Dependency Blast Radius

Dependency Blast Radius is the count of client deliverables that break when one upstream vendor degrades, weighted by how long detection takes. Agencies typically inventory vendors by spend, which hides the real risk: a $40/month status feed or queue broker can sit beneath every retainer you run. The framework asks three questions per dependency: how many active client deliverables touch it, how fast would you know it failed, and who on the client side notices first. Monitoring coverage should follow that ranking, not the invoice. A daily digest service such as The Standup illustrates the low-effort end of the spectrum, aggregating releases, CVEs, and breaking changes across GitHub, npm, Cloudflare, and Datadog into one email, while a status aggregator covering 172+ vendors handles the live-outage half. The point is not tool count. It is mapping which failures reach a client before your team does, then closing those gaps first.