The risk associated with dependence on a particular cloud provider for multiple business capabilities is in the top five emerging risks for organizations for the second consecutive quarter, according to a survey by Gartner, Inc.
In September 2023, Gartner surveyed 294 risk executives about their views on emerging risk or over-the-horizon risks. The Gartner 3Q23 Emerging Risk Report contains detailed information on the possible impact, time frame, level of attention, perceived opportunities and more for 20 emerging risks.
The risk associated with cloud concentration is fast losing its ‘emerging’ status as it is becoming a widely recognized risk for most enterprises. Many organizations are now in a position where they would face severe disruption in the event of the failure of a single provider.
Ran Xu, director, research, the Gartner Legal Risk & Compliance Practice.
Third party viability and mass generative AI availability both make the top five for a second consecutive quarter as well, with third-party viability topping the list on both occasions.
The top five emerging risks for 3Q23 (by frequency)
| Risk name | Frequency (%) |
| Third-Party Viability | 73 |
| Evolving Sociopolitical Expectations | 69 |
| Mass Generative AI Availability | 68 |
| Cloud Concentration Risk | 62 |
| Personal Data Regulatory Fragmentation | 59 |
Cloud concentration risk
Cloud concentration risk has come about because many organizations have opted to focus their IT efforts on a handful of strategic providers in order to reduce IT complexity, and therefore also risk, cost and skill requirements. Compounding the problem, a handful of hyperscale vendors dominate global and regional markets with superior technical capabilities, business reach and partner ecosystems.
There are three main potential consequences of this risk, according to Gartner experts:
Wide incident ‘blast radius’
The more applications (and business processes) depend on a particular cloud provider, the greater the potential breadth of impact of a cloud service issue, which may heighten business continuity concerns.
High vendor dependence
Concentrated dependency on a particular vendor can reduce future technology options and allow vendors to exert significant influence over the organization’s technology future.
Regulatory compliance failures
Organizations may be unable to meet regulatory demands to address concentration risk across different regulatory bodies, which may have different approaches to concentration risk.
