Concentration risk: the number nobody has counted

Ask a security lead how many vendors they have and you get an exact number. Ask what share of their supply chain ultimately runs on one cloud provider and you get an estimate, delivered with a shrug. The first number is on a spreadsheet. The second requires a graph.

What concentration means here

For each major provider, the share of your chain that terminates at it. Not how many of your vendors use it directly — how much of everything beneath your vendors ends up there once the walk is complete. A vendor that looks independent at depth 1 frequently resolves into the same three companies at depth 3.

We compute it per watched root and then average across the roots you watch, so a provider that ends the chain under every one of your vendors scores near 1 and one that ends a single branch of a single vendor scores low. The count of roots travels with the number, because "0.4 across twenty vendors" and "0.4 across one" are different facts and a single percentage hides the difference.

Why it matters more than the vendor count

Vendor count is a procurement metric. Concentration is a blast-radius metric. Twenty vendors that all terminate at one provider is a smaller list and a larger single point of failure than eight vendors spread across four.

It also changes what a mitigation is worth. Replacing a vendor whose chain is 90 percent shared with its replacement moves your exposure almost not at all, and that is knowable before the migration rather than after it.

Reading it honestly

Concentration is computed over the part of the graph we resolved, so it has to be read next to coverage. If half the chain is not_yet_crawled, the concentration figure describes the half we can see. We show both numbers on the same screen for that reason, and we would rather publish a coverage figure that embarrasses us than a concentration figure that misleads you.

The public company pages carry the same pair. Pick any company in the directory and the coverage bar and the top terminal providers sit beside each other.