Why does substitutability matter more than vendor count in concentration risk?

Why vendor count can mislead concentration risk assessments

concentration risk is about whether a disruption in one place can take down the capability you rely on, not how many names appear in a procurement list. A portfolio with several vendors can still be effectively single-threaded if they all depend on the same platform, credential, integration pattern, or operational team. The right question is whether loss of one supplier changes continuity in practice.

That distinction matters because vendor count measures diversity of contracts, while concentration risk measures diversity of recovery options. Two suppliers that require the same proprietary workflow, the same data export path, or the same scarce expertise are not meaningfully substitutable. In that case, the organisation has multiple commercial relationships but one fragile delivery model.

Substitutability also captures time and effort. A truly substitutable dependency can be moved, rerouted, or rebuilt with manageable delay and acceptable degradation. If switching requires a redesign, manual workarounds, or a long revalidation cycle, the dependency is concentrated even when the sourcing strategy looks broad on paper.

What substitutability actually tests

Substitutability asks whether another provider can take over the function without a material rebuild. That includes data portability, interface compatibility, operational runbooks, access handover, and any controls that must survive the transition. The concept is practical: if replacement is technically possible but operationally unrealistic, the risk remains concentrated.

It also exposes hidden common modes. Different vendors may share the same cloud region, the same downstream identity provider, the same software component, or the same managed service. Those shared dependencies collapse apparent diversity. In concentration analysis, shared failure domains matter more than the number of invoices or logos.

For that reason, substitutability is a stronger indicator than vendor count when evaluating whether the organisation can absorb a shock. It tells you whether resilience exists at the capability level, not just the supplier level.

How to judge concentration by recovery reality, not supplier count

The most useful test is whether the service can be restored on another platform within the organisation’s acceptable recovery window. If the answer depends on a rebuild, custom reengineering, or prolonged exception handling, then the current arrangement has a concentration problem even if multiple suppliers are available.

Look for evidence of real portability: standard data export, documented migration steps, tested failover, replaceable integrations, and access patterns that do not lock the service into a single provider. If those elements are absent, “multi-vendor” often just means “multi-contract,” which offers little comfort during a disruption.

That is why concentration reviews should focus on replacement feasibility, not procurement breadth. A small number of highly substitutable providers can be less risky than a larger set of mutually dependent ones.

Risk and Threat Considerations

Weak substitutability creates a single point of failure that attackers, outages, or supplier disruptions can exploit. If one dependency is hard to replace, compromise or unavailability in that layer can cascade into business interruption, recovery delays, and prolonged exposure while teams try to reconstitute the capability elsewhere.

Failure mechanism: Organisations misread vendor diversity as resilience, then discover that common architecture, shared integrations, or proprietary dependencies prevent rapid substitution when the primary provider fails or is compromised.

Impact: Recovery time expands, contingency options narrow, and the same failure can affect multiple apparently independent suppliers at once, turning a supplier event into a service outage or control failure.

Practitioner Guidance

What to prioritise: Map each critical function to its actual recovery path, not its supplier list. The key question is whether another platform can assume the function inside the business’s tolerated interruption window without a redesign.

What to verify: Test portability evidence, including export formats, integration dependencies, access transfer, and whether a failover or migration has been exercised rather than assumed. If the transition has never been rehearsed, treat substitutability as unproven.

Common mistake: Treating procurement diversity as risk reduction even when the service still depends on one technical stack, one credential path, or one niche operator skill set. That creates a false sense of resilience.

Practitioner takeaway: Concentration risk is reduced by credible replacement options, not by the number of suppliers on the spreadsheet.

Related resources from NHI Mgmt Group

• Why do non-human identities create more audit risk than human accounts?
• Why do non-human identities create audit risk in modern environments?
• Why do non-human identities create compliance risk even when policies exist?
• Why do collaboration tools create such a large secrets risk?