Supplier Concentration Audit with a Dust Agent: Detecting Dependencies Before They Become Costly
30% of spend with a single supplier is an invisible risk — until that supplier raises prices or disappears. A Dust agent connected to the Spendesk MCP detects it in 30 seconds, and shares it with the whole leadership team.
The Problem
Supplier concentration is one of the least-monitored financial risks in scale-up finance teams. Everyone knows Salesforce is a big line item — but does anyone know exactly what percentage of total spend it represents? Or whether there are other suppliers that, combined, account for more than 30% of all purchases?
This kind of intelligence doesn't surface in a dashboard. You have to export 12 months of spend, group by supplier, calculate relative shares, and decide on an alert threshold. That's a 3–4 hour task for a finance team — and in practice, it never happens until after an incident: a supplier that suddenly raises prices, gets acquired, or starts experiencing service disruptions.
The risk isn't purely financial. A supplier that represents 25% of your IT spend and suffers an extended outage can bring operations to a halt. Supplier dependency is also operational exposure — and most CFOs don't measure it until it's too late.
What a Dust agent connected to the Spendesk MCP changes
A Dust agent configured with the Spendesk MCP tools analyses the full structure of your supplier spend across any period in seconds — right in the Dust chat, or via @Dust in the leadership team's Slack channel. It calculates concentration indices, flags critical dependencies, and proposes concrete actions — no export required.
@Dust analyse our supplier concentration over the last 12 months. What are our dependency risks?
Supplier Concentration Analysis — July 2025 to June 2026
Total spend analysed: 2,847,300 €
Top 10 suppliers by spend share:
| Rank | Supplier | 12-month spend | Share of total | Category |
|---|---|---|---|---|
| 1 | Salesforce | 312,400 € | 10.9% | CRM SaaS |
| 2 | AWS | 287,600 € | 10.1% | Infrastructure |
| 3 | Deloitte | 198,200 € | 6.9% | Consulting |
| 4 | Workday | 156,800 € | 5.5% | HR SaaS |
| 5 | Stripe | 143,100 € | 5.0% | Payments |
| 6 | Google Workspace | 98,400 € | 3.4% | Productivity |
| 7 | Datadog | 87,200 € | 3.1% | Observability |
| 8 | HubSpot | 76,300 € | 2.7% | Marketing SaaS |
| 9 | Legalstart | 62,100 € | 2.2% | Legal |
| 10 | Personio | 58,400 € | 2.1% | HR SaaS |
HHI (Herfindahl-Hirschman Index): 412
Dependency alerts:
Would you like a category-level breakdown or a price impact simulation for Salesforce?
A published agent, shared across the whole leadership team
Unlike a spreadsheet sent out once a quarter, a Dust agent published on the workspace stays accessible at any time — the CFO, FP&A lead, or COO can all ask the same question without depending on a stale export. Mentioned in the #finance-leadership channel, the agent keeps the exchange visible to the whole leadership team.
Identifying SaaS suppliers without annual contracts
Some SaaS suppliers are billed monthly without commitment — which makes them flexible but also vulnerable to immediate price increases.
@Dust which SaaS suppliers represent more than 5% of our total spend and don't have an annual contract?
Spendesk stores no contract data on suppliers, so I looked at how each supplier was billed over the 12 months (one annual invoice vs. monthly invoices).
SaaS suppliers > 5% of total — billing pattern observed:
| Supplier | Annual spend | Share of total | Billing pattern observed | Risk |
|---|---|---|---|---|
| Salesforce | 312,400 € | 10.9% | 1 annual invoice (Oct 2025) | ✅ Likely annual commitment |
| AWS | 287,600 € | 10.1% | 12 monthly invoices | ⚠️ Likely no commitment |
| Workday | 156,800 € | 5.5% | 1 annual invoice (Jan 2026) | ✅ Likely annual commitment |
Would you like a savings simulation by instance type based on the last 6 months of AWS usage?
Detecting suppliers with a single point of contact
A supplier relationship managed by only one person internally is a continuity risk. If that employee leaves, the contractual relationship, account access, and institutional knowledge leave with them.
@Dust identify suppliers where we only have a single point of contact — relationship dependency risk.
Spendesk supplier records hold no contact person, so I looked at who carries the spend internally: suppliers whose payables over the last 12 months all belong to a single employee.
Suppliers carried by a single employee (relational dependency risk):
| Supplier | Only employee on the payables | 12-month spend | Risk level |
|---|---|---|---|
| Deloitte | Sophie Marchand | 198,200 € | 🔴 High |
| Legalstart | Thomas Brun | 62,100 € | 🟡 Medium |
| Personio | Camille Girard | 58,400 € | 🟡 Medium |
| Datadog | Marc Lefebvre | 87,200 € | 🔴 High |
Would you like the same view restricted to suppliers above 50,000 € a year?
Automating the review every quarter
Once this analysis has been validated manually, a Dust Trigger can re-run it automatically at the start of every quarter and post the result in the #finance-leadership channel — without anyone having to remember.
Key Takeaways
- Supplier concentration is both a financial and operational risk — often invisible until an incident occurs
- The HHI index, calculated automatically, gives an objective measure of your portfolio's concentration level
- SaaS suppliers above 5% of spend with no annual contract represent immediate pricing exposure
- A single internal contact per supplier is a continuity risk that's easy to document and fix
- A published Dust agent turns a 3–4 hour analysis into a 30-second answer, accessible at any time by the whole leadership team
Related skills