Customer Concentration Risk in SaaS Filings

The most dangerous risk in a SaaS filing is the one that looks fine on the growth chart and detonates in a single churn event. That risk is customer concentration, and it hides in plain sight.

Customer concentration risk in SaaS is the exposure that comes from depending on a small number of large customers for a large share of revenue. A 40% growth rate can mask it completely, right up until one logo leaves and the next quarter’s growth rate collapses.

Filings disclose this in two quiet places: the revenue-concentration note and the risk factors section. Neither one shouts. Both are required, and an operator reads them together, because one tells you the size of the exposure and the other tells you what happens when it breaks.

This piece reads concentration through real S-1s and 10-Ks, not narrative. Every company figure below ties to a specific filing and fiscal period. The framing is analytical: how to size and stress-test the risk, not what to do about any stock.

Key takeaways

• Concentration hides behind growth. A company can grow 40% and still have a single churn event waiting to cut its growth rate in half. The growth line does not show the exposure; the footnotes do.
• It lives in two disclosures. The revenue-concentration note gives the percentage; the risk factors section gives the consequence. Read both (per the methodology a filing follows, the note states the fact and the risk factor states the failure mode).
• The 10% line is a floor, not a measure. “No single customer exceeded 10%” tells you only the maximum single logo. Datadog disclosed its top 10 customers were about 14% of ARR (Datadog Form S-1, FY ended June 30, 2019), which is the number that actually informs.
• Logo concentration is structural in enterprise SaaS. Slack disclosed roughly 575 large customers, under 0.1% of its base, drove about 40% of revenue (Slack Form S-1, FY ended January 31, 2019).
• Related parties are hidden concentration. A top customer that is also an investor or board affiliate is concentration the headline percentage does not capture; the SEC requires it disclosed separately.
• Concentration has a price. Higher single-customer concentration tends to carry a valuation discount, because the market prices in the churn it cannot see on the growth chart.

The concentration trap: why growth charts hide customer concentration risk

A revenue chart is a sum. It tells you the total moved up. It does not tell you how many customers produced the increase, or how lopsided the contribution was.

That is the trap. A company can post 40% growth while a handful of accounts carry most of the new revenue. The chart rewards the headline and buries the structure underneath it.

Concentration risk is the gap between the smoothness of that chart and the lumpiness of the customer base behind it. The smoother the chart looks, the more important it is to ask how few customers are producing it.

This is the same instinct that separates a vanity metric from a load-bearing one. A growth rate without a customer distribution behind it is the SaaS equivalent of revenue without gross margin: a number that looks like health until you decompose it. The discipline of decomposing a headline into the structure beneath it runs through every part of reading a filing, and it is the core of how to read a tech S-1 like an operator.

The danger compounds because concentration and growth often travel together. The fastest way to grow a young SaaS company is to land a few large customers fast. That is exactly the move that builds concentration. The growth you are celebrating and the risk you are not measuring are frequently the same deals.

Where SaaS companies disclose concentration: revenue notes and risk factors

Concentration appears in two required places in a filing, and they do different jobs. The revenue-concentration note states the factual percentage. The risk factors section states why that percentage matters and what breaks if a large customer leaves.

The revenue-concentration note usually sits in the MD&A or in a footnote to the financial statements (often the revenue-recognition or significant-accounting-policies note). It reads like a fact: “no single customer accounted for more than 10% of revenue,” or “our top 10 customers represented 14% of ARR.” It is dry, specific, and easy to skim past.

The risk factors section translates that fact into consequence. It reads like a warning: “the loss of one or more of our largest customers, or a reduction in their spending, could materially harm our revenue and growth rate.” Every SaaS company with meaningful concentration carries some version of this language, and the SEC expects it.

Reading only one of the two is the common mistake. The note without the risk factor gives you a number with no failure mode. The risk factor without the note gives you a warning with no magnitude. Together they let you size the exposure and price the break. This is the same dual read you apply to retention, where the headline number and its definition have to be checked against each other, a discipline detailed in gross retention vs net retention in SaaS IPOs.

What does “no single customer exceeded 10%” really tell you?

It confirms only that the largest customer is below the line that would force a name. It says nothing about whether the top 5 or top 10 customers are concentrated. Datadog’s disclosure that its 10 largest customers were about 14% of ARR (Datadog Form S-1, FY ended June 30, 2019) is far more informative. Always ask for the top-N distribution, not just the single-customer threshold.

The 10% threshold is the most common concentration disclosure, and the most commonly misread. Under SEC rules (Regulation S-K, Item 101), a company must disclose any single customer that accounts for 10% or more of consolidated revenue, because losing that customer would have a material effect.

So “no single customer exceeded 10%” means exactly one thing: the largest customer is below the line that would force a name. It does not mean the business is diversified. The top 5 customers could be 9% each and add to 45% of revenue, and the company could still truthfully write that sentence.

This is why the single-customer threshold is a floor, not a measure. It tells you the worst single logo is under 10%. It tells you nothing about the shape of the top of the customer base, which is where concentration actually lives.

The more informative disclosures are the voluntary ones: the top-10 share, the top-100 share, or the share from customers above a spend tier. When a company volunteers that its 10 largest customers are 14% of ARR, it is handing you the distribution. When it stops at the 10% line, you have to ask for more.

The follow-up question is always the same. Given the threshold disclosed, what is the next layer down? A company comfortable with its concentration usually shows you the top-10 or top-100 figure unprompted. A company that stops at the regulatory minimum may be telling you something by what it leaves out.

The Concentration Risk Checklist

Here is the original analytical asset for this piece: the Concentration Risk Checklist. It maps the four places concentration hides in a filing, the threshold that matters for each, and the follow-up question that turns a disclosure into a sized risk. The framework is original; the thresholds reflect standard SEC disclosure rules and common SaaS reporting practice. Name it so you can reuse it: run any filing through these four rows.

Where it hides	What the filing says	The threshold that matters	The follow-up question
Single-customer note	”No single customer exceeded 10% of revenue”	The 10% SEC disclosure rule (Reg S-K) forces a name above this line	What is the actual largest customer share, and how close to 10% is it?
Top-N distribution	”Top 10 customers were 14% of ARR” (when volunteered)	No fixed rule; voluntary. The shape of the top is the real measure	If only the single-customer line is given, what is the top-10 or top-100 share?
Risk factors language	”Loss of a large customer could materially harm revenue”	Qualitative; required when concentration is material	What does losing the single largest customer do to next year’s growth rate?
Related-party / investor overlap	Disclosed separately under related-party rules	Any top customer that is also an investor or board affiliate	Are any of the largest customers also on the cap table or board?

The checklist forces the read in order. Start at the single-customer note to find the floor. Move to the top-N distribution to find the shape. Read the risk factors to find the failure mode. Cross-check related parties to find the concentration the percentages hide.

A worked example from a real filing: Datadog’s S-1 (FY ended June 30, 2019) disclosed that no single customer exceeded 5% of ARR and that its 10 largest customers represented approximately 14% of ARR. Run that through the checklist. The single-customer floor is low (under 5%). The top-10 shape is mild (14%). The implied risk-factor consequence is modest, because no one logo or small cluster moves the growth rate much. That is a diversified revenue base, and the checklist makes the diagnosis mechanical rather than a vibe.

Three real examples: Datadog, Slack, and Asana show the spread

Concentration is not one number; it is a spread, and three filings show how wide it runs. Datadog, Slack, and Asana all disclosed concentration, and the disclosures describe three different businesses.

Company (filing)	Largest single customer	Top-tier concentration	What it tells you
Datadog (S-1, FY ended June 30, 2019)	Under 5% of ARR	Top 10 customers ≈ 14% of ARR	Broadly diversified; no single logo or small cluster moves growth
Slack (S-1, FY ended Jan 31, 2019)	Not the binding figure	~575 customers above $100K ARR (<0.1% of base) ≈ 40% of revenue	Revenue concentrated in a thin enterprise top layer, by design
Asana (S-1 / 10-K, FY ended Jan 31, 2021 and 2020)	Under 1% of revenue	Top 100 customers ≈ 11% (FY2021) and 9% (FY2020) of revenue	Very diversified; long tail of smaller accounts

Sources: Datadog, Inc. Form S-1, fiscal year ended June 30, 2019; Slack Technologies, Inc. Form S-1, fiscal year ended January 31, 2019; Asana, Inc. Form S-1 and Form 10-K, fiscal years ended January 31, 2021 and 2020.

Read the spread. Datadog and Asana sit at one end: no single customer is large, and the top tier is a small slice of revenue. Asana’s largest customer was under 1% of revenue, and its top 100 customers were only about 11% (Asana Form S-1 and 10-K, FY ended January 31, 2021). That is a business where churn in any one account is a rounding error.

Slack sits at the other end, and it is instructive precisely because it is not a problem. Roughly 575 customers, under 0.1% of the base, drove about 40% of revenue (Slack Form S-1, FY ended January 31, 2019). That is logo concentration, the structural reality of land-and-expand enterprise SaaS, where a thin top layer of large accounts carries the revenue. It is not a defect. But it does mean the top 100 to 500 accounts are the business, and churn there moves the growth rate in a way the broad customer count never reveals.

The pattern generalizes across the public SaaS set. Okta disclosed no single customer above 10% of revenue or accounts receivable (Okta Form 10-K, FY ended January 31, 2019 and 2018). Zoom disclosed no single customer at 10% or more of total revenue across FY2022, FY2023, and FY2024 (Zoom Form 10-K, FY ended January 31, 2024). Twilio disclosed no customer organization above 10% of total revenue in 2024 (Twilio Form 10-K, FY2024). MongoDB disclosed no customer at 10% or more of revenue for the year ended January 31, 2024 (MongoDB Form 10-K, FY ended January 31, 2024). The single-customer line clears the bar across the board, which is exactly why the top-N distribution, not the 10% threshold, is the number that separates these businesses.

What is the relationship between customer concentration and valuation multiple?

As a framework, higher single-customer concentration tends to carry a valuation discount, because the market prices in the risk of that customer leaving. Diversified businesses, where no customer is large enough to matter, generally command steadier multiples. This is analysis of how multiples behave under concentration, not a recommendation about any stock.

The mechanism is straightforward: concentration makes revenue less predictable, and the market pays less for revenue it cannot count on.

A business where the largest customer is 1% of revenue has a revenue base that behaves like a statistical average. No single departure moves it much. A business where one customer is 15% has a revenue base with a tail risk attached: a single decision at a single company can cut the growth rate, and that risk gets priced.

This is the same logic that prices retention and margin into a multiple. Predictable, durable, high-margin revenue earns a steadier multiple; lumpy, concentrated, or low-margin revenue earns less. The margin half of that equation is the whole argument in why gross margin is destiny in SaaS, and concentration is the revenue-durability half of the same coin.

The discount is not a fixed number, and any specific figure would be a fabrication, so treat it qualitatively. The direction is reliable: more concentration, more discount, all else equal. The magnitude depends on how large the top customers are, how long their contracts run, how high the switching costs are, and whether the concentration is improving or worsening over time.

This is also why concentration interacts with the rest of the IPO scorecard rather than standing alone. A concentrated business with 130% net revenue retention and multi-year contracts is a different risk than a concentrated business with flat retention and annual deals. Concentration sets the size of the tail; retention and contract structure tell you how likely the tail is to bite. The broader balance of growth and efficiency that frames how the market reads any IPO is covered in Rule of 40: what it actually tells you.

Why should you check the largest customers against related parties?

A company can truthfully state “no single customer exceeds 10%” while omitting that a top customer is also a strategic investor or a related party to the board. The SEC requires those relationships disclosed separately. Cross-check the largest customers against the cap table and board affiliations, because that overlap is concentration the headline percentage hides.

The concentration percentage has a blind spot, and it is a serious one: a customer that is also an investor or a related party. The headline number can be clean while the relationship behind it is not.

Picture a company that discloses “no single customer exceeded 10% of revenue.” True. Now suppose the second-largest customer is a strategic investor who put $50M into the last round, or the third-largest is a company a board member runs. The revenue is real, but it is not arm’s-length, and it may not survive a change in the relationship.

The SEC requires related-party transactions to be disclosed separately, in their own section and in the financial-statement footnotes. That separation is exactly why the risk is easy to miss: the customer concentration note and the related-party note are in different parts of the filing, and the reader has to connect them.

The connection is the work. Take the largest customers (named where disclosed, inferred from segment or geographic detail where not) and check them against the cap table, the list of principal stockholders, and the board affiliations. Any overlap is concentration the percentage does not capture, because the revenue is contingent on a relationship rather than on the product winning on merit.

This matters most at IPO, when a company has often taken strategic investment from the same large enterprises that became its anchor customers. The revenue looks like product-market fit. Some of it may be a financing relationship wearing a customer’s clothes. The filing gives you the pieces; sizing the overlap is the operator’s job, and it is the kind of adjustment where the reported number and the economic reality diverge.

What the skeptics get right: the bear case on concentration analysis

The strongest argument against obsessing over concentration is that, for most modern SaaS businesses, it is a solved problem, and treating it as a red flag misreads the model.

The bear case runs like this. Land-and-expand enterprise SaaS is supposed to have logo concentration. Slack’s 575 accounts driving 40% of revenue is not a warning sign; it is the business model working. The large accounts are large because they expanded, and expansion inside an account is the healthiest growth a SaaS company can have. Penalizing a company for having valuable large customers inverts the logic.

There is more. High switching costs can make concentration safe. An enterprise that has built its workflows on a platform, trained its staff, and integrated it across systems does not churn casually, even if it is 8% of revenue. A concentrated base of deeply embedded, high-retention customers can be more durable than a diffuse base of small accounts that churn freely. Concentration measured by revenue share ignores stickiness, and stickiness is what actually determines whether the revenue stays.

The bear case also notes that the disclosures are blunt instruments. A point-in-time top-10 percentage says nothing about contract length, renewal timing, or whether the concentration is rising or falling. Two companies with identical top-10 shares can have completely different risk if one signs three-year contracts and the other signs annual ones. The metric flattens a dynamic relationship into a single static number.

Here is the honest weighing. The skeptics are right that concentration without context is a weak signal, and that logo concentration in enterprise SaaS is normal, not pathological. They are wrong to dismiss it. Normal is not the same as safe, and the cases where concentration matters most (a customer that is also an investor, a top account on a short contract, a top-10 share that is climbing) are exactly the ones the headline percentage cannot see. The correct posture is not to fear concentration; it is to size it, then check the four things the percentage leaves out. Concentration is a reason to read three more disclosures, not a reason to stop reading.

The operator playbook: how to audit concentration risk in a growth company

Reading concentration is a procedure, not a gut call. Here is the playbook, five concrete moves whether you are a founder pressure-testing your own filing, an operator diligencing an acquisition, or an analyst reading an S-1.

1. Run the Concentration Risk Checklist top to bottom. Find the single-customer floor, the top-N shape, the risk-factor consequence, and the related-party overlap, in that order. Do not stop at the 10% line; that line is where the analysis starts, not where it ends.

2. Convert percentages into a churn scenario. Take the largest disclosed customers and model the loss. If a company has $100M ARR and the top customer is 8M (8%), losing it is an 8-point growth headwind before any new bookings. Do this for the top 1, top 5, and top 10 to see how lumpy the downside is. The arithmetic is yours; the inputs come from the filing.

3. Cross the customer list against the cap table. Pull the principal-stockholders table and the related-party footnote, then check them against the largest customers. Any overlap is revenue contingent on a relationship rather than on the product. Size it separately from arm’s-length revenue.

4. Weight by stickiness, not just share. A concentrated account on a three-year contract with deep integration is a different risk than the same share on an annual deal. Read the contract-length and switching-cost disclosures, then discount or forgive the concentration accordingly. Share tells you the size of the tail; stickiness tells you the odds it bites.

5. Track the direction across periods. A top-10 share falling from 18% to 14% is de-risking; rising from 9% to 14% is the opposite. Asana disclosing top-100 at 9% then 11% across two years (Asana Form S-1 and 10-K, FY ended January 31, 2021 and 2020) is the kind of two-period read that turns a static number into a trend. Always pull at least two years.

For a founder reading your own numbers before a raise or sale, the same playbook is a defense. If your top customer is creeping toward 10%, the move is to disclose the top-10 distribution proactively (the Datadog approach) rather than hide behind the single-customer line, and to lengthen contracts and deepen integration on the large accounts so the concentration is sticky rather than fragile. Durability comes from owning the relationship and the expansion path, so that the large accounts stay large because they are embedded, not because they are captive.

Where concentration is structural: the platform-dependency problem

There is a form of concentration the customer table never shows, and it is often the most dangerous one: dependency on a single platform, channel, or supplier that sits underneath the revenue.

A SaaS company can have a beautifully diversified customer base and still be one decision away from collapse if every one of those customers reaches it through a single app store, ad platform, or cloud marketplace. The customers are diverse. The channel is a monopoly. Concentration moved from the revenue line to the distribution layer, where the standard disclosure does not look.

This is the same lesson that shows up in Apple’s App Store economics under pressure: a developer with millions of diverse end users can still have catastrophic concentration if Apple controls the only door to them. The customer count says diversified. The dependency says otherwise.

The cost-side version is platform supplier concentration. A usage-priced SaaS business that runs entirely on one cloud provider has concentrated its cost structure even if its revenue is spread across thousands of customers. When that provider reprices, the margin moves, a dynamic traced in AWS margin pressure and the cloud reset. Concentration is not only about who pays you; it is also about who can reprice the floor underneath you.

The operator discipline is to audit concentration on three axes, not one: customers (who pays), channels (how they reach you), and suppliers (what you depend on to deliver). The revenue-concentration note covers only the first. The other two require reading the risk factors and the cost-of-revenue discussion with the same suspicion you bring to the customer table.

Where this analysis is vulnerable

A framework this clean deserves its own counterexamples, because concentration analysis has real limits.

The disclosures are voluntary above the 10% line. Most of what makes the analysis useful, the top-10 share, the top-100 share, the spend-tier breakdown, is volunteered, not required. A company that discloses only the single-customer threshold gives you a floor and nothing else, and you cannot manufacture the distribution from public filings. The analysis is only as good as what the company chose to show.

Point-in-time percentages hide dynamics. A top-10 share is a snapshot. It says nothing about whether those customers are on multi-year contracts, when they renew, or whether the concentration is rising or falling. Two years of data helps; it does not fully solve the problem, because contract structure is often disclosed in qualitative terms, not quantitative ones.

Concentration can be safe, and diffusion can be fragile. A concentrated base of deeply embedded enterprise accounts can be more durable than a diffuse base of small, freely churning customers. Revenue-share concentration ignores stickiness, and stickiness is frequently the thing that actually determines durability. The metric can flag the wrong company.

None of this overturns the value of reading concentration. It bounds it. The percentage is a starting point that tells you where to look harder, not a verdict. The companies that fail on concentration usually fail on something the single number did not show, which is precisely why the checklist has four rows and the playbook has five steps.

---

Analysis, not investment advice. Figures are drawn from the public SEC filings cited inline by company and fiscal period (Datadog, Slack, and Asana Forms S-1; Okta, Zoom, Twilio, and MongoDB Forms 10-K). Frameworks here are for understanding SaaS business models and tradeoffs, not for making buy or sell decisions.

Want the full toolkit for reading filings like this, the Concentration Risk Checklist, the top-N distribution worksheet, and the churn-scenario model used above? It’s in the Tech Business Analysis Playbook.