Substitutability
Effective ability to replace one provider with another, measured in migration time rather than market share, and the only criterion genuinely expressing the systemic character of a dependency.
Concentration is usually judged by the number of participants in a market, competition-law reasoning that applies poorly to accumulation risk. Three hosting providers make an acceptable oligopoly if one can move between them within a quarter, and an intolerable risk structure if migration takes three years. It is therefore not market share that produces systemic character, it is switching cost. The practical consequence for underwriting is direct: asking an insured who hosts its systems has little informational value, asking how long it would take to change supplies a numerical answer that measures the exposure. The reasoning extends beyond the cloud, to any technical dependency whose exit requires reconstruction rather than a mere change of contract. Not to be confused with portability, which says whether the data can leave: substitutability says how long it takes for the business to restart elsewhere. Where the word appears: in Article 31 of the DORA regulation, among the criteria for designating a critical provider, and in the exit strategies that Article 28 requires of financial entities.
Textbook case: a portfolio can show exemplary diversification by country, by class and by site, while resting entirely on three nodes nobody measures. Dated case: in June 2024, the attack on CDK Global, which supplies the dealer management software of some 15,000 North American car dealerships, sent them back to paper for nearly two weeks: none of them could switch software within days.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.