The Hidden Risk Lurking Behind Digital Transformation

For years, organizations have focused on the risks associated with individual

technology providers. Yet according to Ricardo Mariano Gonzalez, former Executive Director of Operational Resilience, Technology Risk and Third-Party Governance at Zurich Insurance Company Ltd, that perspective is no longer sufficient.

The greater danger may lie not in any single provider, but in the growing number of organizations that have become dependent on the same providers, platforms, and infrastructure.

Speaking ahead of Next Gen OpRisk Europe 2026 in October, Gonzalez argues that systemic technology concentration risk has evolved into a board-level concern that demands far greater attention from senior leaders.

As firms pursue efficiency, scalability, and innovation, many have independently arrived at similar technology decisions. While those choices often make sense

individually, collectively they can create vulnerabilities that stretch far beyond a single organization.

“What I have observed in practice is that this shift becomes visible at Board level not when a provider fails, but when an organisation realises that the same disruption could affect many of its peers simultaneously,” he explains.

The implications are significant. Financial institutions have become increasingly sophisticated in understanding their direct technology relationships, but Gonzalez believes the real challenge now lies in understanding where dependencies converge across industries and critical infrastructure ecosystems.

“The issue is no longer whether an organisation understands its own technology dependencies,” he says. “The challenge is understanding where those dependencies converge across an industry, a market or a critical infrastructure ecosystem.”

This evolution has been reflected in recent regulatory developments. Having led DORA implementation across two regulated entities operating under different supervisory regimes, Gonzalez has witnessed a growing focus on ICT concentration risk as a resilience and governance issue rather than a purely technical concern.

As a result, technology concentration has moved beyond the traditional domains of procurement, outsourcing, and technology risk.

Boards are increasingly expected to understand how disruption at a shared provider could affect multiple firms simultaneously, potentially creating market-wide consequences.

One reason this challenge has become so difficult is the complexity of modern technology ecosystems. Most organizations have improved their oversight of critical third parties, but dependencies rarely stop at the contractual boundary.

“A financial institution may know which cloud provider it uses, which software vendors support critical services, and which outsourcing partners deliver key capabilities,” Ricardo notes. “What is often less visible are the layers of dependency that sit behind them.”

Cloud providers rely on other providers. Software platforms depend on shared infrastructure. Critical services may ultimately be linked through common data centers, telecommunications networks, or specialist suppliers.