No choice. No control.

An operational dashboard can show green while strategic dependencies grow.

Availability tells the business whether a service is running. It does not tell management whether the company can reject new conditions, change its architecture or move elsewhere.

A system can be reliable and still leave its customer commercially exposed.

The distinction becomes visible when the provider makes a decision the customer would not have chosen.

Can the company refuse - and continue operating on acceptable terms?

If the answer is no, the relationship has changed.

The customer is still buying the service. But the provider increasingly defines the choices around it.

Negotiating power depends partly on what happens if the parties do not agree.

A customer with a workable alternative can reject an unacceptable offer. A customer facing years of migration, extensive redevelopment and operational disruption has a weaker position.

The provider does not have to remove the right to leave. Leaving only has to become impractical.

That can happen gradually:

➜ More workflows depend on proprietary functionality.
➜ Integrations become difficult to reproduce elsewhere.
➜ Internal expertise concentrates on one ecosystem.
➜ Data can be exported, but its business context cannot easily be reconstructed.
➜ The cost of maintaining alternatives disappears from the budget.

Eventually, negotiations focus on how to absorb a change rather than whether to accept it.

Buying time is useful. It is not the same as having a choice.

The IT organisation must keep services secure, resilient and affordable. It must support the business’s compliance obligations and explain operational risks.

Yet some of the decisions shaping those responsibilities may sit outside its authority.

A provider may determine product support periods, available deployment models, supported integrations or migration deadlines. Depending on the contract and service, it may also change pricing, packaging or processing arrangements.

IT then has to manage the consequences.

That creates a difficult imbalance: accountability remains with the customer while important decision rights sit with the supplier.

An IT team cannot compensate indefinitely for strategic options the organisation has allowed to disappear.

Bitkom’s Wirtschaftsschutz 2026 study reports that 96% of surveyed companies in Germany had experienced data theft, industrial espionage or sabotage or suspected that they had. Only 43% considered themselves very well prepared for cyberattacks.

These findings do not establish that vendor lock-in causes cyber incidents. They show the demanding environment in which companies must manage their dependencies.

During a serious incident, the ability to act matters.

Can the organisation isolate an affected service? Restore an independent copy of its data? Continue critical operations through another route? Obtain the expertise needed without waiting for one supplier?

A service-level agreement may define obligations. It does not automatically provide these capabilities.

A backup can support recovery. An export function can support data retrieval. A termination clause can establish the contractual right to leave.

None of these alone proves that the business can operate without the provider.

An exit assessment needs to follow the work:

➜ Where would the data go?
➜ Which applications could use it?
➜ How would identities, permissions and integrations be rebuilt?
➜ Who has the skills and capacity to execute the transition?
➜ How long could the business tolerate the disruption?

The answer may reveal that an apparent alternative depends on the same underlying infrastructure or requires capabilities the company no longer has.

An exit exists when it can be executed - not merely when it is permitted.

Deep integration can deliver substantial value. Maintaining an alternative for every component would be expensive and, in some cases, unrealistic.

The task is to distinguish dependencies the business can accept from dependencies it cannot afford to leave unmanaged.

➜ Identify decisions the provider can impose.
Examine which commercial or technical changes would materially affect operations.

➜ Test the most consequential exits.
Validate migration, restoration or substitution for the services whose loss would cause the greatest damage.

➜ Preserve essential knowledge.
Keep enough architectural understanding and documentation to assess alternatives independently.

➜ Include dependency in investment decisions.
Each additional service should be assessed for both its immediate benefit and its effect on future flexibility.

➜ Fund the ability to respond.
An alternative that receives no budget, maintenance or testing will become less credible over time.

Control has a cost. So does discovering that it has been lost.

At APILANi, we connect technology and market decisions with their longer-term business implications: which relationships create value, which dependencies they introduce and what room remains to change direction.

A strong provider can be the right choice. That choice still deserves review as the relationship expands.

The decisive question is whether staying remains a decision the company can make freely.

The real risk begins when staying is no longer a choice - and leaving is no longer a workable option.