The dependency dilemma: AI, concentration risk and resilience

For the greatest own-business or portfolio resilience gap, technology dependency led at 28%, followed by funding or capital-market shock at 20% and customer or revenue concentration at 13%. The complete answer space also includes regulatory, cyber, talent, infrastructure, and physical-risk concerns, as well as no major gap and Other.

The technology-dependency options differ. The own-business or portfolio question includes platforms and critical vendors, permits only one choice, and specifies a three-year horizon. The general-risk question allows several concerns. Their percentages should not be pooled, subtracted as a change measure, or read as probabilities of loss.

Widely available capability and provider reliance can coexist

A direct pairing makes the tension concrete. Of the 24 respondents who selected access to AI models or tooling as a weakening source of advantage, nine (38%) also selected reliance on a single AI model, cloud, or infrastructure provider as an underappreciated risk. Among the other 40 respondents, 11 (28%) selected that risk. Some respondents therefore saw both limited differentiation from access and a risk in dependence on a provider.

This pairing shows coexistence, not a strong relationship: the questions do not identify whether respondents had the same technology or provider in mind. Strategically, the useful point is that a capability can be widely available and still be operationally important. Azoulay, Krieger, and Nagaraj separately argue that control of complementary assets may shape entry and concentration in generative AI.  That external argument provides context; it does not verify a mechanism in these answers.

Within-submission reading of Questions 6 and 10. Single-provider risk: 9/24 (37.5%) among AI-access-erosion selectors versus 11/40 (27.5%) among others. Different question frames; descriptive pairing, not a causal estimate.

What does the business rely on, not just what makes it distinctive?

Together, these responses suggest a broader management question: what does the business rely on, not just what makes it distinctive? A company can adapt quickly and still be vulnerable to a funding shock, concentration in a major customer, dependence on one technology provider, or a regulatory or cybersecurity event. Our survey does not establish causal relationships among those vulnerabilities, but it makes clear that defensibility and resilience extend beyond learning speed.

No single risk commanded a majority, and our survey did not test which mitigations work. The value of these questions is to surface vulnerabilities that leaders may want to examine alongside the sources of advantage.

Why an interesting comparison did not become a headline

Some apparently interesting subgroup differences became much smaller when we checked whether one group simply tended to select more options. This can happen mechanically: if Group A usually ticks three boxes in a multi-select question while Group B usually ticks only one, almost any individual option has more opportunities to appear in Group A.

In one exploratory comparison concerning the faster-replication threat, the raw difference between two groups was 17.9 percentage points. After re-expressing the comparison so that both groups had the same mix of respondents selecting one, two, or three-or-more options, the difference fell to 2.3 percentage points. Because the contrast largely disappeared under that check, we did not promote it as a headline finding.

In plain language, we asked whether the gap still looked roughly the same once both groups were given the same mix of response patterns. In this example, it did not. That does not prove response behavior caused the original difference or remove every other difference between the groups; it does show why an arithmetically correct contrast may still be too fragile to build a public story around.