Introduction
Most vendor risk programs ask the same question about every supplier: Is this vendor reliable? It's a reasonable question. It's also the wrong one if you're trying to understand systemic exposure.
The harder question — the one most boards never formally ask — is: What happens to our operations if this category of dependency fails?
A vendor can pass every security assessment, carry clean financials, and still represent serious concentration risk if it covers five critical functions simultaneously, shares infrastructure with half your other vendors, or operates in a geography prone to disruption.
That's the essence of third-party concentration risk. It's portfolio-level exposure, not vendor-level exposure. And because traditional assessments evaluate suppliers in isolation, it tends to stay invisible until something breaks.
This article covers what third-party concentration risk actually is, its four distinct forms, why it escapes detection, what's at stake financially and from a regulatory standpoint, and what a governance-first response looks like in practice.
TL;DR
- Third-party concentration risk is portfolio-level exposure — what happens when your organization depends too heavily on one vendor, geography, technology, or sub-provider
- Traditional vendor assessments miss it because they score suppliers individually, without mapping cross-vendor dependencies
- Business consequences span operational disruptions, financial losses, reputational damage, and legal liability
- Regulators — OCC, FFIEC, and DORA — expect boards to show documented oversight, not just management-level awareness
- Effective management starts with governance: inventory, concentration scoring, escalation thresholds, and exit plans you've actually tested
What Is Third-Party Concentration Risk?
Third-party concentration risk is the exposure an organization creates when it depends too heavily on a limited number of vendors, geographies, or technologies: a single disruption in any of those areas creates meaningful impact on operations, revenue, or compliance posture. It sits within operational risk inside TPRM programs — distinct from individual vendor assessment.
The key distinction from general third-party risk is the level of analysis:
- Individual vendor risk asks: Is this supplier secure and reliable?
- Concentration risk asks: What happens to our operations if this entire category of dependency fails?
One is a vendor-level question. The other is a portfolio-level question.
Why "All Clear" on Each Vendor Isn't Enough
A vendor can pass every assessment — clean SOC 2, solid financials, responsive security team — and still represent unacceptable concentration if it supports too many critical functions simultaneously, or shares infrastructure with several of your other vendors.
Think of it as the "all eggs in one basket" problem applied to enterprise operations. The basket may look sturdy. The problem is you didn't notice how many eggs were in it.
DORA's Article 3(29) defines ICT concentration risk as exposure from reliance on one provider — or a small number — where lack of substitutability could affect resilience or financial stability. The EBA frames it similarly: disruption risk arising when multiple functions are outsourced to the same or closely connected providers.
Both definitions focus on dependency patterns, not individual vendor performance.
Concentration risk also isn't always avoidable. Some markets have few viable alternatives for specialized services. The realistic objective is to know where the dependencies exist, govern them deliberately, and have a plan when substitution isn't an option.
The Four Types of Third-Party Concentration Risk
Vendor and Service Concentration
The most recognized form: over-reliance on a single third party for multiple critical services.
When one vendor supports your infrastructure, security monitoring, and disaster recovery, a single breach or insolvency doesn't disable one function. It disables all three simultaneously. The CDK Global cyberattack in 2024 illustrates this clearly: CDK served approximately 15,000 U.S. auto dealers, with a single incident disrupting dealer management systems across sales, inventory, and profitability tracking nationwide.
Two diagnostic questions boards should ask:
- If this vendor exits or fails, how many critical functions are simultaneously impacted?
- What is the realistic timeline and cost to replace them?
If the answers are "more than two" and "months to years," that's a concentration problem worth escalating.
Geographic Concentration
Geographic concentration is the clustering of key vendors, sub-suppliers, or operations within the same region. A natural disaster, power grid failure, or geopolitical disruption can affect all of them at once.
Taiwan's April 2024 earthquake — the largest in at least 25 years — forced TSMC to evacuate facilities and pause production, with estimated losses of approximately $92.4 million and broader supply chain disruptions across the semiconductor sector. The problem extends well beyond semiconductors: roughly 40% of global trade is concentrated, meaning importing economies rely on three or fewer nations for those products.
This risk is often invisible. Organizations see different vendor names on contracts without realizing all those vendors operate out of the same data centers or geographic zone.
Fourth-Party and Technological Concentration
Fourth-party concentration occurs when multiple vendors in your ecosystem depend on the same sub-provider — a DNS provider, cloud platform, or payment rail — creating a hidden shared point of failure.
An AWS outage in December 2021 simultaneously disrupted Netflix, Disney+, Robinhood, Chime, and Ring — seemingly independent services that shared one infrastructure dependency. That same year, a Fastly software bug took down the Financial Times, New York Times, and Bloomberg News together.
Technological concentration is related but distinct: when your organization and its vendors all run the same technology stack, a single vulnerability becomes enterprise-wide exposure. The 2017 WannaCry ransomware attack targeted unpatched Windows systems across thousands of organizations, including NHS England. Those victims had no direct relationship with each other. They simply shared the same underlying platform without consistent patch management.
The cloud market makes this concrete: the top five IaaS providers held 82.1% of the worldwide market in 2024, with Amazon alone at 37.7%. Most enterprise vendor ecosystems are, by default, deeply concentrated in a handful of infrastructure providers.
Industry and Customer Concentration
The demand side of concentration risk is less often addressed in TPRM discussions, but it belongs in the same conversation: over-reliance on a small number of customers or a single industry sector. A sector-specific regulatory shift, economic downturn, or major client departure can produce the same operational disruption as a vendor failure. The vector is different; the damage to operations is not.
A useful board-level diagnostic: if your top three customers represent more than 40% of revenue, or if a single industry accounts for the majority of your pipeline, that exposure belongs in the same risk register as vendor concentration.
Why Concentration Risk Stays Hidden Until It's Too Late
Three structural problems keep concentration risk invisible.
Siloed vendor assessments. Traditional TPRM evaluates vendors individually — security posture, compliance certifications, financial health. Two vendors can each pass every assessment while both depending on the same fourth-party sub-provider. No individual assessment surfaces that shared dependency.
The fourth-party visibility gap. Visibility into supplier risk extends to tier two or beyond for only 42% of surveyed supply chain leaders, according to McKinsey's 2025 supply chain risk survey. Without knowing which sub-contractors your vendors rely on, shared dependencies stay invisible until a disruption exposes them.
Basel's third-party risk principles explicitly identify nth-party dependencies — scenarios where multiple service providers share the same key sub-provider — as a distinct concentration risk category. Most programs never inventory it.
The related-entity blind spot. Organizations sometimes unknowingly award multiple contracts to subsidiaries of the same parent company, believing they have diverse vendor coverage. In reality, they're concentrated with one corporate family. Pre-onboarding due diligence that checks corporate ownership structures is a necessary control — but it's frequently skipped when procurement moves quickly.
Together, these gaps mean concentration risk rarely appears on a dashboard. It shows up in the incident debrief — after the damage is done.
What's Actually at Stake: The Business and Regulatory Impact
The Business Consequences
When concentration risk materializes, the damage spans four categories:
- Operational disruption — production halts, service delivery failures, inability to serve customers
- Financial losses — emergency migration costs, lost revenue, contract penalties
- Reputational damage — customer trust erosion, media exposure, investor scrutiny
- Legal liability — regulatory fines, breach of fiduciary duty claims, data exposure litigation
The Change Healthcare cyberattack in 2024 provides the clearest financial benchmark available. UnitedHealth reported $2.2 billion in direct response costs, $867 million in Optum Insight business disruption impacts, and issued more than $9 billion in interest-free loans to care providers who lost payment processing access.
One concentration point — a single technology unit processing a third of U.S. medical claims — produced system-wide damage across the entire healthcare payment ecosystem.
That scale of cascading damage is precisely what drove regulators to sharpen their requirements.
What Regulators Now Require
Regulatory expectations have moved well past general vendor oversight guidance:
- OCC (2023 Interagency Guidance): Directs banking organizations to consider concentration risk explicitly across the entire third-party relationship lifecycle — due diligence, contract terms, ongoing monitoring, and termination planning
- FFIEC (Appendix J): States that increasing use of third-party technology service providers and industry consolidation raises concentration risk, such that a disruption at one provider can affect critical services across many institutions
- DORA (EU, 2022): Three articles create specific obligations:
- Article 29 — preliminary assessment of ICT concentration risk, including substitutability and over-reliance
- Article 28 — exit strategies for services supporting critical functions
- Article 31 — formal designation of critical ICT third-party providers
The board accountability dimension has sharpened as regulators tightened their expectations. The Federal Reserve states that a banking organization's board of directors has ultimate responsibility for oversight of third-party risk management. The NACD's 2026 Cyber Risk Oversight handbook extends that expectation to fourth-party dependencies, directing directors to ask how management identifies critical upstream relationships.
Boards that cannot answer "If our top three critical vendors fail simultaneously, what is our exposure and recovery plan?" have a governance gap — and examiners are now trained to ask exactly that question.
A Governance-First Approach: How Boards and Executives Should Address Concentration Risk
Step 1 — Build the Inventory
You cannot govern what you cannot see. Maintain a complete critical third-party register that captures:
- Vendor names and services provided
- Number of critical functions per vendor
- Geographic location and data center region
- Fourth-party dependencies (key sub-providers)
- Technology platform dependencies
This isn't a one-time exercise. The register requires ongoing updates as vendors are onboarded, contracts amended, and sub-providers changed.
Step 2 — Score Concentration Into Risk Tiering
Risk-tier vendors not only on individual compliance and security posture, but on portfolio-level concentration. Strong tiering criteria for concentration include:
- How many credible alternatives exist, and what would replacement realistically cost?
- How many critical business functions does this vendor support simultaneously?
- Do multiple vendors in your ecosystem share the same sub-provider?
- Are multiple vendors operating from the same region or data center?
Vendors that score high on concentration should carry higher inherent risk ratings regardless of their individual security posture. A vendor with clean certifications and no substitutes is still a concentration problem.
Step 3 — Set Concentration Thresholds and Escalation Triggers
Define explicit thresholds that trigger board-level escalation. Examples:
- No single vendor responsible for more than a defined percentage of critical functions
- No geographic region representing more than a defined share of key operations
- Any vendor with no viable substitute automatically escalates to board review
These thresholds belong in policy documents, not in someone's head. Review them at least annually and test them against your current vendor portfolio — otherwise they become stale benchmarks that no longer reflect actual exposure.
Step 4 — Develop and Test Exit and Contingency Plans
For every high-concentration relationship, maintain a tested exit plan — not just a documented one. Testing should validate:
- Data portability and format compatibility
- Realistic transition timelines with named milestones
- Licensing contingencies for proprietary platforms
- Communications protocols for customers, regulators, and internal stakeholders
Treat exit drills like fire drills: regular, scenario-based, and documented. An untested plan tells you what you intend to do. A practiced one tells you what you can actually do — and where the gaps are.
Step 5 — Establish Board-Level Reporting and Decision Rights
Boards need a stable dashboard that shows concentration trends, not incident-by-incident vendor trivia. Effective board-level reporting on concentration risk answers three questions:
- Where are our highest concentrations right now?
- Have any thresholds been breached since last review?
- What remediation is in progress, with named owners and target dates?
The reporting format Tyson Martin uses with boards fits in one to two pages: a dashboard showing exposure, trend, and decision points; supporting evidence; and a decision-requested section with options and a recommended path. It shows the top vendors by business impact and flags single points of failure with mitigation status alongside each.
Organizations without in-house CISO capacity to build these frameworks work with Tyson Martin to establish inspectable risk governance structures that hold under regulatory scrutiny and produce clear decisions without slowing operations.
Frequently Asked Questions
Frequently Asked Questions
What does third-party risk mean?
Third-party risk is the exposure an organization faces from external vendors, suppliers, and partners. It spans operational, financial, reputational, compliance, and cybersecurity risks that originate outside direct control — including those introduced by vendors' own sub-contractors and technology dependencies.
What is an example of concentration risk?
A financial institution that relies on a single cloud provider for both core banking and disaster recovery faces concentration risk. A regional outage at that provider simultaneously disables primary operations and the backup plan — the exact scenario where backup infrastructure was intended to prevent total failure.
What are the four types of third-party concentration risk?
The four types are:
- Vendor/service concentration — one vendor supporting multiple critical functions
- Geographic concentration — suppliers clustered in the same region
- Fourth-party/technological concentration — multiple vendors sharing the same sub-provider or platform
- Industry/customer concentration — over-reliance on a single sector or client base
How is concentration risk different from general third-party risk?
General third-party risk asks whether an individual vendor is secure and reliable. Concentration risk is a portfolio-level question: are you over-reliant on a vendor, region, or platform in a way that creates a systemic single point of failure? A vendor can be individually low-risk while still representing high concentration risk.
What questions should a board ask about third-party concentration risk?
Three questions boards should ask: Which vendors currently support multiple critical functions simultaneously? What is our largest geographic concentration of key suppliers? Have our exit plans for high-concentration vendors been tested in the past 12 months?
Is third-party concentration risk a regulatory concern?
Yes. The OCC, FFIEC, and the EU's DORA framework all require financial institutions to identify, assess, and govern third-party concentration risk. Boards — not just management — must demonstrate active oversight, including tested exit plans and documented escalation thresholds.
