Vendor lock-in is not just a technology inconvenience. It is a resilience risk that weakens negotiating power, reduces flexibility, and leaves organisations exposed when vendors change pricing, support, packaging, or strategy.

TL;DR

• Vendor lock-in is a resilience risk, not just a procurement issue.
• Bundling, platform consolidation, and reseller incentives can create structural dependency over time.
• A single platform may simplify operations, but it can also become a single point of failure.
• Deliberate multi-platform architecture helps preserve leverage and optionality.
• VAST helps organisations make dependency risk visible, measurable, and actionable.

‍

There is a moment most technology leaders recognise, even if they rarely say it out loud.

You are sitting in a vendor review. The roadmap looks familiar. The pricing has shifted again. The features you relied on are now in a higher tier. And as you work through the options, you realise that most of the decisions shaping how your organisation operates have already been made for you by someone whose interests are not the same as yours.

You did not choose this in one dramatic moment. You arrived here through a series of individually reasonable steps. A bundled feature activated because it was already there. A platform standardised for simplicity. A reseller relationship expanded because procurement wanted fewer suppliers. An integration adopted because it made short-term operational sense.

But here you are: a passenger in a vehicle you thought you were driving.

This is not an accident. It is the predictable outcome of how enterprise technology is sold.

How it happens

The model is well established. Bundle the product into the licence. Make it the default. Embed it deeply enough that switching feels costly. Then, once the dependency is structural, adjust the commercial terms.

In April 2026, Salesforce, on behalf of Slack, brought legal action against Microsoft in the UK. The allegation was simple: bundle the product, make it the default, and let inertia do the rest. By the time an organisation thinks it has made a choice, the decision has already been made for it.

Regulators recognise this dynamic because distribution power, applied consistently over time, becomes market control. It happened before. In the late 1990s, Microsoft bundled Internet Explorer with Windows and faced landmark antitrust action in the United States. The product was not the problem. The delivery model was.

The names change. The dynamic does not.

Vendor lock-in is really fragility

Most organisations describe this as vendor lock-in and consider it acknowledged. That framing is too comfortable. Lock-in sounds like an inconvenience. Fragility is closer to the truth.

When Broadcom acquired Symantec, many customers learned the difference. Pricing increased sharply. Support narrowed. Organisations that had spent years embedding the platform across their security estate tried to move and found they could not move at the speed the situation required. Emergency workshops. Exit programmes. Compressed timelines. And in many cases, significantly higher costs accepted simply because there was no prepared alternative.

VMware customers are now living through a similar sequence following Broadcom’s acquisition of that business. Different product. Identical commercial logic.

Once a vendor has structural dependency, they have pricing power. The buyer who has no credible exit has no leverage. When you cannot leave, pricing is no longer a negotiation. It is a condition. That is not just a technology problem. It is a resilience risk, and it is one you should never be in.

The route to market is not neutral either

Most organisations scrutinise vendors. Fewer scrutinise the channel through which they buy.

Over the past decade, many large organisations rationalised their supply chains. Fewer VARs. Consolidated procurement. Simpler contracting. Better economies of scale. The logic is sound.

But supply-chain consolidation introduces its own bias. A reseller is a commercial entity with its own margin structure and incentives. If it earns more from one vendor than another, that shapes what gets recommended. The bias is structural, not personal, but it is real. You are not always being sold the best solution. You are often being sold the most profitable one.

When an organisation consolidates its route to market around one or two resellers, it is not just streamlining procurement. It is also narrowing the range of options it will ever be shown.

A healthy diversity of routes to market is not just a procurement preference. It is a resilience consideration.

The single pane of glass is a sales pitch

The vendor answer to complexity is consolidation. One platform. One dashboard. One throat to choke.

The single pane of glass has been the dominant pitch in enterprise technology for two decades, and it has served vendors extremely well. Buyers, less so.

The problem is not that a single platform is always bad. It is that you are trading architectural flexibility for operational convenience, and the cost of that trade only becomes visible when something changes. A price increase. An acquisition. A strategic pivot. A support change. A geopolitical shift that calls your infrastructure assumptions into question.

Across Europe, organisations are already questioning their exposure to US hyperscalers such as Microsoft and Amazon Web Services. Not out of ideology. Out of risk awareness. Because dependency only becomes visible when control is tested.

At that point, the single pane of glass becomes a single point of failure.

A better model: deliberate multi-platform architecture

The alternative is not chaos. It is not duplicating everything. It is disciplined optionality.

The model that works is a deliberate multi-platform architecture built around three principles.

Strategic platforms with crossover coverage. Select two or more strategic platforms with genuine overlap in critical areas. Not because you want to run both for the same purpose every day, but because if one becomes commercially untenable, you can activate equivalent capability elsewhere with minimal disruption.

Best-of-breed tools that integrate. Use specialist tools where they genuinely outperform the platform players, but make integration part of the buying decision from the start. Depth of capability matters. So does portability.

Tactical non-adoption of overlapping features. When a platform offers a feature that duplicates something you already have from a better source, do not adopt it simply because it is included. The moment you rely on a bundled feature you did not consciously choose, you give that vendor another anchor point.

This is not anti-vendor. It is good architecture and good commercial discipline.

Strong vendor relationships, on your terms

None of this argues against deep, productive relationships with strategic vendors. Quite the opposite. Strong vendor relationships are often how you get the most value from your investment.

The distinction is intent.

A strong relationship entered with clear eyes, a mapped architecture, and a credible exit strategy is a position of strength. A deep dependency that accumulated by default is a position of exposure.

The question is not how deep the relationship is. It is whether you could end it if you needed to.

The VAST Strategy: a joined-up approach to resilience

This is not purely a cyber question. The consequences of dependency reach across operational continuity, infrastructure, financial exposure, data governance, IT performance, and strategic agility.

At ITHQ, we address this through the VAST Strategy: Visibility, Availability, Stability, and Transmutability.

Visibility means understanding what you actually have: overlapping tools, embedded integrations, contracted dependencies, and reseller relationships that have quietly accumulated over time.

Availability means ensuring critical capabilities remain accessible even if a platform changes terms, a supplier relationship breaks down, or a commercial model becomes unfavourable.

Stability means reducing the likelihood that an external vendor decision turns into internal disruption.

Transmutability is the most important of the four. It is your ability to say no. No to a price increase. No to a forced roadmap. No to a commercial model that no longer works for you. If you cannot say no, you do not have a strategy. You have a dependency.

ITHQ delivers the VAST Strategy across four domains: SAFE for Cyber Resilience, RISE for Infrastructure, FLOW for Data and AI, and PACE for IT Operations. Together they help organisations see where resilience exists, where it does not, and what it would take to move if conditions changed.

Organisations that have that picture have negotiating power. Organisations that do not are passengers.

The question to ask this week

If your primary vendor changed the rules tomorrow, what would you do?

If the answer is unclear, delayed, or dependent on emergency planning, the risk is already present. You are not operating your platform. You are operating within someone else’s commercial model.

That is what VAST is designed to change. It helps make dependency risk visible, measurable, and actionable before conditions force your hand.

This is how the system works. The question is whether you are designed for it.