Most organizations have a plan for what happens when a key supplier goes down. But what happens when your backup supplier depends on the exact same resources that failed in the first place? That is concentration risk and it can be surprisingly easy to miss. It is unpriced on most balance sheets, and in three of the four industries below, it has already produced real losses.
A banana plantation in Ecuador, a hospital in Boston, a Ford assembly plant in Chicago, and every data center under construction in the United States. Each depends on something it does not control and never listed. They all show what can happen when an entire system becomes dependent on a single product, supplier, location or resource.
Essentially every banana in world trade is a Cavendish, and every Cavendish is a genetic clone of every other. In December 2025, Ecuador confirmed the presence of Fusarium wilt Tropical Race 4, or TR4, in a banana-producing area and declared a plant-health emergency. A second case was confirmed in July 2026. There is currently no fungicide that can eliminate the disease and no widely accepted resistant replacement for the Cavendish.
One shared characteristic creates a vulnerability across an entire industry.
Before Hurricane Helene, Baxter's North Carolina facility produced roughly 60 percent of the IV solutions used in the United States, or about 1.5 million bags each day. Then the hurricane flooded the facility in September 2024. Hospitals across the country suddenly had to conserve supplies. Mass General Brigham postponed some non-emergency procedures requiring IV fluids. The FDA also authorized temporary imports and took other steps to increase supply. Baxter ultimately restored pre-hurricane production capacity in February 2025.
The problem wasn't simply that a factory flooded. It was that so much of the health care system depended on that one factory.
In April 2025, China imposed new export controls on several rare earth elements. The effects quickly reached auto manufacturers thousands of miles away. The following month, Ford temporarily stopped production at one of its plants because it could not get the rare earth materials it needed. Other manufacturers and suppliers faced similar disruptions. Ford didn't need to have a problem inside its own factory to stop production. A dependency much farther down the supply chain was enough.
Semiconductors offer another example, but this time the concern is about what could happen rather than an interruption that has already occurred. According to Counterpoint Research, Taiwan Semiconductor Manufacturing Company (TSMC), the world's largest dedicated semiconductor foundry, accounted for 73 percent of the global pure-play foundry market in the second quarter of 2026.
But look another level down the supply chain.
The most advanced chip factories rely on extreme ultraviolet lithography equipment produced by Dutch multinational corporation ASML. ASML, in turn, identifies Carl Zeiss SMT, the Semiconductor Manufacturing Technology business group of ZEISS, as its single supplier for the optical columns used in its lithography systems. In its annual report, ASML describes the relationship plainly: Carl Zeiss SMT is ASML's single supplier, and ASML is its single customer, for these components.
That is the important lesson.
A company may appear to have multiple suppliers or options, but those suppliers can still share the same underlying dependency.
Put these examples next to each other and a pattern emerges. The banana producer, hospital, automaker and semiconductor company all operate in completely different environments. But each can be affected by something outside its direct control because a critical part of its system has become concentrated in one place.
And concentration isn't always obvious. Your organization may have three vendors, but all three could rely on the same manufacturer. You may have two technology providers, but both could run on the same cloud platform. You may have backup suppliers, but they could all rely on the same country, port, raw material or piece of equipment.
The question isn't just, "Do we have a backup?" It's "Does our backup depend on the same thing?"
We made a narrow version of this argument two weeks ago about shared cyber defenses, where the efficiency of a common playbook is also a correlation nobody underwrote. It is not a cyber problem. It is the same problem a town runs when one data-center tenant funds its tax base, one level further down the same chain.
Most continuity plans are built around an operational failure such as a fire, flood or equipment breakdown.
But a critical dependency can disappear in several ways:
That means continuity planning needs to look beyond the question, "What if this supplier goes down?" It should also ask, "What could make this resource unavailable to everyone who depends on it?"
You don't need a complicated model to start finding concentration risk.
Start with three questions:
If your organization cannot answer those questions, that's useful information in itself. Concentration isn't automatically bad. Sometimes relying heavily on one supplier is the most practical or economical choice. The important part is knowing that you made that choice.
RiskVersity's Vendor Risk Management and Fractional CRO services help organizations identify those dependencies, understand how long they could withstand an interruption, and decide which risks need to be reduced, transferred or consciously accepted.
For municipalities evaluating data-center projects, RiskVersity also offers a free, no-form-required checklist: Risk terms every municipality should demand in a data-center agreement.
Corporate Office
1435 Vine Street, Suite 326
Cincinnati, Ohio 45202
513-644-1085
Charlotte Office
525 N Tryon Street, Suite 1600
Charlotte, NC 28202