How to Evaluate a SaaS Vendor's Customer Concentration Risk Before You Depend on Them

Datadog's Q2 2026 results included a detail most vendors never volunteer: a usage reduction from its single largest customer, disclosed explicitly and built into forward guidance, alongside a beat-and-raise result anyway. That combination is a genuine, real-world stress test of revenue diversification passing in public — and it's a useful prompt to ask a question most enterprises never formally evaluate about their own critical vendors: how concentrated is this company's revenue, and what happens to the products we depend on if their biggest customer leaves?

Why Customer Concentration Risk Matters to You, Not Just Investors

Customer concentration is usually framed as an investor risk metric — but for an enterprise depending on a vendor's product for critical operations, it's equally a continuity risk. A vendor whose growth or stability depends heavily on one or two large accounts is more exposed to sudden roadmap shifts, pricing changes, or even acquisition/distress scenarios if that concentrated relationship changes, compared to a vendor with genuinely diversified revenue across thousands of accounts of varying size.

Public Signals You Can Actually Check Yourself

• For public companies, SEC filings (10-K, 10-Q) disclose customer concentration when it crosses material thresholds — a single customer representing 10%+ of revenue must legally be disclosed, and its absence in a filing is itself informative
• Earnings call transcripts, freely available for any public vendor, often name specific concentration risks directly when management is being transparent — as Datadog's did — versus vendors who avoid the topic in Q&A
• Customer count and cohort growth disclosures (like Datadog's 750+ AI-native customers, 31 spending $1M+ annually) indicate real base diversification when a vendor reports them, versus vendors who only ever cite an aggregate revenue number
• For private vendors with no public filings, ask directly during a sales or renewal conversation what percentage of revenue comes from their top 10 customers — a vendor confident in its diversification will usually give a directional answer; one that deflects entirely is itself a signal

What Genuine Resilience Actually Looks Like

Datadog's specific pattern — non-AI customer growth accelerating even while absorbing a large-customer pullback — is what real resilience looks like in practice: the broader base growing fast enough to more than offset one concentrated loss. A vendor showing overall growth while its underlying base is actually shrinking or stagnant, propped up by one or two large accounts, would look identical on a single top-line revenue number but represents a meaningfully different (and riskier) underlying reality. This is exactly why the underlying composition matters more than the headline growth rate — a lesson worth applying to any vendor's growth claims, not just Datadog's.

Building This Into Vendor Risk Reviews

For any vendor your organization depends on for a business-critical function, add customer concentration to your standing vendor risk review alongside the more commonly checked items (financial stability, security posture, SLA history). It costs little to check — an hour reading recent public filings or asking a direct question during a renewal call — and surfaces a real continuity risk that most procurement processes don't currently ask about at all, treating vendor evaluation as solely about the product's current capability rather than the business's underlying durability.