CDN concentration risk shows up as a shared failure domain, not just a vendor preference debate. Prefer an explicit dependency map of which origins, DNS answers, and TLS terminations sit behind one edge provider, keep a documented failover path that does not share that control plane, and rehearse origin-direct or secondary edge cutovers before an outage forces the decision. Treat single-provider cache purge and certificate renewals as correlated risk, not independent chores.

Ops prove-out after naming the concentration: break the primary edge path in a canary region and confirm traffic lands on the secondary path with correct Host and certificate, then restore primary and confirm no sticky split-brain between edges. Watch origin error rate, DNS answer skew, and edge 5xx share during the drill — a healthy secondary that never receives warm traffic will look fine on paper and fail under real cutover. Keep a canary Host permanently dual-pathed so the next provider incident is a failover, not a redesign.