In today’s digital age, cybersecurity has become a critical factor in mergers and acquisitions (M&A). Ignoring cybersecurity during these transactions can lead to devastating breaches, financial losses, and operational disruptions. This comprehensive analysis delves into the cybersecurity risks that Chief Information Security Officers (CISOs) need to be aware of during M&A processes and offers insights into the measures that can be taken to mitigate these risks.
The Growing Importance of Cybersecurity in M&A
Recent high-profile breaches have raised awareness about the importance of cybersecurity in M&A transactions. According to Gergana Winzer, KPMG Australia’s cyber lead partner, there has been a measured shift over the last couple of years in how much attention companies are paying to cybersecurity during M&A deals. Gartner reported that by 2025, 60% of organizations will use cybersecurity risk as a primary determinant when engaging in M&A activity. This trend underscores the increasing recognition of cybersecurity as a critical factor in the success of M&A transactions.
A failure to consider cybersecurity during M&A transactions can have severe consequences. Winzer compares this oversight to driving blind without mirrors, making companies vulnerable to cyberattacks. The risks include disruptions to business operations, financial losses, and potential impacts on occupational health and safety. For instance, in the healthcare industry, a cyber breach could affect patient care and access to vital support.
Key Cybersecurity Risks in M&A
CISOs need to be aware of several key cybersecurity risks during the M&A process. Experts from major consulting firms have highlighted the importance of ensuring that technology and governance are up to date, reviewing third-party agreements, and being vigilant about opportunistic cybercrime and dormant attackers.
One significant risk during M&A transactions is the challenge of merging different technology stacks. Shameela Gonzalez, CyberCX financial services lead, emphasizes the importance of understanding the risks associated with consolidating these technologies and maintaining cybersecurity coverage post-merger. An example of this risk was the Marriott hotel chain’s acquisition of Starwood in 2018. Marriott continued to use Starwood’s IT infrastructure, which had been compromised by hackers, resulting in the breach of 339 million guest records.
In addition to technology, governance is a critical component of cybersecurity. Mature and highly regulated organizations may have robust cyber-risk management processes, but other enterprises may mistakenly believe that purchasing a few cybersecurity tools is sufficient. Effective governance and risk management processes are essential to identify and address potential vulnerabilities during an M&A transaction.
Cybersecurity risks are not limited to the companies directly involved in the M&A transaction. Third-party providers also pose significant risks. According to Blatchford, common questions during cyber due diligence include identifying third-party suppliers and assessing residual risks in the supply chain. A report by SecurityScorecard revealed that 98% of organizations are affiliated with a third party that has experienced a breach, and third-party attacks have led to 29% of breaches. Vulnerable third parties can serve as entry points for cyber attackers to target larger organizations.
Public announcements of M&A intentions can attract cyber attackers. Gonzalez points out that such announcements signal potential opportunities for attacks, as organizations may be distracted and focused on other aspects of the transaction. Companies need to adopt a proactive approach to cybersecurity, preparing for potential attacks and implementing barriers to prevent opportunistic cybercrime.
M&A activities can also provide opportunities for dormant attackers to strike. These attackers may have been lurking in a network, gathering information and waiting for the right moment to exploit vulnerabilities. Gonzalez warns that dormant threat actors can expand their attack surface during a merger, posing significant risks to the newly combined entity.
Mitigating Cybersecurity Risks in M&A
To mitigate these risks, companies need to adopt comprehensive cybersecurity strategies during M&A transactions. This includes conducting thorough cyber due diligence, maintaining robust governance and risk management processes, and ensuring the security of third-party providers.
Cyber due diligence is a critical step in the M&A process. This involves assessing the cybersecurity posture of the target company, identifying potential vulnerabilities, and evaluating the risks associated with the transaction. Key considerations include:
- Reviewing the target company’s technology stack and identifying potential integration challenges.
- Assessing the target company’s governance and risk management processes.
- Identifying third-party providers and evaluating their cybersecurity practices.
- Assessing the target company’s history of cybersecurity incidents and breaches.
Conducting thorough cyber due diligence helps companies identify potential risks and develop strategies to address them, reducing the likelihood of cyberattacks post-merger.
Effective governance and risk management are essential to mitigate cybersecurity risks during M&A transactions. This includes:
- Establishing clear cybersecurity policies and procedures.
- Ensuring that cybersecurity responsibilities are clearly defined and assigned.
- Implementing robust risk management processes to identify and address potential vulnerabilities.
- Conducting regular cybersecurity assessments and audits.
Maintaining robust governance and risk management processes helps companies identify and address potential risks, ensuring the security and integrity of the merged entity.
Third-party providers pose significant cybersecurity risks during M&A transactions. To mitigate these risks, companies should:
- Conduct thorough assessments of third-party providers’ cybersecurity practices.
- Implement robust third-party risk management processes to identify and address potential vulnerabilities.
- Establish clear cybersecurity requirements for third-party providers and ensure compliance.
Ensuring the security of third-party providers helps companies reduce the risk of cyberattacks and protect the integrity of the merged entity.
Case Studies: Cybersecurity Risks in M&A
Several high-profile cases highlight the importance of cybersecurity in M&A transactions. These case studies illustrate the potential risks and consequences of neglecting cybersecurity during the M&A process.
In late 2018, Marriott announced that one of its reservations systems had been compromised, two years after acquiring Starwood. The breach resulted in the compromise of 339 million guest records, including credit card and passport details. Investigations revealed that Marriott continued to use Starwood’s IT infrastructure, which had been breached by hackers and infected with malware. This case highlights the importance of thoroughly assessing the cybersecurity posture of the target company and addressing potential vulnerabilities before completing the transaction.
In another high-profile case, Verizon slashed Yahoo’s deal price by $350 million during the evaluation phase due to Yahoo’s security breaches. This case underscores the importance of improving cybersecurity posture before an acquisition to protect the company’s sale value and ensure a successful transaction.
Conclusion
Cybersecurity is a critical factor in the success of M&A transactions. Ignoring cybersecurity risks can lead to devastating breaches, financial losses, and operational disruptions. CISOs need to be aware of the key cybersecurity risks during the M&A process, including technology and governance challenges, third-party risks, opportunistic cybercrime, and dormant attackers. By conducting thorough cyber due diligence, maintaining robust governance and risk management processes, and ensuring the security of third-party providers, companies can mitigate these risks and protect the integrity of the merged entity. As the importance of cybersecurity in M&A continues to grow, companies that prioritize cybersecurity will be better positioned to achieve successful and secure transactions.