Controlling Cyber-risk in Mergers and Acquisitions

September 21, 2020

Acquiring a company is a significant undertaking that requires meticulous planning and precise execution. Time is crucial—the quicker an integration materializes, the faster the time to value. However, being the target of an acquisition can pose risks to shareholders and company valuation if cybersecurity issues are not addressed before due diligence or, worse, in the months following the acquisition.

The financial and reputational impact of cyber breaches

In a survey by West Monroe Partners, executives reported that 52% discovered a cyber problem post-deal, and 41% said post-merger integration is their main cyber concern. Cybersecurity has become the number one reason why companies walk away from a deal and the second most common cause for deal regret.

Many M&A agreements now include clauses stating that the target company might risk up to 30% devaluation if it falls victim to a cyber breach within 12 months after an acquisition. This significantly raises the stakes beyond the immediate costs of a breach and recovery process.

Cybersecurity challenges in M&A

Merging two companies introduces several critical cybersecurity challenges that need to be managed carefully.

Broader attack surface

Merging two companies creates a broader attack surface. The potential attack vectors an attacker might leverage increase, leaving the networks of both the acquiring and target companies exposed and vulnerable.

Inherited or imported threats

Introducing a new organization into your network can impose significant threats without visibility into hidden attackers. Existing vulnerabilities or undetected threats in the target company can infiltrate the acquiring company's infrastructure.

Insider threats

During mergers, the potential for insider threats increases due to various reasons like employee concerns and job uncertainty. This can lead to intentional or unintentional security breaches.

Third-party risks

Business and technical consultants, commonly employed during M&As, can knowingly or unknowingly become avenues for cyberattacks if proper security measures aren't in place.

Burden on IT and security teams‍

Throughout the M&A process, IT and security teams from both companies are often stretched thin. This overload can result in oversight and increased vulnerability to cyber threats.‍

How Vectra addresses these challenges

Introducing the Vectra AI Platform

In the M&A process, the Vectra AI Platform can be utilized by the target company to conduct a security assessment and by the acquiring company to assess the risk and compliance of the target organization. Vectra AI is instrumental in accelerating the M&A process by providing AI-driven threat detection and response for cloud, data center, and enterprise environments.

Accelerating due diligence and integration

The Vectra AI Platform speeds up due diligence and integration by automating threat hunting and prioritizing detected threats based on certainty and risk. This enables faster response, mitigation, and thorough incident investigations.

Detecting inherited and insider threats

Whether it's an insider threat or an external threat, the Vectra AI Platform automatically detects malicious behaviors at every phase of the attack lifecycle. This capability is essential during mergers and acquisitions, where inherited vulnerabilities and insider risks can compromise both the acquiring and target companies.

Below is a detailed overview of how the Vectra AI Platform automatically detects malicious behaviors in every phase of the attack lifecycle:

Killchain Stage	The Challenge	How Vectra AI Solves the Challenge
Command and Control	Identifying unauthorized remote access attempts that could lead to data breaches or network compromise.	Vectra AI detects anomalous outbound connections and suspicious communication patterns indicative of command and control activities.
Internal Reconnaissance	Detecting scanning and probing activities within the network that may signal an attacker mapping out resources.	Vectra AI monitors network traffic to identify unusual scanning behaviors and internal host interactions.
Lateral Movement	Monitoring for unusual internal traffic patterns indicating the spread of malware or unauthorized access across systems.	Vectra AI analyzes movement patterns to detect lateral spread attempts, flagging suspicious access to critical resources.
Data Exfiltration	Alerting on attempts to transfer sensitive data outside the network, risking intellectual property loss.	Vectra AI identifies abnormal data transfers and exfiltration methods, such as encrypted or obfuscated channels.
Botnet Monetization	Recognizing signs of compromised devices being misused for malicious activities like spamming or DDoS attacks.	Vectra AI detects patterns associated with botnet activity, helping to isolate and remediate affected hosts.

By addressing these challenges across the attack lifecycle, the Vectra AI Platform ensures that inherited threats and insider activities are promptly identified and mitigated. This proactive approach protects the integrity of both organizations during the M&A process, reducing the risk of cyber incidents that could impact company valuation and shareholder confidence.

Reducing third-party risks

By providing continuous monitoring and analysis, the Vectra AI Platform helps minimize risks associated with third parties involved in the M&A process, ensuring that consultants and temporary staff do not become entry points for cyber threats.

Alleviating the burden on IT and security teams

The platform automates manual processes and consolidates numerous security events and historical context in real-time, pinpointing compromised hosts that pose the biggest risk. This reduces the workload on IT and security teams, allowing them to focus on critical integration tasks.

Conclusion

Addressing cybersecurity challenges is essential to protect company valuation and shareholder interests during mergers and acquisitions. The Vectra AI Platform provides critical capabilities to ensure that cyber threats are not inherited by the acquiring or target company, eliminate attack surface vulnerabilities, and accelerate integration resulting from M&A.