On 17 August, one GitHub incident degraded source hosting, CI, identity and AI assistance for seven and a half hours. On the same day, Cursor announced it would host your code too.
Those two events pose the same question from opposite directions: how many companies does your ability to ship depend on, and did anyone decide that number?
Consolidation happened without a decision
Nobody held a meeting and resolved to put source, CI, identity, code review and AI assistance with one supplier. It happened one reasonable step at a time.
Actions was easier than a separate CI service. GitHub SSO was easier than another identity provider. Copilot was already in the editor. Every one of those was the right call in isolation, and integration is a genuine benefit rather than a marketing story.
The result is still a single point of failure that nobody chose. That is what makes it worth mapping — not because consolidation is wrong, but because a risk you never decided to take is one you have never sized.
Map the six layers
Fifteen minutes with a piece of paper. Write the vendor next to each, and count the distinct names.
- Source hosting — where the repository actually lives
- CI and deployment — what runs the tests and ships the artifact
- Identity — SSO, permissions, group membership
- Code review — where the discussion happens and the history lives
- AI assistance — the models and agents in the loop
- Package registries — where dependencies come from
Deliberate consolidation versus drift
One vendor across all six is a legitimate architecture. Integration removes real friction, and a team that consolidated knowingly, sized the risk and tested an exit has made a defensible choice.
Drift is different, and it has three symptoms. Nobody can say when the decision was made. Nobody has tested whether leaving is possible. And the answer to "what happens if they are down for a day" is a shrug rather than a plan.
The distinction is not about the number of vendors. It is about whether the number is an outcome or a choice.
More vendors is not automatically safer
This is where the standard advice goes wrong. Splitting six layers across six suppliers gives you six integration seams, six status pages, six billing relationships and six upgrade cycles — and integration seams fail more often than platforms do.
It also does not necessarily reduce correlated failure. Several apparently independent vendors run on the same cloud regions, and an identity provider outage takes down services that look unrelated on your diagram.
The useful question is not "how many vendors" but "what can we still do when any one of them is unavailable for a day". A stack with two vendors where work continues beats a stack with six where it does not.
The exit test
Pick your most consolidated layer and answer, concretely, what leaving would take. Not whether you would — what it would cost.
For source hosting: could you reconstruct repositories, open pull requests, review history and settings elsewhere? Review history is usually the answer nobody likes, because it is institutional memory and it does not migrate.
For AI assistance: is there a second path to a model? Copilot for JetBrains added Ollama as a BYOK provider on 11 August, and a local model is the only assistance that survives any vendor's bad day.
For identity: how many internal systems go down with your identity provider? That list is nearly always longer than people expect, and it is the layer where concentration hurts most.
What is worth diversifying
Not everything deserves a second supplier. Three tests decide it, and they are cheap to apply.
- Does a day of downtime stop work entirely, or just delay it? Delay is survivable; a full stop is what deserves a fallback
- Would leaving take a week or a quarter? A quarter-long exit is a dependency, whatever the contract says
- Does this layer hold something you cannot recreate? Code you can restore from a clone. Review history, issue history and audit trails you cannot
A reasonable position
Consolidate deliberately on the layers where integration genuinely pays — that is a real benefit and pretending otherwise is posturing.
Keep one independent path for the things that stop work entirely: a model you can run locally, a way to talk to your team off-platform, a backup of what cannot be recreated.
And write down what you decided, so the next person can tell the difference between a choice and an accident. That sentence is most of the value of this entire exercise.