Most private equity firms treat cyber diligence as a checkbox in the pre-close workstream — a questionnaire, a policy review, maybe a scan report from the target's last audit. That framing is too narrow. A PE firm doesn't buy one company's risk; it accumulates the aggregate risk of every asset it holds, across wildly different levels of maturity, on a clock that runs from signing to exit. A breach at a mid-sized portfolio company doesn't just impair that asset's EBITDA. It consumes deal team attention, delays an exit process, and invites questions from LPs about how the firm governs risk it clearly owns. The discipline that fixes this isn't more paperwork. It's testing — the kind that produces evidence of what an attacker can actually do.
Pre-Acquisition: Find the Liabilities Before You Own Them
Diligence questionnaires measure what a target's management believes about its security. Testing measures what is true. Those two things diverge constantly, and the gap is where deal risk lives. A target with a clean SOC 2 report can still be running an unpatched edge appliance with a public exploit, a flat internal network where one phished credential reaches the ERP, or a customer-facing API with broken object-level authorization exposing the entire tenant base.
Pre-close work is necessarily time-boxed and often constrained by what the seller will permit, so it has to be sharply prioritized. In our experience the highest-yield checks are narrow:
- External attack surface reality check: enumerate what the target actually exposes to the internet, including shadow assets from prior acquisitions and abandoned marketing infrastructure that nobody has owned in years.
- Evidence of prior compromise: an asset that has already been breached and doesn't know it is a fundamentally different negotiation than one that hasn't.
- Crown jewel reachability: whether the systems holding customer data, payment flows, or source code can be reached from a realistic starting position such as one compromised workstation.
- Integration blast radius: whether connecting this target to a shared identity provider or a sibling company's network would expose the acquirer to inherited weaknesses.
The output should feed the model, not just the risk register. Remediation cost is a real number, and it belongs in the deal. Our approach to pre-acquisition security due diligence is built to produce findings on a deal timeline, in language a deal team can price.
Post-Close: The First Hundred Days Set the Baseline
The value of pre-close testing evaporates if nothing happens after the wire clears. The post-close window is when a PE firm has the most leverage it will ever have over a portfolio company's security posture — new board seats, a mandate for change, and management that expects operational intervention.
Use it to establish a baseline rather than a project. That means deciding, at the firm level, what every portfolio company must have: enforced MFA on all remote access and administrative paths, EDR with actual coverage verification, tested and restorable backups held out of the production identity domain, a named owner for vulnerability remediation, and an incident response plan someone has rehearsed. None of that is exotic. What makes it work is that it's non-negotiable and consistent across the portfolio, so a new asset inherits a known standard instead of a bespoke argument.
Integration deserves specific attention. Merging networks and identity systems is the single most common way a PE firm converts one company's problem into several companies' problem. Test the connection before you build it permanently.
Ongoing: Manage Aggregate Risk, Not Individual Assets
A portfolio of twenty companies has twenty external attack surfaces, and they don't stay static between diligence and exit. Companies ship products, acquire bolt-ons, migrate to new cloud accounts, and lose the engineers who knew where things were.
Portfolio-wide testing programs work when they're standardized. A single provider running a consistent methodology across every asset gives the firm something no collection of one-off local vendors can: comparability. You can see which companies are drifting, which findings recur across the portfolio and therefore indicate a systemic gap worth solving centrally, and where remediation is real versus reported. Consistent scope and severity definitions turn twenty separate reports into one portfolio view — which is the view an operating partner actually needs.
There's a commercial argument too. Standardized programs are cheaper per asset than fragmented ones, and they eliminate the recurring cost of re-educating a new vendor about a company nobody documented.
Exit: Assume the Buyer Is Testing You
The market has changed on both sides of the table. Buyers now run the same diligence that sophisticated sellers run, and they use findings the same way — to reprice, to expand indemnities, or to slow a process while the seller scrambles for answers. A security finding surfaced by a buyer's team during exclusivity costs far more than the same finding surfaced two years earlier by your own.
Preparing an asset for exit means the same testing done proactively, with the remediation completed and documented. A clean, independent test report and a demonstrable remediation history do something a policy binder cannot: they remove an entire category of buyer objection before it's raised. That is not a compliance artifact. It's a diligence defense, and it protects the multiple.
Get in Touch
Cyber risk across a PE portfolio is a hold-period problem, not a signing-day problem. If you want to see how a repeatable testing program works across diligence, integration, and exit preparation, review our methodology or contact us to discuss your portfolio.