You are two weeks into confirmatory diligence on a $40M ARR B2B software target. The QoE is clean. Growth looks real. Then you pull the customer-level revenue file and see it: one logo accounts for 31% of trailing twelve-month revenue. Two more make up another 28%. Three customers, 59% of the business.
Customer concentration risk just became the central question of this deal. It will shape your underwriting, your purchase price, your hold structure, and possibly whether you proceed at all. The problem is that most concentration analyses stop at a top-10 revenue table, which tells you almost nothing about actual risk exposure. A 30% customer can be stable for a decade or gone in 90 days, depending on contract terms, relationship depth, and switching economics.
This article provides a weighted scoring framework to quantify customer concentration risk across the dimensions that actually predict churn and renewal behavior. It is the approach I use when advising deal teams on commercial diligence, and it converts a single scary percentage into a structured risk profile you can underwrite against.
One Logo Is 30% of Revenue
The rule of thumb you will hear from most PE sponsors is that no single customer should exceed 10-15% of revenue, and your top five should not exceed 40-50%. These thresholds appear in countless investment committee memos. They are also almost useless as standalone criteria.
A SaaS company with one customer at 25% of ARR under a five-year contract with 18 months remaining, deep multi-department integration, and $2M+ switching cost represents a fundamentally different risk profile than a services business with one customer at 25% on month-to-month terms with a single point of contact who just gave notice.
The commercial consequence of getting this wrong is substantial. According to research from Bain & Company, customer concentration is among the top five factors that cause post-close value creation plans to miss their targets in the first two years of ownership. The issue is not concentration itself. It is unquantified concentration that distorts your entry multiple, your debt capacity, and your hold period assumptions.
When you are reviewing commercial due diligence red flags in B2B businesses, concentration is typically the first item on the list. But flagging it is not the same as measuring it. What follows is a framework for measurement.
Measuring Concentration Beyond the Top-10 Table
The standard concentration analysis in a CIM or QoE shows revenue by customer for the top 10 or 20 accounts, sometimes with a Herfindahl-Hirschman Index calculation. This tells you the distribution of revenue. It does not tell you the distribution of risk.
Risk requires you to layer at least five additional dimensions onto the revenue share data:
- Contract term and enforceability: How long is the customer contractually committed, and what does exit look like?
- Tenure and historical behavior: How long have they been a customer, and what is their renewal and expansion pattern?
- Relationship depth: Is the account single-threaded to one champion, or embedded across multiple stakeholders and departments?
- Switching cost: What would it cost the customer, in dollars and disruption, to move to an alternative?
- Renewal timing: When does the contract come up, and does that fall within your hold period or diligence window?
Each of these factors either amplifies or mitigates the risk implied by the revenue share percentage. A comprehensive commercial due diligence checklist for B2B acquisitions should include data requests for all five.
Contract Terms, Tenure, and Switching Cost
These three factors form the structural foundation of concentration risk analysis. They are the hardest for a customer to change quickly and therefore the most predictive of near-term behavior.
Contract Terms
Pull the actual agreements for your top 10 customers, not summaries. You need to know:
- Initial term and renewal mechanism (auto-renew vs. active opt-in)
- Termination for convenience clauses and notice periods
- Termination for cause triggers
- Any change-of-control provisions that could allow exit upon acquisition
That last item is critical in deal context. According to a 2022 analysis by Lincoln International, approximately 15-20% of enterprise software contracts contain change-of-control provisions that allow termination or renegotiation upon acquisition. If your largest customer has one, you have a Day 1 risk that requires active management.
Tenure
Tenure measures relationship stability over time. A customer who has been paying for seven years and renewed three times is statistically unlikely to churn in year eight absent a major service failure or strategic shift. Harvard Business Review research on B2B retention suggests that customers who renew beyond the second contract cycle have churn rates 60-70% lower than first-cycle customers.
Tenure also creates institutional knowledge. Long-tenured customers have adapted their processes to your target’s product. That adaptation itself becomes a switching cost.
Switching Cost
Switching cost is the sum of direct costs (implementation fees, data migration, retraining) and indirect costs (productivity loss, workflow disruption, executive attention) required to move to an alternative solution. For enterprise software, Gartner estimates that full switching costs typically range from 1.5x to 4x annual contract value, depending on integration depth.
High switching cost is the single strongest mitigator of concentration risk. A customer who represents 25% of your revenue but would face $3M in switching costs and 12 months of disruption to leave is not a flight risk. They are a captive.
Relationship Depth vs Single-Threaded Risk
Relationship depth measures how many people at the customer organization have direct engagement with your target’s product or team. This is distinct from user count. You can have 500 users who never interact with the vendor and one champion who owns the relationship entirely.
Single-threaded accounts are the most dangerous form of concentration risk. When one person leaves, retires, or loses internal influence, the entire account becomes vulnerable. I have seen $2M ARR accounts churn within 90 days of a champion departure when no other stakeholder had ever spoken with the vendor.
Multi-threaded accounts have executive sponsorship, operational users who depend on the product daily, and typically a procurement or finance contact who processes renewals. Losing any one of these contacts does not destabilize the relationship.
During diligence, ask the target to map their top 20 accounts by:
- Number of distinct stakeholder contacts in their CRM
- Number of stakeholders who have participated in a meeting or support interaction in the last 12 months
- Presence of executive sponsor above the day-to-day user level
- Departments using the product (single department vs. cross-functional)
Accounts that score low on all four are single-threaded regardless of size. That should increase their risk weighting in your concentration analysis.
Cohort and Renewal Exposure
Renewal timing creates a different kind of concentration risk: temporal concentration. Even a well-diversified customer base can have dangerous exposure if 40% of ARR renews in the same quarter.
When reviewing GTM due diligence and revenue quality for B2B acquisitions, renewal cohort analysis should be standard. You need to see:
- Renewal schedule by quarter for the next 24 months
- Historical renewal rates by cohort (did Q1 renewals perform differently than Q3?)
- Concentration of renewal value in any single period
The risk here is not just churn. It is negotiating leverage. When a large customer knows their renewal falls in a quarter where you have significant ARR at stake, they have leverage to demand discounts, extended terms, or scope changes. If your top three customers all renew within six months of each other, you face a compounding negotiation problem.
For deal teams, renewal timing also matters relative to your hold period milestones. If your three largest customers all renew within 18 months of close, you will know within your first two years whether the concentration risk was real. If they renew at month 36 and 42, you are carrying that uncertainty through most of your hold period without resolution.
How Concentration Changes Price and Structure
Concentration risk directly impacts deal economics in three ways: valuation, debt capacity, and earnout structure.
Valuation Impact
Sponsors routinely apply a 0.5x to 2.0x multiple discount for concentrated revenue bases, depending on severity. A business that would trade at 8x EBITDA with diversified revenue might trade at 6.5x or 7x with significant concentration. The discount is meant to price in the probability-weighted loss of the concentrated revenue.
McKinsey’s analysis of software valuations suggests that customer concentration above 20% in a single account correlates with a 10-15% valuation discount on average, though this varies by sector and contract structure.
Debt Capacity
Lenders apply their own concentration haircuts. A senior lender may reduce their advance rate or apply higher pricing if they see concentration risk in the customer base. In some cases, they may exclude concentrated revenue entirely from their borrowing base calculation.
Earnout and Holdback Structure
Concentration creates a natural earnout trigger. If the seller believes the concentrated customer is stable, they should be willing to accept a portion of purchase price tied to that customer’s retention through a defined period. A common structure ties 10-20% of purchase price to retention of specified key accounts through the first 12-24 months post-close.
This converts an underwriting disagreement into an aligned incentive. The seller gets upside if they are right about customer stability. The buyer gets downside protection if they are wrong.
A Customer-Concentration Risk Scorecard
The following scorecard provides a weighted scoring methodology for your top 10 accounts. Each account receives a score from 0-100, where higher scores indicate higher risk. Accounts with scores above 60 warrant specific mitigation strategies. Aggregate portfolio scores above 45 suggest systemic concentration risk that should impact deal structure.
Scoring Methodology
Each dimension is scored on a 1-5 scale, then multiplied by its weight. The sum produces the account risk score.
| Dimension | Weight | Score 1 (Lowest Risk) | Score 3 (Moderate) | Score 5 (Highest Risk) |
|---|---|---|---|---|
| Revenue Share | 25% | <5% of revenue | 5-15% of revenue | >20% of revenue |
| Contract Term Remaining | 20% | >36 months | 12-24 months | <6 months or MTM |
| Tenure | 15% | >5 years, 3+ renewals | 2-4 years, 1-2 renewals | <2 years, no renewal yet |
| Relationship Depth | 15% | Cross-functional, exec sponsor | Multi-stakeholder, single dept | Single-threaded champion |
| Switching Cost | 15% | >3x ACV to switch | 1.5-3x ACV to switch | <1x ACV to switch |
| Renewal Timing | 10% | >24 months to renewal | 12-24 months to renewal | <12 months to renewal |
Calculating the Score
For each account: (Revenue Share score × 0.25) + (Contract Term score × 0.20) + (Tenure score × 0.15) + (Relationship Depth score × 0.15) + (Switching Cost score × 0.15) + (Renewal Timing score × 0.10) = Account Risk Score (1-5 scale, multiply by 20 for 0-100 scale)
Interpreting Results
- Score 0-30: Low risk. Standard monitoring, no structural adjustment needed.
- Score 31-50: Moderate risk. Include in key account management plan, consider in underwriting scenarios.
- Score 51-70: Elevated risk. Active mitigation required. Consider earnout tied to account retention.
- Score 71-100: High risk. Material deal consideration. May warrant price adjustment, significant holdback, or deal structure change.
Portfolio-Level Analysis
Calculate the revenue-weighted average score across your top 10 accounts. A portfolio score above 45 indicates systemic concentration risk, not just account-specific exposure. This should trigger structural deal adjustments rather than account-level mitigation alone.
Applying the Framework: An Illustrative Scenario
Consider this illustrative example to see how the scorecard works in practice. This is not a real deal, but reflects patterns I have seen across multiple diligence processes.
A $25M ARR vertical SaaS business has three customers above 10% of revenue:
- Customer A: 28% of ARR, 18 months remaining on contract, 6-year tenure, single-threaded to one VP, moderate switching cost (2x ACV), renewal in 18 months
- Customer B: 15% of ARR, 30 months remaining, 4-year tenure, multi-department usage with exec sponsor, high switching cost (4x ACV), renewal in 30 months
- Customer C: 12% of ARR, month-to-month, 18-month tenure, single-threaded, low switching cost (0.5x ACV), no contract protection
Scoring these accounts:
- Customer A: Revenue (5) × .25 + Contract (3) × .20 + Tenure (1) × .15 + Depth (5) × .15 + Switching (3) × .15 + Renewal (3) × .10 = 3.5 → 70 on 100-scale. Elevated risk.
- Customer B: Revenue (3) × .25 + Contract (2) × .20 + Tenure (2) × .15 + Depth (1) × .15 + Switching (1) × .15 + Renewal (2) × .10 = 1.95 → 39 on 100-scale. Moderate risk.
- Customer C: Revenue (3) × .25 + Contract (5) × .20 + Tenure (4) × .15 + Depth (5) × .15 + Switching (5) × .15 + Renewal (5) × .10 = 4.35 → 87 on 100-scale. High risk.
Despite Customer A having the largest revenue share, Customer C presents the highest risk due to contract and relationship structure. The portfolio-weighted average score here would be in the 55-60 range, suggesting deal structure should include earnout provisions tied to retention of Customers A and C specifically.
Conclusion
Customer concentration risk is not a single number. It is a composite of revenue exposure, contractual protection, relationship stability, and economic lock-in. A top-10 revenue table tells you almost nothing about actual risk without these additional dimensions.
The scorecard framework in this article converts concentration from a qualitative concern into a quantified input for underwriting. It allows you to differentiate between stable concentration you can underwrite at a modest discount and fragile concentration that requires significant structural protection or price adjustment.
Use the weighted scoring methodology during confirmatory diligence. Build account-level scores into your investment memo. Let the data drive your conversation about price, structure, and post-close key account management.
For deal teams that need to run this analysis on a live target with real account data, DevriX provides commercial diligence support for B2B software and data acquisitions.
