Provider dependency is the situation where a cloud service, platform, or managed tool becomes so central to an environment that changing vendors, moving workloads, or restoring service elsewhere is difficult. The dependency may come from proprietary APIs, identity systems, storage formats, network design, or managed services that have no easy equivalent outside one provider.
In cyber security, this matters because it can weaken resilience and bargaining power. If an attacker disrupts a provider account, a control plane, or a critical service, the customer may have limited recovery options. A strong dependency can also make audit, incident response, and legal or geographic compliance harder. Defenders reduce the risk by designing for portability, using open standards where possible, documenting exit paths, testing backup and restore outside the primary platform, and avoiding single points of failure in identity, logging, and data storage.