Vendor dependency becomes operational risk when a business cannot change, renew or recover from a single provider without substantial disruption. Concentration on one vendor turns that vendor's decisions into your operational exposure.
The risk appears in several ways: price increases you cannot absorb, licensing decisions you cannot control, a vendor roadmap that removes a feature you rely on, or a contract that locks your data in a format you cannot leave.
Continuity requires the ability to operate and exit. A healthy environment keeps escape hatches: exportable data, documented configuration, and alternatives that have been reasoned about before a crisis forces the decision.