365 Risk Desk · Strategic Intelligence

Industry structure analysis. How market forces shape commercial risk.

An independent commercial intelligence guide for founders, operators and finance leaders building scaling businesses across the UK, US and EU. Industry structure shapes pricing power, supplier leverage, platform dependency and competitive resilience long before any of it shows up in the numbers.

Category Industry analysis Read time 12 minutes Series Strategic intelligence Audience Founders and operators
5 Forces of competitive structure 8 Layers of digital dependency 4 Phases of structural decay 3 Pressure patterns to map 5 Forces of competitive structure 8 Layers of digital dependency 4 Phases of structural decay 3 Pressure patterns to map
Why this matters

Most risk frameworks start too late. Industry structure is where the pressure usually begins.

Businesses talk about commercial risk at the point of disruption. A supplier fails. A platform changes its rules. A competitor undercuts pricing. Regulation tightens. Customer economics deteriorate. By that stage, the structural conditions that made the disruption possible were already in place. Industry structure analysis surfaces the forces that make certain forms of pressure more likely, more persistent and harder to escape.

01 / Foundation

Why industry structure shapes commercial risk.

Industry structure determines how competition, dependency, profitability and fragility move through a market. It shapes how easily firms can defend margin, how much bargaining power they really have, how exposed they are to supply side pressure and how quickly disruption can destabilise an otherwise healthy operating model.

This is not an abstract strategy concept. It is the commercial environment leadership teams operate inside every day. It influences pricing flexibility, customer retention, procurement leverage, access to infrastructure, switching behaviour and the resilience of revenue under stress. When operators understand the structure beneath the market, they stop treating pressure as random and start seeing the deeper mechanics behind it.

★ Market pressure map
5
Competitive forces that shape industry profitability and resilience.
★ Dependency layers
8
Stack layers where digital businesses quietly accumulate concentration risk.
★ Decay phases
4
Stages from healthy structure to disruption-ready exposure.
When you understand industry structure properly, you stop asking why pressure has appeared and start seeing why it was always likely to build there in the first place.

Risk rarely arrives as a single clean event. It accumulates through concentration, reliance, incentives and competitive dynamics. A fragile supplier base, a dominant platform, a capital intensive category, low switching costs or a market full of poorly differentiated competitors all shape the risk profile of the business long before a formal incident occurs.

Structural analysis becomes commercially useful when it helps leaders answer practical questions. Where are margins most likely to be eroded? Which dependencies have become too embedded? Which parts of the value chain create hidden exposure? Where is the business vulnerable to substitution, compression or external rule changes? Those are the questions that turn industry analysis into decision support rather than background theory.

02 / Digital

How digital markets amplify structural pressure.

In digital markets, industry structure tends to move faster than traditional planning cycles. Businesses can scale quickly, competitors can emerge from adjacent categories, customer expectations change rapidly and third party technology layers become embedded before teams fully appreciate the risk they carry. That makes structural pressure harder to spot and more dangerous to ignore.

Cloud infrastructure, identity providers, payment processors, hosting environments, app stores, marketplaces, ad platforms and analytics layers all create dependencies that quietly shape an industry's true operating conditions. Many of these dependencies feel like neutral infrastructure until a pricing shift, outage, rules change, concentration issue or service withdrawal exposes just how much leverage was sitting elsewhere.

The digital dependency stack.

8 layers · concentration risk
Layer 01 Cloud infrastructureHyperscaler concentration shapes resilience
Layer 02 Payment processorsRevenue rails are someone else's product
Layer 03 Identity and accessWho controls the login controls the customer
Layer 04 App stores and marketplacesDistribution gatekeepers set the rules
Layer 05 API and integration layerThird party services running inside the product
Layer 06 Ad platformsCustomer acquisition rented, not owned
Layer 07 CRM and operating SaaSWhere the institutional memory lives
Layer 08 Analytics and reportingDecision making depends on someone else's pipeline
Risk Desk insight

The most dangerous dependencies are usually the ones that no longer feel like dependencies. Once a platform, processor or service layer becomes embedded enough to be treated as normal infrastructure, teams often stop stress testing its concentration risk, commercial leverage or operational failure impact.

Digital economy businesses also face unusually fast substitution pressure. Products can be replicated, distribution can be rerouted, categories can be collapsed by bundling, and adjacent players can absorb value that once sat comfortably inside a specialist segment. Industry structure analysis is not only about direct competition. It is about understanding how the entire value chain can be reconfigured around you.

Three structural patterns to watch
Pattern 01

Platform dependence

When customer access relies on a gatekeeper, structural risk often sits outside the business even while revenue sits inside it.

Pattern 02

Embedded infrastructure

Third party tools and service layers can become so operationally critical that small changes create disproportionate disruption.

Pattern 03

Speed of substitution

Digital categories can be reshaped quickly by adjacent entrants with stronger distribution, lower cost or better data advantages.

03 / Forces

Five market forces, applied to commercial risk.

Five forces shape the structural reality of any market. The best-known version of this framework was introduced by Michael Porter in Harvard Business Review in 1979 and remains a useful lens for reading competitive structure. Used commercially, it helps leadership teams identify where pressure is most likely to compound. High buyer power can compress margins until service quality suffers. Concentrated suppliers can turn a narrow vendor base into a major operating vulnerability. Low entry barriers can make market share harder to defend. Strong substitution risk can cap returns even when execution is good. Direct rivalry sets the baseline competitive intensity for everything else.

Five forces mapped to commercial pressure.

Reference framework HBR 1979
Force 01

Buyer power.

High buyer power weakens pricing control and forces ongoing proof of value. In markets with low switching friction, commercial strength can erode faster than product teams expect.

Pressure type Margin
Common signal Pricing pull

In digital markets, these forces are often amplified by rapid product cycles, accelerated customer comparison, scalable distribution and lower switching costs. Structural awareness lets businesses move from reactive explanation to proactive positioning.

Healthy Diverse suppliers, pricing power, sticky demand and lower substitution pressure.
Mixed Growth remains possible, but resilience depends on managing concentration and bargaining imbalance carefully.
Exposed Weak differentiation, thin margins and external leverage combine to make disruption harder to absorb.
04 / Resilience

Industry evolution and the path to operating resilience.

Industries evolve through shifts in technology, regulation, customer behaviour, capital availability and global events. Disruption usually gains traction where structural inefficiencies already exist. It becomes more severe where dependency is concentrated, margins are thin or operating models have been built around assumptions that no longer hold.

Operating resilience has moved from being an internal preference to a formal expectation for many regulated financial services firms. Across the UK, US and EU, the wording and scope differ, but the direction of travel is similar: firms in scope are expected to understand the services that matter, identify where disruption can bite, and evidence how they remain within tolerable levels of impact.

Operating resilience, three jurisdictions.

UK · US · EU
UK

Important business services framework.

Firms in scope identify important business services, set impact tolerances, carry out mapping and testing, and address vulnerabilities in operational resilience.

Effective 31 March 2022
US

Sound practices for operational resilience.

Joint guidance from the Federal Reserve, OCC and FDIC describes supervisory expectations for large banking organisations strengthening resilience to operational disruption.

Issued 30 October 2020
EU

Digital Operational Resilience Act.

DORA harmonises rules on ICT risk, incident reporting, resilience testing and oversight of critical third party providers for financial entities in scope.

Applicable from 17 January 2025

How healthy structure becomes disruption-ready.

4 phases · cumulative
Phase 01 Healthy Diverse counterparties, pricing power and operational optionality.
Phase 02 Comfortable Concentration creeps in. Convenience starts to outweigh resilience review.
Phase 03 Embedded Dependencies stop being tested. Assumptions become invisible infrastructure.
Phase 04 Exposed A single shift exposes how much leverage was sitting elsewhere all along.

New entrants often do not win simply because they are new. They win because they exploit friction that incumbents have normalised. They move faster where legacy systems are slow, bundle value where categories have become fragmented, or remove cost where the market has accepted inefficiency for too long. Structural analysis helps explain why those openings exist.

Disruption tends to succeed where structure was already fragile, incentives were already misaligned, or the industry had become too dependent on assumptions nobody was testing properly.

Operating resilience is not about predicting every market shift correctly. It is about building an operating model that can absorb pressure without immediately losing strategic position. That may mean diversifying supplier exposure, reducing dependency on a single channel, improving contractual control, strengthening customer stickiness or building better visibility across the systems that matter most.

The firms that navigate industry evolution best are usually the ones that treat structural awareness as a strategic discipline rather than a periodic exercise. They review where leverage sits, where optionality is shrinking, where substitution risk is rising and where hidden fragility could turn a manageable change into a serious commercial setback. That review is the foundation of any serious approach to operating resilience, platform risk, contract risk and payment risk.

Strategic takeaway

Industry structure is not background theory. It sits underneath pricing power, resilience, growth quality and the durability of the business model itself. The more clearly leadership understands those structural conditions, the more intelligently it can allocate attention, capital and defensive effort.

Continue across the desk
Membership

Go deeper with 365 Risk Desk.

Independent commercial risk intelligence for founders, operators and finance leaders building scaling businesses across the UK, US and EU. Built to help readers understand pressure earlier, think more clearly and make better strategic calls under uncertainty.

Explore membership

Sources and attribution

  1. Porter, M. E. (1979). How Competitive Forces Shape Strategy. Harvard Business Review, March-April 1979.
  2. Financial Conduct Authority and Prudential Regulation Authority. Operational resilience: impact tolerances for important business services. Rules and guidance effective from 31 March 2022 for firms in scope.
  3. Board of Governors of the Federal Reserve System, Office of the Comptroller of the Currency and Federal Deposit Insurance Corporation. Sound Practices to Strengthen Operational Resilience. Issued 30 October 2020.
  4. European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. Applicable from 17 January 2025 to financial entities in scope.
  5. 365 Risk Desk independent commercial risk intelligence framework, 2026.