Glossary
What Is Concentration Risk?
Concentration risk is the danger that too much of an organisation's infrastructure depends on a single provider, network, or facility — so one outage or compromise cascades across everything at once. DORA (Art. 28–30) now requires firms to analyse ICT concentration and hold exit strategies for it.
Why one provider is a risk
Resilience comes from diversity. When forty subdomains all resolve into the same two networks, or a region's traffic all lands at one facility, the footprint looks busy but rests on a single point of failure. The day that provider has an outage — or a route hijack — everything downstream goes with it.
How you measure it
Count the distinct dependencies behind a footprint, not the assets in front of it. Resolve every subdomain to the networks announcing its IPs and tally the unique ASNs; trace a network to the datacenters it sits in. Low diversity is high concentration. Done across a pre-joined graph, this is one query instead of dozens of manual lookups.
Why regulators care
Financial regulation now treats concentration as systemic. DORA Articles 28–30 require firms to assess ICT third-party concentration risk and plan exits; NIS2 pushes the same diligence across critical sectors. The analysis they ask for is exactly the cross-layer join — DNS to routing to physical — that flat tools cannot make.
Where this shows up
See it in a live investigation: Map an org’s infrastructure concentration risk.
Go hands-on with the compliance recipes.
Workflows that use this
Runnable workflows where this concept does the work.