the acceptance, its owner and its review date, and report it to the risk committee with a trend.

VendRisk360 maps fourth parties and subservice organizations to one record per provider, measures concentration by provider, service type and hosting region, and shows the blast radius of a shared failure. See nth-party intelligence for how it works.

Frequently asked questions

What is an example of vendor concentration risk?

Several critical vendors, such as a core banking platform, a fraud tool and a messaging service, all host in the same cloud region. Each looks acceptable alone, but a single regional outage disrupts all three at once. The concentration is invisible unless you map the providers your vendors rely on.

How is concentration risk different from fourth-party risk?

Fourth-party risk is the risk from any one of your vendors' providers. Concentration risk appears when many of your vendors or critical services depend on the same provider. Mapping fourth parties into one record per provider is what lets you see and measure concentration.

How do you measure vendor concentration risk?

Count how many critical vendors depend on each provider, directly or indirectly, and what share of your critical services would be affected if it failed. Add how hard each service would be to substitute and how confident you are in each dependency, then compare the results with thresholds set in your risk appetite.

Can concentration risk be eliminated?

Usually not entirely, because some services have few credible providers. The aim is to know where concentration sits, decide which concentrations you accept, and hold an exit plan, alternatives and contract protections for the critical services that depend on them.