Having multiple suppliers can create a comforting illusion of resilience.
Different contracts. Different account managers. Different logos.
But what if all three suppliers rely on the same cloud provider, payments processor, manufacturer, logistics hub or specialist sub-contractor?
Then you may not have three suppliers at all.
You may have one dependency wearing three different outfits.
That is the bit that interests me.
Most organisations are reasonably good at asking: Who do we depend on?
Fewer ask: Who do they depend on?
And that is often where concentration risk is hiding.
A supplier register might show diversity at the contractual level while the underlying infrastructure is highly concentrated.
The same data centre region.
The same power grid.
The same software platform.
The same manufacturer.
The same port.
So resilience is not just about having alternatives.
It is about whether those alternatives fail differently.
A backup supplier that disappears during the same outage, cyberattack or supply shock as your primary supplier is not much of a backup.
Different vendors do not necessarily mean different dependencies.
The company that eventually takes you offline may be one you have never contracted with, or even heard of.
So pick three services your organisation genuinely cannot function without.
Then go one layer deeper to examine: What sits underneath them?
