Dive Brief:

• Cloud concentration risk has become an increasing concern for organizations as many of them have focused their IT efforts on a small number of strategic providers, according to research from Gartner.
• Cloud concentration risk refers to an organization’s over-reliance on one cloud service provider. Adding to the complexity of the problem, organizations are facing sometimes conflicting regulatory demands from agencies requiring them to address the risk.
• Roughly 62% of risk executives listed cloud concentration as one of their leading risks when surveyed during Q3 2023, a Gartner press release said. Other leading risks include third-party viability and the mass availability of generative AI. 

Dive Insight:

Gartner suggests that cloud concentration risk has increased because a large number of organizations have sought to reduce IT complexity, as well as associated cost and skill requirements.

Additionally, a small number of large vendors “dominate global and regional markets with superior technical capabilities, business reach and partner ecosystems,” the research firm said.

“Concentrated dependency on a particular vendor can reduce future technology options and allow vendors to exert significant influence over the organization's technology future,” Gartner said.

The research firm noted that the greater number of applications and business processes that depend on a particular cloud provider, the increased potential scale of a cloud service issue. This possibility can heighten business continuity concerns.

Regulations both at the country and sub-national level also vary on anti-competition, data sovereignty and privacy rules concerning cloud services, which can create compliance challenges for businesses. 

Overall, depending on a particular cloud provider for multiple business capabilities ranked in the top five emerging risks for organizations for the second consecutive quarter in Q3 2023, Gartner found. 

“The risk associated with cloud concentration is fast losing its ‘emerging’ status as it is becoming a widely recognized risk for most enterprises,” said Ran Xu, director, research in Gartner’s Legal, Risk & Compliance Practice. “Many organizations are now in a position where they would face severe disruption in the event of the failure of a single provider.”

The Gartner research was based on a survey of 294 risk executives.