Digital sovereignty: Can you measure your vendor lock-in across the entire IT landscape?

The debate on digital sovereignty often reaches the same conclusion: we must abandon Big Tech. While this sounds decisive, it is rarely the actual decision management needs to make. The question is more pragmatic: Can we continue delivering value to our customers and citizens if access, pricing, or terms are altered externally?

Professor Jan Damsgaard from CBS, who explored the topic in his book Digital Sovereignty, makes a clear distinction between two concepts: Independence means standing alone. Sovereignty means being able to stand firm. He also points out that multi-vendor sourcing does not inherently create sovereignty, and that the subject should be understood as a capability rather than an ideological stance.

This is a critical distinction because it shifts the conversation from ideology to strategic maneuverability. And strategic maneuverability is something you can measure.

Why "We Are Dependent" Is Insufficient for Decision-Making

All organizations rely on vendors—and this is fundamentally sound. The critical question is not whether dependency exists, but where it is concentrated, how mission-critical it is, and what resources would be required to transition away from it.

Many executive teams sense that a handful of vendors carry significant weight. Far fewer possess concrete metrics to inform strategic decisions. Without a shared metric, discussions easily default to intuition, and the strongest voice dictates direction.

The Value of the Dependency Score

In Damsgaard's framework, the dependency score provides visibility into vendor concentration across the entire technology stack. The metric gives leadership a unified framework to identify where the primary lock-in resides, and where an exit-by-design strategy can realistically begin.

The objective is not simply to chase a lower score. The objective is to identify precisely where in the stack a single vendor carries disproportionate operational risk, and then make an informed choice as to whether this constitutes an unacceptable risk or an acceptable strategic dependency.

The Metric Is Only Half the Picture

Two organizations can have an identical dependency score yet occupy vastly different risk profiles. One can transition within months. The other is constrained by proprietary data formats, long-term contracts, niche expertise, and processes tightly coupled with a single vendor's operational model.

Therefore, we evaluate not only concentration, but also the operational viability of an exit and the organization's resilience should a disruption occur. Here, we align with the book's logic: Sovereignty is the capability to pivot or substitute, not merely a question of where a vendor is headquartered.

Key strategic questions that inform this evaluation include:

• Can data be extracted in a format we can utilize independently?

• What is the required investment in time and budget to execute a transition, and which stakeholders must be involved?

• When can the agreement realistically be terminated, and what are the operational implications during the transition period?

• Does the requisite technical expertise exist internally, or does it reside exclusively with the vendor?

• Which core business processes are disrupted if the vendor fails to deliver?

An Architectural Imperative

Dependencies do not exist in isolation. They are embedded across applications, infrastructure, data pipelines, legal contracts, and business processes. A metric disconnected from underlying systems, processes, and business ownership offers limited actionable insight.

This is the very correlation mandated by regulations such as NIS2 and DORA regarding third-party risk management and vendor governance. An organization that maintains a cohesive architectural overview can address both regulatory compliance and digital sovereignty requirements using the same unified dataset.

Interpreting the Results

A dependency score delivers maximum insight when assessed alongside exit feasibility. Three strategic profiles emerge:

• High dependency, low exit barrier. A calculated dependency. Strategic maneuverability is preserved, and the risk posture is adopted deliberately.

• Moderate dependency, high exit barrier. This represents the classic hidden risk. Concentration appears manageable on the surface, but transition pathways are restricted.

• High dependency, high exit barrier. The heavy anchor. In this scenario, evaluating where to initiate an exit-by-design framework is critical, even if there is no immediate intent to transition.

Our Approach

We operationalize the dependency score in accordance with Jan Damsgaard's methodology, utilizing his conceptual framework with his endorsement. The model is his, and we build upon it rather than reinventing the wheel. Our contribution is mapping this metric directly to your enterprise landscape, correlating it with systems, processes, and commercial contracts.

If you wish to evaluate the profile of your core vendors, we offer a scoped baseline assessment for selected strategic partners. This is non-binding and designed to provide management with a concrete, data-driven foundation for internal strategic alignment.

A Strategic Question for Leadership

If your primary technology vendor altered commercial terms tomorrow, how long would it take your organization to pivot, and who currently holds the answer?

📅 We welcome your perspective at clariox.dk/contact

The concepts of the dependency score, the heavy anchor, and exit-by-design originate from Jan Damsgaard and the book "Digital Sovereignty".

Troels Rendbæk Sørensen, CEO & Founder