Strategic Risk Snapshot #14
Strategic Risk Snapshot provides focused insights into emerging geopolitical, regulatory and security developments shaping today’s global risk landscape.
Prepared by The Mentors, each edition highlights early signals and trends that may carry strategic implications for organisations operating in complex and high-risk environments.
The Dependency Trap: Why Resilience Can Create New Vulnerabilities
Resilience has become a strategic priority. But every new supplier, platform, partner or backup system can also create another dependency. The challenge is not simply to build more resilience, but to understand where resilience itself can introduce new vulnerabilities.
The Resilience Paradox
Organisations are under growing pressure to become more resilient.
They diversify suppliers, add backup systems, develop alternative logistics routes, move to multiple technology platforms and build contingency arrangements.
These measures can reduce exposure to a single point of failure.
But they can also introduce something less visible: more dependencies.
Every additional supplier requires oversight. Every new technology creates integration requirements. Every external partner introduces another relationship that must be managed.
Resilience can therefore reduce one type of risk while creating another.
More Options, More Complexity
Diversification is often treated as an automatic improvement in resilience.
But having more options does not necessarily mean having greater control.
A company operating across multiple suppliers, jurisdictions and technology platforms may be less dependent on any single provider, but more dependent on the systems that connect them.
Data has to move between platforms. Contracts have to remain aligned. Standards have to be compatible. Information has to be shared across organisational boundaries.
As complexity increases, so does the possibility that a disruption in one part of the system will create unexpected consequences elsewhere.
The question is not how many alternatives exist, but how independently they can operate when the system comes under stress.
Hidden Dependencies
Some of the most important dependencies are not immediately visible.
A company may have several suppliers but discover that they all depend on the same raw material.
Several technology platforms may ultimately rely on the same cloud infrastructure.
Multiple logistics routes may pass through the same strategic chokepoint.
Different organisations may appear independent while relying on the same financial, digital or communications infrastructure.
These hidden connections can create concentration risk beneath apparent diversification.
A system can therefore look resilient on the surface while remaining vulnerable underneath.
The Third – Party Problem
External partners can increase capability while simultaneously increasing exposure.
Outsourcing technology, logistics, data management, cybersecurity or critical services may improve efficiency and flexibility.
But it also means that an organisation’s resilience partly depends on the resilience of others.
This creates a difficult question:
How much of your organisation’s risk is actually outside your organisation?
Understanding that exposure requires more than traditional supplier due diligence.
It requires mapping critical dependencies and identifying which external failures could materially affect strategic objectives.
When Redundancy Becomes Complexity
Redundancy remains an important component of resilience.
But redundancy is not free.
Additional systems require investment, maintenance, testing and coordination. Backup arrangements that are never exercised may fail when they are needed most.
Too much complexity can also make decision-making slower during a crisis.
The objective should therefore not be to create endless layers of backup.
It should be to identify the critical dependencies where redundancy genuinely preserves strategic choice.
What Decision – Makers Should Watch
Several indicators can reveal that resilience measures are creating new vulnerabilities:
- Increasing reliance on third-party providers for critical functions
- Multiple suppliers or platforms sharing the same underlying infrastructure
- Growing complexity across technology, logistics or operational systems
- Contingency arrangements that have never been tested
- Limited visibility beyond direct suppliers and partners
- Critical functions that cannot operate independently for a meaningful period
- Recovery plans that depend on the same systems or providers as the primary operation
- Increasing difficulty in identifying who owns a risk across organisational boundaries
These signals do not necessarily mean that a resilience strategy is failing.
They may indicate that the organisation needs to look one level deeper.
Resilience depends not only on where you have alternatives, but on where those alternatives remain independent.
Strategic Takeaway
Resilience is not simply about having more suppliers, more systems or more options.
It is about understanding which dependencies are critical, which can fail independently, and which cannot be allowed to fail at the same time.
The organisations best positioned for disruption are not necessarily those with the most redundancy.
They are those that understand the architecture of their dependencies and know where a failure could cascade.
The critical question is therefore not:
“How many alternatives do we have?”
It is:
“How many of those alternatives would still work if the same underlying dependency failed?”
Strategic Risk Snapshot No. 14
The Dependency Trap: Why Resilience Can Create New Vulnerabilities
The Mentors | Strategic Risk & Crisis Management
