How To Calculate Your Startup's Customer Concentration Risk

One customer writing more than a quarter of your revenue can sink a deal before the buyer finishes their first call. Here's the formula they're already running.

Quick Summary - TLDR:

• A buyer or VC calculates customer concentration risk by dividing your largest customer's revenue by total revenue, then checks it against unwritten thresholds of 10% for consumer and SMB models and 25% for enterprise B2B
• Crossing 25% from a single customer routinely triggers a valuation haircut of 10% to 30% or an escrow holdback in acquisition term sheets
• The Herfindahl-Hirschman Index, borrowed from antitrust law, gives a more complete picture than the top-customer percentage alone when you have five or more material accounts
• Twilio's 2016 S-1 disclosed that WhatsApp accounted for 17% of revenue, a figure underwriters required precisely because public market investors price concentration risk into the stock
• Fixing concentration before diligence starts, not during it, is the only version of this that actually works, because a buyer who finds it themselves assumes you were hiding it

Here's the formula: take your largest customer's trailing twelve-month revenue, divide it by total trailing twelve-month revenue, multiply by 100. That's your customer concentration ratio. Nobody explains this to founders until an investment banker or a corp-dev analyst drops it into a diligence request list, usually right after they've asked for your cohort retention curves and right before they go quiet for a week.

The math is the easy part. What founders don't know is where the lines actually sit, because almost no one writes them down. Buyers and investors don't publish a rulebook. They just know it when they see it, and they act on it instantly.

For consumer and SMB-focused companies, 10% from one customer is the informal ceiling. Go over it and a buyer starts asking why your biggest account looks nothing like your average one. For enterprise B2B software, where six-figure contracts are normal, the ceiling moves to roughly 25%. Past that, due diligence teams start modeling what happens to your valuation if that single logo churns.

These aren't regulatory rules. The SEC doesn't define a hard percentage. But accounting firms and investment banks treat 10% as the disclosure trigger in financial statement footnotes for a reason, and private equity shops have quietly standardized around it for smaller deals, with more room given to enterprise software where contract sizes are naturally lumpy. Ask five bankers for the exact number and you'll get five slightly different answers. Ask them if a 40% customer kills a deal, and every one of them says yes.

What actually happens when you cross the line isn't a flat rejection. It's a price cut. Advisors who work on lower middle-market SaaS deals describe concentration above 25% from one account as routinely producing a 10% to 30% reduction in offered valuation, sometimes structured as an earnout tied to retaining that customer, sometimes as a straight escrow holdback released only if the account renews past closing. The deal doesn't die. It just gets smaller and slower, and the escrow sits there as a constant reminder of exactly what the buyer doesn't trust.

Top customer isn't the whole story

The top-one-customer percentage is the number everyone quotes, but it misses a common trap: five customers each at 18% of revenue look fine on the single-customer test and terrible on any real stress test, because losing two of them in the same quarter guts more than a third of the business. This is where the Herfindahl-Hirschman Index earns its keep, even though almost no startup finance team uses it.

HHI, originally built for antitrust regulators to measure market concentration, works just as well on a customer base. Take each customer's percentage of revenue, square it, add up the squares. A company with one customer at 100% scores 10,000. A company with ten equal customers at 10% each scores 1,000. Anything under 1,500 reads as genuinely diversified. Between 1,500 and 2,500 is a gray zone that gets questions. Above 2,500, expect a buyer to run their own model of what happens if your second and third largest accounts both leave within twelve months of each other, because at that score, correlated churn isn't a tail risk, it's a plausible quarter.

Run both numbers before anyone outside your company asks for them. The top-customer ratio tells a buyer about their single point of failure. HHI tells them about the shape of the whole book. A seed-stage company with three customers has no real HHI story to tell yet, and that's fine. A Series B company closing a nine-figure acquisition with an HHI north of 3,000 has a story whether they want one or not.

A public company already lived this

Twilio's 2016 IPO prospectus disclosed that WhatsApp represented 17% of revenue that year, a fact underwriters required in the S-1 specifically because concentration is exactly the kind of risk public market investors expect to see priced in before they buy a share. Twilio wasn't hiding it. It couldn't. Public disclosure rules force the number into the open, and the stock traded with that number already known.

Private acquisitions work the opposite way. Nobody forces you to disclose concentration upfront, so most founders don't, and the buyer finds it themselves three weeks into diligence when their analyst pulls your top-20 customer list and runs exactly the ratio described above. At that point the number isn't just a number anymore. It's a number you didn't volunteer, and buyers treat the non-disclosure as the second red flag, sitting right next to the concentration itself.

Frankly, the fix here isn't clever. It's sequencing. Calculate your concentration ratio and your HHI the same month you start fundraising or the same month you hire a banker, not the month diligence opens. If the number is bad, you have two real options: diversify revenue before you go to market, or get ahead of it with a clean narrative, something like a multi-year contract with that customer, a documented expansion pipeline elsewhere, or evidence the relationship predates any dependency risk. Either path works. Walking into diligence hoping nobody asks does not.

One more thing worth saying plainly: concentration risk compounds with contract length. A customer at 30% of revenue on a month-to-month agreement is a different risk profile than the same customer at 30% locked into a three-year contract with renewal terms already negotiated. Buyers price the duration, not just the percentage. If you're carrying concentration you can't shed before a raise or a sale, locking in the term is the next best move, and it's one you can make starting this quarter.

Also read: How to Calculate CAC Payback Period for a B2B SaaS Startup • How to Write an AI Agent Data Residency Clause Before Europe Signs • How to Structure a Founder Salary Increase Tied to Revenue Milestones

This article is posted in Startup News, check it out for more related stories.