Cybersecurity has become a critical concern for Private Equity (PE) firms. With frequent deal announcements, a vast amount of sensitive data and readily available capital, they can be seen as attractive targets for cybercriminals. PE firms need to monitor both their own cybersecurity and that of their portfolio companies. The repercussions of a cyber incident can be severe, impacting both immediate financial stability and long-term investor confidence.
Why cybersecurity matters for PE firms
Unlike corporate M&A, where the entity is onboarded and IT systems are subsequently integrated, PE firms do not typically integrate systems with their portfolio companies. The cyber risk remains within individual portfolio companies, yet the PE firm remains exposed to legal liabilities, costs and reputational damage for the duration of the investment cycle.
Impact of cyber Incidents on Investments
Cyber incidents can impact investments in various ways at all stages of the investment lifecycle, whether pre-acquisition, during the hold period or at the point of exit:
Pre-acquisition
After identifying a target, if the cybersecurity is not appropriately assessed during the due diligence, vulnerabilities may not be identified, and the deal value can be overestimated. WTW has seen cyber-attacks incurred by target companies even during a transaction process and in such instances being able to quantify the potential exposure is critical from a valuation perspective.
Cyber Risk Management and Insurance
Safeguard your digital infrastructure and assets against cyber threats with our tailored coverage solutions.
PE firms will need to adopt an appropriate cybersecurity strategy for the portfolio company to best position themselves for an exit.
Effective management and insurance strategies are crucial when mitigating cybersecurity risks for PE firms.
Exit
A robust and mature cyber posture within a company can mean it is perceived as more resilient and capable of long-term growth which can increase market value at the time of exit. Conversely, portfolio companies with inadequate cybersecurity measures are less attractive to potential buyers and often seen as higher risk, this may result in fewer interested bidders and a greater challenge in obtaining the maximum valuation.
If the public announcement of a deal encourages a cyber-attack at the portfolio company during a transaction process, this can delay deals or, in the worst-case scenario, cause them to collapse.
What role does insurance have to play?
Warranty and Indemnity (W&I) insurance and cyber insurance
A W&I insurance policy is typically purchased to protect buyers and / or sellers from financial losses arising from breaches of warranties and indemnities in the sale agreement. These sale agreements often include warranties related to cyber risks. Historically, W&I insurers were reluctant to cover cyber risks, often including a general cyber exclusion. However, insurers are now more willing to provide coverage, subject to appropriate due diligence and sufficient operational cyber insurance being in place at portfolio company level.
While W&I insurance can offer some protection against cyber risks, it is not a substitute for cyber insurance at the portfolio company itself. W&I insurers typically look to sit in excess of the target’s specific cyber insurance policy, ensuring comprehensive coverage.
Cyber insurance solutions for PE firms
PE firms have two key options for cyber insurance:
Each portfolio company purchases its own insurance policy, tailored to its specific needs. These policies typically cover data breaches, ransomware attacks, incident response costs, and business interruption due to cyber incidents.
Summary and recommendations for PE firms
Portfolio companies with inadequate cybersecurity measures are less attractive to potential buyers and often seen as higher risk.
At WTW we understand Private Equity and Cyber Risks. By integrating WTW’s expertise in the Private Equity practice – spanning cyber due diligence, cyber risk consultancy, portfolio management and tailored insurance solutions - PE firms can mitigate risks, maximise exit valuations and protect investor confidence. Please contact us to find out more.
Author
Conducting thorough DD at the point of acquisition to understand the cyber maturity of target companies will assist with negotiations and avoid deal delays