Fourth-party risk

Your suppliers have suppliers, and concentration frequently hides one layer down.

Three vendors with no apparent relationship may all run on the same platform, use the same authentication provider or depend on the same small library. Assessing each individually shows diversity; the actual dependency is shared. The question worth asking a supplier is what they depend on.