The Concentration Risk That Dare Not Speak Its Name

Hello and welcome to the fourth issue of The Business Of Analytics newsletter.

I will admit to being slightly pleased with myself for managing to stick to a fortnightly newsletter cadence for as many issues as this. I have upcoming school holidays (which always bork schedules) and then some travel, so I may not be quite so reliably and consistently present for the next few weeks.

This time around, I want to talk about concentration risk. The de facto linguistic reflex when you hear that term is to think that it’s describing the problem of having one client that constitutes far more revenue than any of the other clients, the implication being that if that client decides to leave you for any reason, your business will struggle.

That’s a valid concern of course, but there’s another type of concentration risk that’s just as significant, isn’t predicated on the occurrence of a disaster, and is something you can actually take meaningful steps to do something about. What’s not to love?

Anyway.

To business!

Truth for thee, but not for me

Truth can be wonderful, can’t it? Like, it can be really great.

Clients come to you saying they don’t trust the numbers, and you fix data collection so they can see what’s really going on. Or they have some weird checkout process that needs session_id to be bolted to a cookie that gets passed back and forth between systems. Or you design them a UX dashboard that shows all the horrible, terrible, nightmarish usability disasters happening on their website.

In all those scenarios, what you’re selling is truth.

You’re aligning yourself with the delivery of clarity, shining light into the corners and being generally very… “truthy.”

As a concept, truth is going out of fashion, largely because of connotations with dreadful and unnecessary social networks born out of geopolitical puppeteers that I shan’t name or discuss, because why else are you running an analytics business if not to shield yourself from the pantomime nastiness of The World At Large.

But I suspect that, just as we no longer say that birds “tweet” because they do not complain about receiving poor service from local businesses in 140 characters or ~~fewer~~ more (still can’t get used to that), at some stage in the non-distant future we will need another word to use when we want to talk about “truth” that doesn’t carry the unfortunate connotations of our times.

Anyway.

For an industry so aligned, to the point of deliciously specific dashboard perfectionism, with the concept of truth, is it not a little bit incongruous that we don’t seem to be accepting of truths about our own businesses and how they are run?

That’s what we’re here for today: a couple of truths about your own business.

I believe one should be very wary about anyone that claims they have access to some sort of “universal truth”, in whatever context they are making that claim. However, here I go with an assertion that there is a “more or less universal truth” that applies to your business, and many others like it.

And here it comes: everything in your business is too concentrated.

The Client Concentration Risk

Let me start with the one that everyone knows, and that I mentioned earlier on: client concentration.

Business books always seem to land on this idea that client concentration is a Very Bad Thing.

The idea is that if more than xx% of your revenue comes from one client, that’s a risk because (well, duh) if that client leaves you then you have a rather large hole in your balance sheet into which you can gaze as you contemplate the existential dread of what’s going to happen to your business.

Sometimes the xx% is something like 40%, sometimes it’s more like 20%, and sometimes it’s the analyst’s favourite “it depends.”

I don’t wish to blab on about the concept (a) because I don’t really agree with it in all cases and (b) as it’s been blabbed about many times before (and you can ask your favourite search engine or LLM for further info on this if you are keen to explore it.)

But what I will say is this:

If you’re a freelancer or solo-operator, client concentration is probably actually basically inevitable, not least because managing 10-15 clients on your own is hectic as hell, and you’re probably going to be better off getting more work from fewer clients;
If 40% of your revenue comes from a big beast like The Government then that’s probably more or less fine;
(Caution, incoming contradiction) It’s a good idea to always think of your client concentration as being a risk, and something you need to fix.

Let me stick with that last point for a minute, because it’s a weird one.

If client concentration risk is always a risk for all companies, then it’s not really “special” to just you, hence everyone is trying to fix it, hence you’re going to try and fix it as well.

Because how do you fix it?…..

Get more clients.

Goodness me, what a revelation that is. Get more clients, who’dathunk it?

(Okay, yes technically there’s another way to fix it which is “earn more from existing clients.” Equally obvious! And yes of course you should be doing both these things, all the time.)

So how should you think about this?

Chances are you have a good book of clients, some on retainer, many repeating customers.

Three of these will probably deliver more than their share of your total revenue; this is more or less how most professional service firms are going to look, and while it may look sustainable today, your job as a business owner is to see the future, which you can do by diversifying the living crap out of everything, so the future state of your business will thank you for fixing your current three-client lion’s-share situation.

As I say, I don’t want to bang the drum on this particular risk as it’s a drum that’s basically hanging in tatters from being drummed too much. But a sift through your client list through the lens of there being a concentration risk to fix, done with level and non-panicky head, sounds to me like a good way to spend a couple of hours.

The Technology Concentration Risk

Ahh, fresh air! How delightful to shift to a topic that hasn’t been played to death like the Wonderwall of client concentration risk!

This one is subtler, I think, and harder to detect.

It’s also easier to solve than the risk of client concentration, because you don’t solve it by “simply” winning more clients.

Your business most likely has a Technology Concentration. Mine did: we were very well known for working with the Google Analytics product suite, and did great work on that stack. We knew it like the backs of our own hands, and we bent and hacked and cajoled and tortured it to within an inch of its life, and it was glorious.

But we were more or less completely concentrated on that stack.

Latterly we brought in Google Cloud skills and did a lot of great work in that area, some of the most exciting and challenging work I could ever imagine. But we never de-concentrated our stack to AWS or Azure, for instance.

If we’d done so, I have no doubt that today the balance sheet would show some good numbers for the Google stack work we were doing, but then equally good numbers on the work we’re doing with things like Amplitude, Snowplow, and goodness knows what else.

In other words: we’d be operating multiple service lines. Not just one.

So I think you should do the same for your business. Every step you take to de-concentrate the tech stacks you work in has many benefits:

New revenue stream for existing clients (cross-sell)
New revenue stream for net new clients
New partnership opportunities
Cool stuff to train your team on, increasing staff retention

And yet, you meet (well, I do anyway, not sure about whether this is true for normal people) agency owners who will confidently puff their virtual chests out and tell you that their team are world-leaders in Technology X as though being a single-stack practice is a Very Good Thing.

So. Maybe today you concentrate on Google’s stack, and maybe that’s because that’s what your clients want.

Okay, fine. But what about (a) clients that don’t know what they want, and (b) clients who know what they want, and what they want isn’t Google?

You’re invisible to them, and you can fix that by making simple lateral sidesteps into different technology stacks.

To me, it’s a no-brainer. Diversify the offering, spread the risk.

Some thoughts:

Amplitude is probably the most exciting analytics tool in the world at the moment, yet despite a strong partner network, comparatively few service providers work in that space
Spinning up a privacy-conscious offering based on Matomo or Piwik PRO will open you up to new business opportunities, and provide your current client patch with an alternative to big tech (discl: I am commercially engaged as an advisor to Matomo.)
Tools like PostHog, Plausible and Simple Analytics are ripe for a sphere of services to be built around them, just as we all did with Google
Other, newer open-source tools like Rybbit are worth a look too; any analytics practice with technical chops should be able to imagine building solutions with this

In short: in a world where the analytics industry has opened itself up to become a race of many horses, backing only one means you’re missing opportunities.

The Human vs Agent Concentration Risk

I’ve talked a little about this previously, and it’s very early days in this topic so forgive me for this being thin. But I do think that with a big shift coming, this could be a business-changing, success-generating step change if it plays out.

Let’s take a quick step back…

All the analytics work we’ve ever done has been about understanding human behaviour. Pretty much.
The problem is that the future state of the web isn’t going to be human (or at least, not in the way we’re accustomed to.)
That means our industry is going to change, which means you need to adapt, and adaptation is profitable

Recently, Cloudflare published their manifesto on The Agentic Internet. It’s worth a full read if you’ve not seen it already.

The idea is that hitherto, the web has been about the actions of humans (the goodies) and bots (the baddies, because they scrape your content or compare your prices or something like that, and they often pollute your analytics data).

But the New Way Of Things is going to be weirder, because now we’re going to have a murky middle category of Agents, which aren’t humans and aren’t bots, and aren’t quite “bots working on behalf of humans” either.

I mean let’s not gloss over just how weird that sounds. I expect it’ll be weirder still how fast it all becomes normal…

They say in the article: “The web was not built for this, and neither were your analytics.” Can anyone hear the thunderous sound of a distant stampede of agentic buffalo headed for our industry?

Indeed, they have already launched a new browser called Kitesurf that runs on Workers and is built for agents. What better way to own the tracking than to own the browser? I understand that Kitesurf executes JavaScript, so we might get some regular hits into GA4, but whether that will also include dimensions that give clues to intent and success, I cannot say.

What I can say is that chances are Cloudflare will be the ones who determine how we track this new classification of behaviour. GA4 alone won’t cut it.

I’m not a doomer on this. Far from it. This stuff from Cloudflare, while extremely early days, might just translate to being a whole new sub-industry for us, a new service line, a new addition to the capabilities of smart analytics businesses everywhere.

That’s the future state. For now:

Communicate this upcoming change to all your clients, and get them excited about what’s coming and how your business will light the way through these extremely challenging times (etc)
Set up every gosh darn Cloudflare thing you can on your own website(s), so you know how it all hangs together
Surface early metrics to clients for them to use in reporting (there are some, largely disparate, ones available in Cloudflare already)
A simple dashboard today with these metrics will remind clients of how you have your finger on the pulse, your ear to the ground, and how essential you are as a service provider ❤️ ❤️ ❤️

This is not to say that in the future, analytics businesses will not be providing services around Google technology. As long as Google remains an ad platform there will be advertisers, therefore there will remain demand for Google’s analytics platform, and there will therefore remain demand for services to get the damn thing working like it’s supposed to.

My point is that, right now, I would say that getting a diversification strategy that moves you into agentic analytics tracking (as well as into other tech stacks) is a smart play, and one that’ll set you up nicely for the future.

(Just ask the businesses that were in on the ground floor in Google Analytics way back in the mists of time. They mostly got acquired, and I assume (but I don’t know for certain) that their founders are all happily retired working on whatever they want to work on these days.)

But hey, enough of my yakkin’. Stay well until next time!

Thanks for reading. No AI was used in the creation of the words you just read.

I do this for a living. I work with agencies and consultancies around the world, providing the support I wish I’d had throughout my journey of starting, scaling, and selling an agency.

If you think you could benefit from what I know how to do, I welcome conversation: hit reply or wander over to damionbrown.com

On that site, you’ll find the newsletter archive, and also information about the Analytics Consultants Circle, a free monthly peer-group call that I moderate, where solo and small-team consultants share battle stories from the field, and we talk about the challenges you face when you grow and scale a business.

The last movie I watched: LifeHack (2026).