Private Equity Firms Should Make Cybersecurity Diligence A Priority

Uploaded on 2024-10-23 in FREE TO VIEW, BUSINESS-Services-Financial

Cybersecurity is a top concern for businesses of all sizes, and private equity (PE) firms are no exception. In fact, PE firms are increasingly targeted by cyberattacks, as they typically hold a wealth of sensitive information, including financial data, customer information, and intellectual property.

There’s been a recent uptick in so-called “supply chain hacks,” with attackers targeting third-party vendors that supply critical technology components, gaining access to the target organizations’ systems and data.

Notable examples of these supply chain attacks include the headline-grabbing SolarWinds and Kaseya breaches. In a way, private equity firms are the ultimate “supply chain” target, because they tend to have sensitive data and access to the portfolio companies they own, and they tend to have deep pockets.

Indeed, a recent study by the Ponemon Institute found that the average cost of a data breach for a financial services firm was nearly $6 million in 2022. This is significantly higher than the average cost of a data breach for other businesses, which is $4.35 million.

It’s clear that even well-protected PE firms are an enticing target for enterprising cyber hackers looking to make a quick buck.

A Uniquely Good Target To Attack

PE firms are often harder to protect than the typical organization. With many employees working remotely, it’s difficult to keep track of who has access to sensitive information and how they are using it. Middle-market PE firms, which comprise the majority of the market, often invest in companies that have been bootstrapped and have not had the IT security budget or expertise to build the necessary internal security controls.

To protect themselves and their portfolio companies from cyberattacks, PE firms need to focus on cybersecurity during the diligence process when they are evaluating potential acquisitions. A data breach or ransomware attack could have a significant impact on the value of the acquisition, and could also damage the reputation of the firm.

Here are a few tips that PE firms can utilize to assess risk of a potential acquisition during due diligence:

Ask the target company – both IT team and leadership – about current cybersecurity policies and procedures and review those controls. Conduct IT/cybersecurity due diligence on behalf of a firm, and complete gap assessment against the NIST controls.

Review the target company’s insurance policies, including specific cyber insurance if the company pays for it. Often insurance policies have lapsed, or there is a gap in the target company’s security policies.

Conduct an open-source threat analysis, including a sweep of the Dark Web to look for compromised employee credentials and other potential threats. It’s often shocking what’s out there – which in rare cases, reveals an active cyber breach – but more frequently can inform post-acquisition remediation recommendations.

Review the target company's security logs, to see if there have been any recent breaches. This is recommended for all diligence processes, assuming the logs are accessible.

Evaluate the target company's incident response plan. In the event of a cyber-attack, a well-designed incident response plan can help mitigate the damage and limit the impact on the business. Make sure there’s an effective plan in place and that it’s tested and updated regularly.

If applicable, evaluate the target company's compliance with industry regulations and standards. Depending on the industry, businesses may be required to comply with certain cybersecurity regulations such as the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), or the General Data Protection Regulation (GDPR).

You may also want to occasionally conduct penetration tests of the target company's systems to identify any vulnerabilities. You not always have time to do this during the diligence phase, as it’s an extremely involved deep-dive process - but this is often a critical “next step” on the post-acquisition roadmap.

It’s important to recognize that not every vulnerability or cyber risk can be remediated before a deal closes - and unless diligence reveals an active breach at the target company, rarely is a risk so severe that a buyer should not complete the planned acquisition.Typically, the most critical output of IT/cybersecurity diligence is the creation of a roadmap or timeline of investment for hardening IT security, remediating vulnerabilities, and filling any gaps.

By conducting a thorough cybersecurity due diligence process, PE firms can help mitigate the risks of a data breach or other cybersecurity incident. This will help protect the value of the acquisition and the reputation of the private equity firm.

Chris Snyder is Principal Sales Engineer at Quadrant Security

Image: ismagilov

You Might Also Read:

How Financial Institutions Can Address Their Top Cybersecurity Challenges:

If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.