Tier 2 and Tier 3 Supplier Risk: How to Find the Hidden Dependencies Beneath Your Supply Chain

You know your Tier 1 suppliers. This guide shows how to find what they all depend on, how to spot Tier 2 supplier risk and hidden concentration risk, and where Decision Intelligence picks up when visibility runs out.

Key takeaways

Most companies see Tier 1 clearly. McKinsey found 60% of supply chain leaders have comprehensive Tier 1 visibility, while visibility into deeper tiers fell for the second straight year.
The supplier most likely to disrupt you is often one you never contract with. A Sphera survey of 250 procurement and supply chain chiefs found 85% of risk incidents occur at Tier 2 through Tier 4.
Three healthy Tier 1 suppliers can share one point of failure underneath. That is hidden concentration risk, and you cannot see it by monitoring suppliers one at a time.
AI infrastructure makes the problem bigger. Large power transformers now take up to five years to arrive, and one company builds every EUV lithography machine used for advanced chips.
Rank suppliers by Dependency Power, not spend. Ask what stops working without them and how long a replacement would take.

A $15 billion data center is really a dependency network

On October 1, 2026, JERA, Dell Technologies and RHAELM announced a plan to build a $15 billion, 400-megawatt hyperscale AI data center in Chiba, Japan (Reuters via KSL). JERA, the country’s largest power generator, will provide land next to its Chiba power station and supply 400 MW under a 15- to 25-year agreement. RHAELM will develop, build, operate, and finance the facility, and Dell will supply standardized rack-scale AI infrastructure.

Apollo Global Management is expected to serve as RHAELM’s strategic investment and financing partner (Finimize). The partners plan phased operations in 2028 and full capacity in 2029.

On the surface, it is an AI infrastructure project. One layer down, it is a dependency network.

The servers depend on racks. The racks depend on chips, networking, cooling, and electrical equipment. The building depends on construction crews, transformers, switchgear, and skilled labor. All of it depends on 400 MW of reliable electricity. Every one of those dependencies has dependencies of its own.

That is where supply chain visibility usually breaks down.

What are Tier 1, Tier 2, and Tier 3 suppliers?

Tier 1 suppliers sell to you directly. Tier 2 suppliers sell to your Tier 1 suppliers. Tier 3 suppliers sit further upstream, usually as raw material processors, specialty manufacturers, or equipment makers. Most companies hold contracts only at Tier 1, so anything below it is visible only if a supplier chooses to share it.

Tier	Who they are	Example in an AI data center	Who usually monitors them
Tier 1	Companies you contract with directly	Server vendor, electrical contractor, cooling integrator	Your procurement team
Tier 2	Suppliers to your Tier 1 suppliers	Chipmaker, switchgear manufacturer, chiller maker	Your Tier 1 supplier, sometimes
Tier 3	Suppliers to Tier 2	Lithography tool maker, grain-oriented steel mill, specialty foundry	Often nobody
Deeper tiers	Materials, processes, infrastructure	Copper, rare earths, ports, regional power grids	Rarely tracked as suppliers at all

Why supply chain visibility stops at Tier 1

Visibility stops at Tier 1 because that is where contracts, scorecards and procurement systems stop. Sophisticated companies know their major suppliers. They have approved vendor lists, risk ratings, and quarterly reviews. They know Tier 1.

The data shows how sharply that knowledge drops off below it:

60% of supply chain leaders report comprehensive visibility of their Tier 1 suppliers, yet the share with good visibility into deeper tiers fell by seven points, its second annual decline (McKinsey Global Supply Chain Leader Survey 2024).
45% of organizations have no upstream visibility at all or can see only Tier 1 suppliers, according to McKinsey’s 2025 risk research (as reported by CXTMS).
85% of risk and critical incidents occur at Tier 2 through Tier 4, according to a Sphera survey of 250 chief procurement and supply chain officers (as reported by ChainLink).

Put those together, and the problem is clear. The supplier most capable of disrupting your business may not be a Tier 1 supplier at all. It may be a Tier 2 supplier your team has never contracted with, a Tier 3 supplier your Tier 1 does not watch, or one machine in one facility that never made it onto the risk dashboard.

The Tier 1 supplier can look perfectly healthy while something beneath it turns fragile. A specialty foundry falls behind. A material tightens. A port closes. Nothing has happened to your Tier 1 supplier yet, so the dashboard stays green. By the time the disruption reaches Tier 1, the window to respond has shrunk.

Monitoring the supplier is not the same as understanding the supply chain.

What is hidden concentration risk?

Hidden concentration risk is when suppliers you believe are independent all depend on the same company, material, facility, or piece of infrastructure further down the chain. Procurement sees diversification. The supply chain sees a single point of failure.

Imagine three Tier 1 suppliers. All three look healthy. But at Tier 2 or Tier 3, all three rely on the same specialty foundry, the same raw material, the same port, or the same source of power. You do not have three independent supply chains. You have three paths to the same failure.

Hidden concentration risk: three Tier 1 paths, one Tier 3 dependency.

Tier 2 supplier risk: three Tier 1 paths share one Tier 3 dependency You cannot find this by monitoring Tier 1 suppliers one at a time. You have to map the system.

A real example: the 2021 Renesas fire. A fire at Renesas Electronics’ Naka plant in Japan destroyed 11 manufacturing machines, about 2% of the plant’s equipment, and Renesas put the cost at roughly 17 billion yen a month (Equities.com). Renesas held about 35% of the automotive semiconductor market at the time (AFP via TechXplore). Its direct customers were mostly auto parts makers, not the carmakers themselves (Reuters via Nippon.com). Toyota, Honda and Nissan had to assess their exposure to a supplier that sat at least one tier below their own contracts.

How the AI infrastructure buildout multiplies hidden dependencies

Every AI data center branches into at least three dependency chains: compute, power, and cooling. Each one narrows to a handful of suppliers a few tiers down. Start with the capability everyone sees, AI compute, and follow each branch until the number of credible alternatives gets very small.

AI data center dependency network AI data center dependency tree · compute, power and cooling branches

Two of those endpoints are already binding constraints.

Power: large power transformers. Before 2020, high power transformers arrived 24 to 30 months after an order. They can now take up to five years, while an AI data center can be built in under 18 months (Vucense, citing Bloomberg and Sightline Climate). PwC analysts put lead times for high capacity units at up to four years (pv magazine USA). A site can have land, permits and a tenant and still miss its date because one piece of electrical equipment is still in a factory queue.

Compute: EUV lithography. ASML is the only company that makes the extreme ultraviolet lithography machines needed to produce every advanced processor chip in use today (CNBC). Each machine draws on hundreds of thousands of components from a global supplier base. A data center buyer never contracts with ASML. Every advanced chip in its racks depends on ASML anyway.

The Chiba project’s design reflects this. By building next to an existing JERA power station with a long-term supply agreement, the partners lock in the dependency most likely to delay everything else.

Those endpoints deserve disproportionate attention.

Dependency Depth and Dependency Power

Dependency Depth is how many tiers you must travel before alternatives disappear. Dependency Power is how much of your outcome stops if that dependency fails. At Polaris I/O, we use both to decide where attention belongs.

The question is not “Who are my suppliers?” It is “What does my outcome depend on?” Then ask what that depends on, and keep going until substitution becomes slow, difficult or impossible inside the decision window that matters. That is often where the real risk lives.

Spend is a poor proxy. A supplier that represents 1% of procurement spend can carry more Dependency Power than one at 20% if losing it stops an entire program.

dependency power

Supply chain visibility vs Decision Intelligence

Supply chain visibility tells you a hidden dependency exists. Decision Intelligence tells you what to do about it while there is still time. Finding a Tier 3 dependency is valuable. Finding it early enough to change the outcome is far more valuable.

Suppose Polaris identifies that four Tier 1 suppliers depend on the same Tier 3 manufacturer. That opens a set of decisions:

Is there another supplier, and does it have available capacity?
How long would qualification take?
Can inventory be repositioned or capacity reserved?
Should we fund additional capacity or partner with the supplier?
Should we invest in it or acquire it?
Can we redesign the dependency out entirely?

Visibility shows the map The goal is not a more impressive map. The goal is time to act.

How do you find Tier 2 and Tier 3 supplier risk?

Start with the outcome you need to protect, work backward through every tier, then monitor the signals around the dependencies that matter most. Traditional supplier management starts with the companies you know. This approach starts with what cannot fail.

Name the outcome. Pick the mission, program, facility, or capability you cannot afford to lose. A 400 MW data center energization date is an outcome. A supplier list is not.
Decompose it. Break the outcome into systems, subsystems, and components. Assign each component to the Tier 1 supplier that delivers it.
Follow each component down. Trace Tier 2, Tier 3, and below until you reach the material, process, equipment, geography, or infrastructure it depends on. Stop where alternatives become scarce.
Look for convergence. Overlay the branches. Anywhere two or more “independent” suppliers meet at the same company, site, material, or port is hidden concentration risk.
Score Dependency Power. Rate each convergence point on criticality, concentration, replacement time, alternative capacity, depth, and downstream consequence. Rank by consequence, not spend.
Monitor the signals, not just the supplier. Watch capacity changes, financial pressure, leadership turnover, hiring, plant expansions and closures, regulatory changes, commodity pressure, geopolitical events, logistics constraints and capital investment. One signal may mean little. Several connected signals across a critical dependency can mean a great deal.
Decide while there is time. For each ranked risk, set the options, the owner, and the date by which a decision must be made. That turns a supplier list into a living model of the system.

Polaris I/O vs 6sense: what is the difference?

6sense tells revenue teams which accounts are researching a purchase. Polaris I/O tells operators, buyers, and investors where risk and opportunity are forming across a network of companies, often before anyone is researching anything. Both use signals and AI. They answer different questions for different teams.

6sense describes itself as a Revenue AI platform built on intent data, predictive analytics, and sales and marketing orchestration. Its predictive models score accounts and buying group members on how likely they are to convert, and its AI agents run campaigns across ads, email, and tools such as Salesforce and LinkedIn (6sense). It is built to help B2B marketing and sales teams find and engage in market buyers.

Polaris I/O works earlier in the chain of events. We call it pre-intent signal intelligence: reading the operating changes inside companies, such as capacity shifts, financial pressure, leadership moves, plant openings and closures, that precede a need, a failure, or a decision. In supply chain, that means connecting those signals to the dependencies beneath your Tier 1 suppliers.

	6sense	Polaris I/O
Category	Revenue AI, account-based marketing	Decision Intelligence, pre-intent signal intelligence
Core question	Which accounts are in market to buy?	Where is risk or opportunity forming, and what will it affect?
Primary users	Marketing, sales and RevOps teams	Supply chain, procurement, operations, strategy and investment teams
Signal type	Buyer intent: research activity, web engagement, firmographics, technographics	Operating signals: capacity, financial health, leadership, hiring, facilities, regulation, geopolitics, logistics
Unit of analysis	An account and its buying group	A network: suppliers, sub-tiers, facilities, programs, markets
Typical output	In-market scores, buying stage, campaign orchestration	Dependency maps, concentration alerts, ranked risks with time to act
Timing	When buyers are actively researching	Before a disruption or need becomes visible

Which one do you need? If your goal is generating pipeline from accounts already researching your category, 6sense is built for that. If your goal is protecting a program, facility or investment from risk forming several tiers down, that is the problem Polaris I/O was built to solve. Some organizations use both.

Frequently asked questions

What is the difference between Tier 1, Tier 2 and Tier 3 suppliers?

Tier 1 suppliers sell directly to your company. Tier 2 suppliers sell to your Tier 1 suppliers. Tier 3 suppliers sell to Tier 2 and are often raw material processors, specialty manufacturers, or equipment makers.

Why are Tier 2 and Tier 3 suppliers a bigger risk than Tier 1?

They are harder to see and rarely monitored. A Sphera survey of 250 procurement and supply chain chiefs found 85% of risk incidents occur at Tier 2 through Tier 4, while most companies have good visibility only at Tier 1.

What is hidden concentration risk in a supply chain?

Hidden concentration risk is when several suppliers that look independent depend on the same company, facility, material, or infrastructure further down the chain. One failure at that point disrupts all of them at once.

How do you identify Tier 2 and Tier 3 supplier risk?

Start from the outcome you need to protect, decompose it into components, trace each component down through every tier, and look for points where branches converge. Then monitor external signals around those points continuously.

What is Dependency Power?

Dependency Power measures how much of your outcome stops if a dependency fails. It weighs criticality, concentration, replacement time, alternative capacity, depth, and downstream consequence, rather than procurement spend.

What is Decision Intelligence in supply chain management?

Decision Intelligence connects signals across suppliers, markets and facilities to show where risk is forming, what it could affect and how much time remains to act. Visibility shows the map. Decision Intelligence shows the options.

What are the biggest supply chain risks for AI data centers?

Power equipment and advanced chips. Large power transformers can take up to five years to deliver, and every advanced chip depends on EUV lithography machines that only ASML makes.

Is Polaris I/O a 6sense alternative?

Not directly. 6sense identifies accounts showing buying intent for sales and marketing teams. Polaris I/O detects pre-intent operating signals across companies and their dependencies for supply chain, operations, strategy, and investment teams.

The question leaders should be asking

The question is not whether you know your suppliers. Most companies do. The better question is how far down your supply chain you can actually see. The uncomfortable follow-up is where suppliers you believe are independent secretly depend on the same thing.

For a $15 billion AI data center, the answer might be a transformer, a lithography tool, a cooling component, or 400 MW of reliable electricity. For a defense program, it might be a specialty casting several tiers beneath the prime. For an energy project, it might be one Tier 2 manufacturer supplying several work packages. For a manufacturer, it might be a material nobody inside the company buys directly.

The pattern is the same. The most important dependency in your supply chain may be a company you have never heard of. You need to find it before everyone else does.

Polaris I/O continuously connects signals across suppliers, markets, facilities, programs, and the dependencies beneath them. We help organizations see where risk is forming, understand what it could affect, and decide where there is still time to intervene.

Knowing your Tier 1 suppliers is important. Knowing what they all depend on is Decision Intelligence.

Talk to Polaris I/O about mapping the dependencies beneath your most critical programs.