Technology supply-chain dependencies get treated as isolated vendor risk, when they actually behave as a shared concentration exposure across an entire portfolio.