What is concentration risk?
Too much reliance on too few suppliers, technologies, locations or counterparties.
When too many eggs sit in one basket.
Concentration risk is the risk that arises when an organisation, or a whole sector, depends heavily on a small number of suppliers, technologies, locations, customers or counterparties. If one of them fails, the impact is large, because there are few alternatives and little spread.
In finance the term was first used for exposure to a few borrowers or markets. In business continuity and operational resilience it is now widely used for dependence on a few cloud providers, software vendors, service providers, ports or regions.
Where it appears.
Supplier
Heavy dependence on one supplier or a few, for goods, components or services.
Cloud and technology
Critical systems with one cloud provider, region or software platform.
Geographic
Sites, suppliers or customers in one city, region or country exposed to the same hazard.
Route and infrastructure
Reliance on one port, canal, pipeline, airport or power grid.
Customer
A large share of revenue from one customer or sector.
Counterparty and financial
Exposure to a small number of borrowers, banks or markets.
People and skills
Key knowledge held by one team, firm or location.
Sector-wide
Many organisations using the same provider, so one failure hits them all at once.
Concentration turns a small failure into a big one.
Fewer alternatives
If the main provider fails, there may be no ready substitute, and switching can take months.
Correlated failure
Many customers fail together, which stretches support, recovery capacity and supply of replacements.
Limited bargaining power
Dependence weakens your ability to negotiate terms, obtain information or demand resilience.
Systemic risk
When a sector depends on a few providers, an outage can threaten the stability of services that many people rely on.
Regulatory attention
Regulators in finance and other sectors look at concentration in outsourcing and cloud, for example the EU DORA regulation, the UK operational resilience rules and Basel Committee principles on operational resilience.
How to measure and reduce concentration risk.
Map and measure
List critical suppliers and platforms, and measure share of spend, volume and critical services per provider or location.
Set appetite
Decide how much dependence is acceptable and agree limits with senior management.
Diversify where it matters
Use a second source, region, provider or route for the most critical services.
Plan to exit
Have tested exit and transition plans, including data portability and a stressed exit.
Contract for resilience
Require recovery targets, incident notification, audit rights and support in contracts.
Monitor
Track supplier health, incidents, ownership and geopolitical or regional risk.
Exercise
Test what happens if a key provider is unavailable for days or weeks.
Link to supply chain risk
Concentration in practice.
July 2024, CrowdStrike
One security software update caused outages across airlines, banks, hospitals and retailers that used the same product.
October 2025, AWS outage
A fault in one large cloud region was reported to have disrupted many apps and services at once.
February 2024, Change Healthcare
A ransomware attack on a single healthcare payments provider disrupted pharmacies and providers across the US.
2024 to 2025, Red Sea
Attacks on shipping forced vessels to avoid a key route, lengthening journeys and raising costs for businesses dependent on that corridor.
March 2021, Suez Canal
One blocked route affected a large share of world trade.
2011, Thailand floods
Flooding of industrial estates disrupted global supplies of components such as hard disk drives, because production was concentrated in one area.
Examples are drawn from public reports and are simplified. Check the original reports for details.
Concentration risk questions.
Is using one cloud provider a concentration risk?
Is a sole-source supplier always a risk?
How is concentration risk different from supply chain risk?
Talk to ADVOX about third-party and concentration risk.
We aim to reply to your enquiry within 2 hours during working hours.
Related reading: What is Redundancy? | What is a Single Point of Failure? | What is Concentration Risk? | What are Data Centres? | What is HVAC?