A four-week plan to tackle vendor concentration risk

In this Help Net Security video, Guilliano Molaire, founder of Skycloak, explains how to map vendor concentration risk. A company may pay 30 vendors and think its tools are spread out, but many of those vendors run on the same few providers underneath, such as one cloud, one identity provider, one DNS service, one email provider, one payment processor, or one AI model provider. When one of those goes down, more of the business breaks than the contracts suggest.

Molaire walks through a four-step mapping exercise using a fictional 200-person company, from listing direct vendors to narrowing them down to about five choke points.

He covers warning signs to watch for, questions to ask vendors, and contract terms around exit help, data portability, and SLAs. He also discusses architecture steps like standard protocols, export drills, and backup identity paths, and closes with a four-week plan teams can start on Monday.

Download: The IT leader’s guide to AI code sprawl