Supplier Concentration Risk: How to Identify Single-Source Vulnerabilities
Direct answer: Supplier concentration risk exists when a company depends on one or a few suppliers for a critical input. Investors assess it by reading 10-K risk factor disclosures, examining gross margin trends after supply disruptions, and identifying where single-source relationships create asymmetric bargaining power. High concentration can be a moat (the supplier) or a vulnerability (the buyer).
What Is Supplier Concentration Risk?
Supplier concentration risk describes the degree to which a company's operations depend on a small number of suppliers for critical inputs. When a single supplier accounts for a large share of a company's purchased inputs, any disruption to that supplier creates an outsized impact on production, cost, and ultimately earnings.
The risk is not limited to outright supplier failure. It extends to pricing negotiations (a sole-source supplier can demand higher prices at contract renewal), geopolitical risk (a supplier in a single country is exposed to that country's policy environment), and capacity constraints (a supplier that serves multiple customers may allocate scarce capacity to higher-margin buyers first).
From an investment standpoint, concentration risk shows up differently depending on which side of the relationship you are analyzing. If you own shares in the supplier, concentration is often a sign of market power. If you own the buyer, it can represent a fragile operating model that has not been fully priced into the stock.
How to Read 10-K Risk Factors for Supply Chain Exposure
The SEC requires public companies to disclose material risks in their annual 10-K filings, and supply chain concentration is among the most common risk factors cited in manufacturing, technology, and consumer goods industries. The standard disclosure threshold for customer concentration is 10% of revenues: if a single customer accounts for at least 10% of a company's revenue, that customer must be named or the relationship disclosed.
A similar convention applies on the supplier side, though the language varies. Typical phrasing includes "we rely on a single or limited number of suppliers for certain critical components," followed by a description of what would happen if that supplier were unable to deliver. The risk factor section rarely quantifies the exposure precisely, but the specificity of the language is itself informative: a company that names the supplier and describes the product category is more transparent about its vulnerability than one that uses vague boilerplate.
Apple (AAPL) and Taiwan Semiconductor Manufacturing (TSM) present a well-studied example of mutual concentration. Apple relies almost exclusively on TSMC for the advanced logic chips (A-series and M-series processors) that power its products. Apple's 10-K risk factors have consistently noted geographic concentration in its supply chain, referencing Taiwan without always naming TSMC explicitly. TSMC, in turn, has disclosed Apple as its largest customer, representing roughly 25% of consolidated revenues. Each company's 10-K contains material risk factors that are mirror images of the other's.
The Boeing (BA) and Spirit AeroSystems (SPR) relationship provided another case study until Spirit's reacquisition. Spirit manufactured a majority of Boeing's 737 fuselages under a long-term supply agreement. When Spirit encountered quality control problems in 2024, the concentration of fuselage supply with a single vendor created a direct production constraint at Boeing that could not be resolved quickly. Boeing's risk factors had disclosed Spirit as a significant supplier; analysts who read those disclosures carefully were not surprised when quality issues translated into production line stoppages.
Identifying Single-Source Suppliers
There is a technical distinction between sole-source and single-source suppliers. A sole-source supplier is the only company in the world that makes a particular component or provides a particular capability. A single-source supplier is simply the only supplier a company has chosen to use, even if alternatives exist. The investment implications differ significantly.
Sole-source dependencies arise most often from regulatory requirements, proprietary technology, or natural resource constraints. In aerospace, aviation-grade components must be certified by the Federal Aviation Administration (FAA) or equivalent regulators, and certification processes can take years. If only one supplier has achieved certification for a critical actuator or avionics component, that supplier is effectively sole-source regardless of how many companies could theoretically manufacture the part. Pharmaceutical APIs (active pharmaceutical ingredients) present similar dynamics: a drug manufacturer may depend on a single certified API supplier because qualifying an alternative source requires regulatory submissions and inspection cycles that take 18 to 36 months.
ASML (ASML) is the canonical example of a sole-source supplier at the leading edge of semiconductor technology. ASML is the only company that manufactures extreme ultraviolet (EUV) lithography machines, which are necessary for producing chips below approximately 7 nanometers. There is no alternative source for this equipment; competitors exited the market or never successfully developed competing EUV platforms. Every leading-edge chip manufacturer, including TSMC, Samsung, and Intel, depends entirely on ASML for EUV capability. This is not single-source in the strategic-choice sense; it is sole-source in the technical-capability sense, and it explains why ASML trades at premium multiples relative to most industrial equipment companies.
TSMC occupies a similar position for advanced logic semiconductor manufacturing. While other foundries exist, only TSMC has consistently delivered leading-edge nodes (3nm and below as of 2026) at scale, on schedule, and with the yields that enable profitable product launches. Apple, NVIDIA (NVDA), AMD (AMD), and Qualcomm (QCOM) all depend on TSMC for their most advanced products. Each of their 10-K filings acknowledges geographic concentration in Taiwan as a material risk.
Concentration from the Supplier's Perspective
Customer concentration at a supplier creates a different set of risks than supplier concentration at a buyer. When a single customer accounts for a large share of a supplier's revenues, that customer gains significant bargaining leverage at contract renewal, and any reduction in that customer's demand directly impacts the supplier's revenue.
Apple's relationship with TSMC illustrates both sides of this dynamic. Apple represented approximately 25% of TSMC's consolidated revenue as of recent filings. This creates revenue visibility for TSMC: Apple's product launch cycles are predictable, and Apple tends to commit to capacity well in advance. But it also means that any material change in Apple's purchasing, whether from a product transition, an in-house chip strategy shift, or a market share loss, would have a significant impact on TSMC's financials. TSMC discloses Apple as a significant customer precisely because this concentration is material to investors.
Qualcomm (QCOM) presents a related case of customer concentration risk with a specific threat vector. Apple has historically purchased modem chips from Qualcomm for iPhone connectivity. However, Apple has been developing its own in-house modem capability for years, and the prospect of Apple internalizing modem production represents a significant revenue risk for Qualcomm. Apple's potential departure as a customer would affect not just the direct revenue from Apple but also the royalty income that Qualcomm collects on Apple devices under its licensing agreements. Qualcomm's 10-K has disclosed Apple-related revenue and the risk of Apple developing alternative modem solutions for multiple years. Investors in Qualcomm have had to weigh this disclosed risk against the timeline uncertainty of when (or whether) Apple would fully transition away from Qualcomm modems.
Margin Analysis as a Concentration Signal
Beyond 10-K disclosures, gross margin trends provide an empirical signal of how pricing power is shifting across a supply chain. When a critical supplier is capacity-constrained, prices tend to rise at the input level, and the company that absorbs those higher costs sees margin compression unless it can pass costs through to its own customers.
The automotive semiconductor shortage of 2021 and 2022 is the most instructive recent example. Automakers had historically purchased chips through intermediaries and maintained lean inventories, treating semiconductors as commodity components. When pandemic-related demand volatility caused automakers to cut chip orders in 2020, semiconductor foundries reallocated capacity to consumer electronics. When automotive demand recovered faster than expected, automakers found themselves at the back of the queue for foundry capacity.
The margin impact was asymmetric in exactly the way that concentration analysis predicts. Chip suppliers and foundries with constrained capacity saw average selling prices rise and gross margins expand. TSMC reported record revenues in 2021 and 2022. Meanwhile, automotive OEMs including Ford (F) and General Motors (GM) reported production shortfalls measured in hundreds of thousands of units. Ford attributed billions of dollars of lost revenue directly to semiconductor shortages in its 2021 earnings communications. The gross margins of semiconductor companies rose while those of the companies dependent on them fell.
An investor who tracked TSMC's order books and booking lead times in 2020 and early 2021 could have anticipated this dynamic before it appeared in automotive earnings. Lead time extensions reported in TSMC's earnings calls and in trade press were a forward indicator of margin pressure at the automotive OEM level, months before that pressure appeared in quarterly income statements.
How do analysts measure supplier concentration risk?
Analysts use several techniques. First, they read 10-K risk factors: the SEC requires disclosure of any customer accounting for 10% or more of revenues, and similar thresholds often appear in supplier risk disclosures. Second, they look for geographic concentration (a factory in one country or one region). Third, they model scenario stress tests: what happens to gross margins if this supplier goes offline for 90 days? Companies that cannot quantify this risk in management presentations often have not mapped their own supply chain well, which is itself a risk signal.
Is high supplier concentration always bad for investors?
Not necessarily. A dominant single-source supplier often enjoys pricing power, sticky customer relationships, and high margins. ASML earns premium multiples precisely because it is the only company that can manufacture EUV lithography machines. The risk is asymmetric: concentration is a moat if you are the supplier, and a vulnerability if you are the buyer. The investment question is which side of that relationship a company sits on, and how easily either party could find alternatives.
What happened to supply chains during the 2021-2022 semiconductor shortage?
Automakers and consumer electronics companies that had cut orders during early COVID found themselves unable to source chips when demand recovered. The shortage illustrated how concentration risk materializes: most automakers relied on a small number of foundries for specialized automotive-grade chips. Production lines stopped for lack of a $5 component. Meanwhile, semiconductor companies with constrained capacity saw pricing power and expanded margins. The episode accelerated US and European investment in domestic chip manufacturing through the CHIPS Act and EU Chips Act.