You probably cannot name every app you depend on. Nobody can — the average person has dozens of accounts, and the important ones hide among the trivial. But when a shutdown notice arrives, “I forgot I even had that account” is how data gets lost. A dependency audit fixes the forgetting: a systematic map of every app your life depends on, ranked by how much pain its disappearance would cause.
This 2026 audit walks you through building that map in about two hours: discovering forgotten accounts, scoring each app on dependence and risk, and turning the result into a prioritized action plan. It extends the inventory idea from our What Happens When an App Shuts Down: The Full Timeline shutdown timeline into a full risk framework, and the historical perspective in What a Decade of Discontinued Apps Teaches Us explains why this exercise matters more each year.
Phase 1: discover everything (including what you forgot)
Start with the obvious: your phone’s home screens and your computer’s applications folder. Then go deeper. Check your email for welcome messages and receipts — search for “welcome to,” “your account,” and “receipt” to surface accounts you created and forgot. Check your password manager, which is effectively a census of your digital life. Check your bank and card statements for the last twelve months; every recurring charge is an app you pay for, and every one-off charge is an app you used.
Do not forget the invisible dependencies: the “sign in with” buttons you clicked (your Google or Apple account is a single point of failure for dozens of logins), the integrations between apps (your calendar feeding your task manager feeding your notes), and the shared accounts (family plans, work tools, the streaming login you borrow). Map the connections as well as the nodes — a shutdown hurts most where dependencies chain together.
Also list the accounts of people who depend on you: the family photo library you manage, the elderly parent’s accounts you set up, the club or small business tools you administer. Your audit covers your blast radius, not just your own inconvenience.
Phase 2: score dependence and risk
For each app, score two dimensions from one to five. Dependence: how badly would its disappearance disrupt your week? Five is “I cannot work without it”; one is “I would not notice for months.” Risk: how likely is trouble — shutdown, acquisition, price hike, or simply your own forgotten credentials? Signals include no visible business model, long-unupdated apps, companies in volatile sectors, and your own neglected account hygiene.
Multiply the two scores. Anything scoring 12 or above is your critical tier — these get exit plans, tested exports, and backup cadences. Scores of 6 to 11 are the watch tier: documented, with exports tested once. Below 6, a simple list entry suffices. The multiplication matters because it surfaces the dangerous combination: high dependence plus high risk, the apps that would hurt most and are most likely to hurt you.
Be honest about risk, especially for apps you love. Affection is not a business model. Some of the most beloved apps have the shakiest economics, and loving an app is a reason to prepare for its loss, not a reason to assume it is safe. Write down your risk scores even when they feel disloyal — the paper does not judge, and the honest numbers are what protect you when sentiment says everything is fine.
Phase 3: find your single points of failure
The audit’s most valuable output is the list of single points of failure — places where one shutdown cascades. The classic: your email account, which is the recovery path for nearly every other account. If your email provider shut down, you would not just lose email; you would lose the ability to reset passwords everywhere else. Your email deserves the highest preparedness standard you can give it: tested export, current recovery options, and ideally a custom-domain address you can move between providers.
Other common single points: the cloud storage where your only photo copies live, the password manager holding every credential, the phone number that receives all your two-factor codes (lose the number, lose the accounts), and the note app containing years of thinking. For each, the fix is the same pattern: a second copy, a second path, a tested exit. Redundancy is not paranoia at these nodes; it is engineering.
Chain risk: when apps depend on apps
Draw the chains: your task manager syncs to your calendar, which syncs to your phone, which backs up to your cloud. A failure anywhere in the chain degrades everything downstream. Chains are where “I have a backup” proves illusory — the backup exists but depends on the thing that broke. For each critical chain, ensure at least one link has an independent copy outside the chain entirely.
Phase 4: the prioritized action plan
Convert scores into actions, ordered by risk-weighted pain. For critical-tier apps: test the export this week, write the mini exit plan, set the backup cadence, verify recovery options. For the watch tier: test exports this month and document the basics. For everything else: the list itself is the action — awareness without effort.
Put the plan on a calendar, not just in a document. “Test photo export” as a quarterly recurring event beats “photo export” as a line in a forgotten file. Preparedness that is not scheduled is preparedness that does not happen; the audit’s value is realized in the calendar entries it produces.
Revisit the full audit yearly. Apps change tiers — the trivial becomes critical as your life changes, the critical becomes trivial as you migrate away. An hour a year keeps the map honest, and an honest map is the difference between a shutdown being an errand and being an emergency.
Extending the audit to your household
Your audit has a blind spot: the people around you. The family member whose photos live only in an app they barely understand, the partner whose business runs on a tool with no backup, the kid whose schoolwork exists in a single cloud account. Their single points of failure become your emergency when something breaks.
You do not need to audit their lives in detail — that would be unwelcome. But have the conversation: “If this app disappeared tomorrow, what would you lose?” Help with the critical tier: set up the export, show them where the files live, put the reminder on the shared calendar. An hour of help now prevents a weekend of rescue later, and it is one of the kindest technical favors you can do.
Reading risk signals like an analyst
Risk scoring improves dramatically once you know what to look for. Financial signals: the company raises prices sharply (often a sign of trouble, not strength), cuts the free tier aggressively, or goes quiet about funding. Product signals: the changelog slows to security fixes, the blog stops publishing, support response times stretch from hours to days. Market signals: a giant enters their niche, their core platform shifts underneath them, or regulation changes their economics.
None of these signals predicts a shutdown with certainty — healthy companies show some of them during normal pivots. What matters is clustering: three or more signals together, sustained over two or three quarters, is when prudent users start preparing. Think of it as weather forecasting, not prophecy. You do not need to know the exact day of the storm to own an umbrella.
Where do you watch for signals? The company’s status page and changelog, their blog and social accounts, user communities where employees sometimes hint at trouble, and app-store review trends — a sudden wave of “abandoned app” reviews is data. Fifteen minutes of signal-checking per quarter for your critical-tier apps is enough; you are scanning horizons, not conducting surveillance.
Frequently asked questions
Are there tools that automate the discovery phase?
Partially. Password managers list your logins, email search surfaces accounts, and bank statements reveal subscriptions — but no tool sees the full picture, especially shared accounts and “sign in with” chains. The manual pass is unavoidable; the tools just make it faster. Budget two hours and do it properly.
Should work apps be in my personal audit?
List them separately with a clear boundary. Your employer’s IT owns work-app preparedness, but your personal work product inside those apps — portfolio pieces, contacts, reference material you created — deserves your own export where policy allows. Never let the boundary blur: company data stays in company systems.
How often do scores change?
More often than you expect. A price hike moves an app’s risk score; a new project moves its dependence score; an acquisition changes both overnight. That is why the yearly review matters — the audit is a living document, not a one-time report.
Won’t this audit just make me anxious?
The opposite, in practice. Anxiety thrives on vagueness — the uneasy sense that you depend on things you cannot name. The audit replaces vagueness with a list, and a list with a plan. People consistently report feeling calmer after auditing, because every risk now has a corresponding action.
What is the minimal version for someone who won’t do all this?
The 80/20 version: list your top ten most-used apps, test the export on the top three, and make sure your email recovery works. Thirty minutes, once a year. It is not the full audit, but it covers the failures that hurt most.
Two hours, once a year, and you will know exactly where you stand: every dependency mapped, every risk scored, every critical app with an exit plan. In a software landscape where apps get discontinued every year, that knowledge is the closest thing to immunity — not from shutdowns happening, but from shutdowns hurting.