Strong product and team can still hide structural risks that show up later. Customer concentration and other “one thing goes wrong and the company breaks” dynamics are among the most common. Here’s how to spot them and what to do.
Customer concentration
The risk: One or a few customers make up a large share of revenue. Loss or delay from one of them blows up the plan.
What to look for: Top 1–3 customers as % of revenue or pipeline. Contract length and renewal timing. Whether the “reference” customers are also the only paying ones.
Red zone: More than 30–40% from a single customer, or more than 50–60% from top three, with no clear path to diversify in the next 12–18 months.
What to do: Don’t assume it will diversify. Ask for a realistic plan and milestones. Price the risk into valuation or structure (e.g. milestones, information rights) if you still want to invest.
Single channel or single decision-maker
The risk: All revenue or growth depends on one channel (e.g. one platform, one partner) or one relationship (e.g. one buyer, one champion). If that goes away, growth stops.
What to look for: “Our growth comes from…” — if the answer is one thing, dig in. Same for “our sales motion is…” or “our key partner is…”.
Red zone: No evidence of a second channel or second champion in the pipeline. Founder can’t articulate what they’d do if the main one disappeared.
What to do: Ask for a diversification plan and timeline. Treat as higher risk until there’s proof of a second path.
Key person dependency
The risk: One person (often the CEO) is the only one who can sell, fundraise, or make critical decisions. No succession, no backup.
What to look for: Who is in the room for key customer and investor conversations? Who would run the company if the CEO got hit by a bus (or left)?
Red zone: Founder admits they do all enterprise sales, or all key relationships sit with one person with no plan to scale that.
What to do: Understand the plan to reduce dependency (hiring, process, delegation). If there’s no plan, factor it into risk and support (e.g. board focus on building bench).
Technical or operational single points of failure
The risk: One vendor, one integration, one piece of tech, or one facility is critical. If it goes away or breaks, the business can’t operate or ship.
What to look for: “We run on…”, “We depend on…”, “If X went away we’d…”. Ask what happens when a key vendor changes terms or a critical integration is deprecated.
Red zone: No backup, no migration path, and the founder hasn’t thought it through.
What to do: Ask for a continuity or migration plan. If the answer is “we’d figure it out,” treat as a risk and document it.
Cap table or governance time bombs
The risk: A messy cap table, weird preferences, or governance that will block future rounds or create misalignment. Not always visible in the deck.
What to look for: Who’s on the cap table, what preferences exist, whether there are side letters or commitments that could surprise the next round.
Red zone: Founder is vague or defensive about cap table, or you hear “we’ll clean it up later.”
What to do: Get the full picture before term sheet. “We’ll fix it later” often means “we’ll fix it with your money and your round.”
Structural risks aren’t always deal killers — but they should be named, sized, and either mitigated or priced in. The best investors spot them early and decide consciously instead of discovering them after the wire.
