Most companies can state their largest customer as a share of revenue. Very few can state the equivalent for suppliers, and the exposure is frequently larger.
Measure it properly
Start with spend by supplier, which is easy and only part of the answer. A supplier taking two per cent of spend can still stop production if what they provide has no substitute.
The better measure is a short list of inputs that would halt or materially damage operations, and for each: how many qualified sources exist, how long qualifying a new one takes, and how much stock or buffer you hold.
That list is usually shorter than expected and rarely matches the spend ranking.
Look for hidden single points
Concentration hides behind apparent diversity. Three suppliers who all source from the same manufacturer are one supplier. Two logistics providers using the same route are one route. A software dependency with no alternative is a single point regardless of the invoice size.
Ask suppliers where their critical inputs come from. Reluctance to answer is itself information.
Match the response to the recovery time
For each dependency, the question is how long you could operate without it, against how long replacement would take. Where recovery time exceeds endurance, you have a gap, and gaps are closed in only a few ways: a second qualified source, more inventory, a contractual notice period, or a redesign that removes the dependency.
Each costs money. The point of measuring is to spend it where the gap is real rather than spreading it evenly.
Review it when things change
Supplier risk is not static. A supplier acquired, relocating, or losing a major customer of their own has a different profile than when you qualified them. An annual review of the critical list is enough for most businesses, and more than most do.