Everyone shares the same vendors
The number of supplier breaches matters less than how few suppliers there are. Concentration is what turns an incident into a sector event.
Denny Müller via UnsplashThird-party risk programmes count suppliers. The number that actually predicts a bad week is how many organisations depend on the same one, and by that measure the picture is considerably worse than the questionnaires suggest.
Analysis of the supplier landscape makes the point directly: concentration rather than breach volume is the driver of cascading failure, because a small set of vendors sits underneath a very large share of major companies.
The clearest demonstrations were not attacks at all. A faulty update to a widely deployed endpoint agent, and separately large cloud and network provider outages, took down unrelated businesses simultaneously without anyone being targeted.
That is the property worth internalising. Concentration converts a routine failure into a systemic one, and it does so regardless of whether the cause was malicious, which means security controls are not the mitigation.
The reason it persists is that concentration is individually rational. Buying the market-leading provider is the defensible choice for any single organisation, and every organisation making that defensible choice produces the aggregate exposure.
Diversifying is expensive and often illusory. A second supplier that runs on the same cloud region, uses the same identity provider or ships the same underlying library is a different logo attached to the same dependency.
Which is why the more useful question is not who the vendor is but what happens without them. An organisation that can state how long it can operate with a given supplier offline knows something a vendor questionnaire will never tell it.
Regulators have started asking that question in financial services, where operational resilience rules require firms to identify important business services and set tolerances for disruption. The rest of the economy has no equivalent.
The practical work is unglamorous and mostly not technical. Knowing which suppliers touch which processes, testing the manual fallback, and accepting that some dependencies cannot be removed and must be planned around instead.
The uncomfortable conclusion is that a well-run programme does not reduce this risk much. It documents it accurately, which at least means the failure is anticipated rather than discovered.