Data collected over several years shows that cybersecurity is an increasing concern among business decision-makers. In 2018, 63% of CEOs surveyed were extremely concerned about cyber threats. Other surveys revealed that around 76% of business decision-makers have backed out of an acquisition or merger deal because of cybersecurity concerns.
If you’re pursuing an M&A deal of any kind, you have every reason to be concerned about cybersecurity. Hackers are always waiting for the right opportunity to steal data they can sell on the dark web or use for identity theft.
You can’t possibly know exactly what you’re getting into when you pursue a merger or acquisition deal. However, there are ways to mitigate the potential risks where cybersecurity is concerned.
1. Agree to conduct a secure transaction in online spaces
Most importantly, you need to make sure all parties agree to secure all online transfers and data storage. The optimal solution is to use a service like Caplinked for a virtual data room to securely hold your documents.
However, that’s not enough. You also need to utilize digital rights management (DRM) to control access to your files. Caplinked also provides this service.
Storing files securely is only the first step. You need to make it as hard as possible for anyone to compromise your security. Once you store your files in a virtual data room, you can use DRM technology to rescind access to users at the drop of a hat. You can also limit how files can be shared and copied.
It’s impossible to prevent all threats, but controlling access and rights to your files will prevent careless mistakes and if a deal falls through, revoking access can prevent an instance of spontaneous, retaliatory sabotage.
2. Know the total attack surface
Whether you’re merging or acquiring a company, you need to know what that company’s attack surface really looks like; it may be larger than you think.
If you’re not familiar, an attack surface covers all the points where an unauthorized party can potentially gain access to data or a network. This can include a user’s physical computer and mobile devices, the company’s physical server, the company’s online accounts, and any software used on the company’s website or in the cloud. All of these (and other) points must be secured as much as possible at the source. Additionally, all users should follow tight cybersecurity protocols to ensure those points stay secure.
With remote employees, attack surfaces can be deceptive
The biggest problem you’ll face is assessing the actual size of an attack surface. An attack surface in today’s remote-centered world can be enormous and partially invisible, especially if employees and contractors are operating outside of strong IT security protocols.
It’s not always intentional when employees work outside of IT security protocols. Some companies don’t have an IT security plan and employees are free to operate however they want. Make no mistake, this will be a huge problem going forward if cybersecurity protocols are not put in place.
3. Conduct a full assessment of company cybersecurity policies and protocols
Before completing a deal, you need to know how the company manages cybersecurity so you know what you’re getting into. For example, you’ll want to discover:
- The company’s written IT security policy. Does the company have a security policy in writing? Is it part of each employee’s training?
- How the company responds to and enforces its cybersecurity policies. Security policies are only as good as their enforcement. Do employees share credentials? Are employees reprimanded for breaking security policies?
- What software does the company use to protect network threats? Some software is better than others. Also, sometimes companies rely on cloud hosting providers for security because they don’t understand the shared responsibility model. They may not know the secure environment promised by a cloud provider only refers to the infrastructure.
4. Learn from past failed M&A transactions
Study past M&A deals that fell apart because of cybersecurity issues. These past situations will give you a good idea of what to look for as potential red flags.
Financial companies always prioritize cybersecurity knowing it’s the only way to avoid millions of dollars in fines and a tarnished brand reputation. However, some companies ignore red flags and things don’t turn out so well.
Set your standards high
No M&A deal is worth risking your brand’s reputation or revenue. Set high standards for what kind of companies you’ll acquire. If you run into red flags, take careful consideration before moving forward. Don’t sacrifice long-term gains for short-term rewards.
