Organisations are often assessed as if they were self-contained. Strategies are evaluated within organisational boundaries, risks are catalogued within internal frameworks, and controls are designed to manage exposures that can be clearly attributed. This framing is increasingly misaligned with how risk actually manifests. Most organisations now operate within dense networks of dependency that extend well beyond their formal perimeter.
These dependencies are not new, but they have deepened and become less visible. Supply chains are more distributed, technology stacks are more layered, and reliance on shared infrastructure has increased. Third-party relationships have expanded into fourth- and fifth-order dependencies that are rarely mapped in full. At the same time, artificial intelligence systems are often built on common data sources, models, and platforms, introducing forms of correlation that are difficult to detect until they fail.
In this environment, risk does not remain contained. It propagates. A disruption in one part of the network can trigger effects elsewhere that appear unrelated at first glance. A supplier’s operational weakness becomes a customer-facing failure. A platform decision taken outside the organisation’s control alters its risk profile overnight. An assumption of independence between systems proves unfounded under stress. What looks like a local issue becomes systemic through connection.
Traditional risk management struggles to capture this. It is designed to identify and assess risks that can be attributed, owned, and mitigated within defined boundaries. Third-party risk frameworks extend this thinking, but they tend to focus on direct relationships. They are less effective at capturing the dynamic interactions through which risk actually propagates. Mapping exercises provide snapshots of dependency, but they quickly become outdated as relationships evolve.
The connection to earlier essays is clear. Where narratives assume stability within the organisation, they often understate the degree of external dependence. Where appetite is defined internally, it may not reflect exposures created through the network. Where surprise occurs, it is frequently attributed to external factors rather than to the organisation’s inability to interpret its own interdependence. In such conditions, risk appears to originate outside, when in reality it arises from how connections are understood.
Artificial intelligence both helps and complicates this picture. It can detect patterns across large datasets and identify correlations that would otherwise be missed. At the same time, it contributes to convergence. Organisations relying on similar models, data sources, and infrastructure may behave in similar ways under similar conditions. This increases the likelihood of simultaneous failure across systems that appear independent. The diversification that organisations believe they have may be less real than it appears.
If risk propagates through interdependence, then systems that focus on discrete entities will systematically underestimate exposure. The limitation is structural. Understanding requires attention not only to individual relationships, but to how those relationships interact and evolve. This cannot be fully mapped, but it can be sensed earlier if signals are connected across contexts. Environments that enable this are not optional extensions of existing frameworks. They are necessary if organisations are to remain aligned with the realities in which they operate. RiskMetrica is designed to surface these connections where they begin to matter.
Within such an environment, dependencies are not treated as static inventories. They are observed through patterns of interaction over time. Signals that indicate stress in one part of the network are connected to developments elsewhere, allowing emerging fragility to be recognised before it becomes visible in outcomes. Assumptions about independence are made explicit and revisited as conditions change. This does not eliminate ecosystem risk, but it reduces the likelihood that it will be misinterpreted as isolated failure.
For boards, the implication is that oversight must extend beyond the organisation as a unit of analysis. Understanding risk requires attention to the structure of the network in which the organisation operates, and to the ways in which that structure can amplify or dampen shocks. This is inherently uncertain and cannot be reduced to a complete map. It requires sensitivity to signals that sit outside traditional reporting and a willingness to question assumptions about control.
The question is not whether dependencies are known, but whether their interactions are understood before they fail.
Richard Anderson
Founder, AndersonRisk
This essay was first published on 21 May 2026 on my Substack.