A risk analysis examining Microsoft's ability to block customer access due to government sanctions, using the ICC incident as a case study. The author applies return on security investment calculations to determine whether organizations should invest in reducing Microsoft dependency, concluding that while the probability is extremely low (1 in 2 million), the potential costs are catastrophic (millions in downtime). The mathematical analysis reveals that for most organizations, the rational investment in mitigation is surprisingly small due to the low probability, despite the severe consequences.