Post-CrowdStrike, everyone's instinct is to diversify vendor concentrations.
That instinct has costs nobody's calculating.
Vendor concentration works like an investment portfolio. Diversification reduces risk — until it doesn't. Over-diversify and you're paying transaction costs, losing returns, and creating complexity that becomes its own risk.
Same with vendors.
Over-Concentration: The Risk Everyone Talks About
One critical vendor handles most of your outsourcing. They fail or get breached — material impact across the institution. No fallback, no leverage, complete dependency.
CrowdStrike made this real for a lot of banks this year.
Under-Concentration: The Risk Nobody Talks About
20 vendors doing 20 things that could be 5 vendors doing 20 things. Now you've got integration complexity between systems that don't talk to each other. Data silos across platforms. No vendor owning problems end-to-end. 20 contracts, 20 renewals, 20 relationship managers. More surface area, not less risk.
Fourth-Party Concentration: The Risk You Can't See
Your vendors look diversified. But half of them use the same cloud provider, the same payroll processor, the same authentication service. One fourth-party incident ripples across your "diversified" portfolio.
You didn't reduce concentration. You just hid it one layer down.
The Optimization Problem
The optimization isn't "minimize concentration." It's finding the right balance for your risk appetite.
"Concentration risk isn't a dial you turn to zero. It's a portfolio you manage."
Questions That Actually Matter
- Which vendors could cause material harm if they failed tomorrow?
- Where does apparent diversification mask shared dependencies?
- What's the real cost of fragmentation you're tolerating to avoid concentration?
The answer isn't always "add more vendors." Sometimes it's consolidation. Sometimes it's mapping fourth-party dependencies you didn't know existed. Sometimes it's accepting measured concentration where the alternative is worse.
Managing the Portfolio
Like any portfolio, vendor concentration requires active management. You need visibility into direct and indirect dependencies, clear understanding of your tolerance for concentration at different criticality levels, and honest assessment of whether fragmentation is helping or hurting.
The instinct to diversify isn't wrong. But it's incomplete. The goal is optimization, not minimization.