Platform Dependency Research Note

Platform Dependency Research Note

Working definition

A platform dependency is an externally controlled input, interface, market, or capability whose change can materially affect a product's customer value, economics, continuity, differentiation, or strategic options.

Dependence is not automatically a defect. Every company relies on suppliers and complements. The strategy question is whether the company understands the control point, can detect change, and has a credible response within the time available.

Primary evidence

Ron Adner's ecosystem-as-structure paper treats an ecosystem as the alignment of actors and activities required for a value proposition. The framework supports mapping interdependence around the customer result rather than treating every partner relationship as equivalent.

The NIST Cloud Computing Standards Roadmap defines portability and interoperability as capabilities that allow data and applications to move or work across cloud systems at acceptable cost. It is a federal technology roadmap, not a general proof of business performance.

NIST's Cybersecurity Supply Chain Risk Management project frames supply-chain work as identifying, assessing, and mitigating risk across interconnected technology suppliers. The July 2026 ICT supplier due-diligence guide emphasizes provenance, resilience, foundational cyber practices, supply-chain tiers, and foreign ownership or control. These sources focus on cybersecurity and public-sector use, but their inventory and resilience logic is a useful bounded analogy.

Control-point model

Mitigation choices

Redundancy is useful only if the second path works under load and the company can operate it. Abstraction helps only if provider differences do not leak through the product. Contracts help only within their scope and enforcement reality. Vertical integration can increase control while consuming time and capital. Deliberate acceptance is legitimate when the cost of mitigation exceeds the risk and the decision is monitored.

The public guide should require a timed switching test, not a slide that names alternatives. It should also separate technical substitution from business continuity. A product may move inference to another model but still lose distribution, customer confidence, or economics.

Windsurf boundary

E077 discussed Windsurf's dependence on models and the competitive position of large providers. The reviewed evidence does not establish that platform dependence caused the OpenAI talks to fail, caused Google's arrangement, or forced Cognition's acquisition. Windsurf should appear only as the episode context that motivated the broader framework.