In July 2024, a faulty CrowdStrike update affected 8.5 million Windows devices worldwide. Airlines stopped flying. Hospitals rescheduled surgeries. Banks closed branches. It was not a cyberattack. It was a routine update from a single security vendor with privileged kernel access on millions of machines.
That event should have been a wake-up call for every board in the world. Technology concentration is not just an operational efficiency matter: it is a strategic risk that can paralyze entire organizations in hours.
The concentration map
As documented in our research on technology concentration and global dependency:
- Public cloud: Three providers (AWS, Azure, Google Cloud) hold over 65% of global cloud infrastructure market.
- Desktop operating systems: Windows holds over 72% of the corporate market in LATAM.
- Endpoint security: CrowdStrike showed that a single kernel-level agent on millions of devices becomes a single point of failure.
- Semiconductors: TSMC manufactures over 50% of the world's advanced chips.
Why it is a strategic risk
- Massive availability risk: When your critical infrastructure depends on a single provider, their failure is your failure.
- Regulatory and geopolitical risk: US-China tensions are redefining technology supply chains.
- Data sovereignty risk: When your critical data sits in foreign-jurisdiction servers (CLOUD Act), your organization is exposed to decisions it does not control.
What boards should be discussing
- What is our concentration index per critical provider?
- Do we have a documented and tested exit strategy?
- Do we assess the geopolitical risk of our providers?
- Do our contracts include portability and continuity clauses?
- Do we include technology concentration in our strategic risk management map?
It is not paranoia, it is governance
Diversifying does not mean rejecting major providers. It means being conscious of the dependency risk and making informed decisions. What is not acceptable is a board unaware that 85% of its critical infrastructure depends on a single provider under a jurisdiction that can change rules without notice.
The first step is mapping existing dependency. A technology concentration analysis shows where single points of failure are and enables data-driven decisions.