Webinar Replay : Cyber Risk at Scale–Safeguarding Portfolio Value in Private Equity

Portfolio companies are seeing cyber incidents more often and with greater financial impact. As risk grows, so does the importance of portfolio cybersecurity risk management.

PE firms should take measures to govern cyber risk across portfolio companies to avoid disruption, limit financial impact and secure exit value.

Watch the replay of Kroll’s expert briefing exploring the evolving cyber risk landscape facing PE firms, the financial impact of disruptions and practical strategies to build portfolio resilience.

 

Key Takeaways

• Cybersecurity incidents are rising, increasing the need for strong portfolio‑level risk management.
• Incident impact is typically $2.1 mn, and larger financial impacts are not uncommon.
• Larger firms have established effective practices to enable portfolio company leaders to protect their business.
• Smaller firms have less robust risk management practices and are more likely to experience additional remediation costs and deal disruption during exit transactions.

 

Key Sections From the Webinar

“Cyber threat actors are good business people. They understand ROI — and they know when capital is about to move.”

Brent Tomlinson

 

Here our experts discuss the disruption that occurs across the deal life cycle — from pre-investment through to the hold period and on to exit. Attackers are deliberately targeting high-pressure inflection points where visibility is high and leverage is greatest. The hold period sees the highest number of incidents, as adversaries recognize that PE-backed companies offer pathways to broader financial impact on sponsors and portfolios, a trend intensifying as deal pipelines rebuild and more assets approach exit.

“Just because you’re lower profile doesn’t mean you’re lower risk. That dynamic has fundamentally changed.”

Eric Hasty

 

Kroll’s findings show that mid-market PE firms are increasingly exposed due to a more sophisticated threat landscape, AI-driven attacks and lower cyber maturity. While larger firms have developed portfolio-wide controls and practices such as collective procurement to mitigate risk, mid-market firms often lack these, making them prime targets.

“Most incidents still come from the basics-not sophisticated attacks.”

Brent Tomlinson

 

Our speakers highlight that effective cyber risk management begins with clear standards and basic data to guide decisions, while focusing on common threats like identity impersonation, social engineering, and third-party risk. Simple, consistent controls—such as counterparty verification and defined cash flow processes—are key to reducing exposure and preventing costly incidents.