Kroll Conversations: Meet the Private Equity Experts

According to recent Kroll research, cybersecurity weaknesses in private equity portfolio companies now pose a significant material threat to deal flow and valuation. Owen Wagoner and Sean Appelson are helping change that. As part of Kroll’s Private Equity Team, they deliver tailored cybersecurity advisory services to enable private equity firms to protect portfolio value and secure exit value.

Sean explains: “We are typically hired to either look at the portfolio of a firm or one specific portfolio company (PortCo). That involves security controls assessments through which we build a profile of an organization’s security infrastructure, identify key risks, prioritize the remediation steps required and provide decision-makers clear visibility into the risks that matter most to the deal. On the transaction side, I also work on technical due diligence, where we evaluate the technical controls of businesses that private equity firms are looking to acquire. Beyond that, much of my work runs across the broader Cyber and Data Resilience team in areas such as security operations, security controls testing, and incident readiness.”

“I support both the private equity channel and how we go to market for Cyber and Data Resilience,” says Owen. “We provide private equity firms and their PortCos with recommendations that can inform zero-to-100-day planning, followed by ongoing monitoring and support. My role involves a lot of balancing between how we reach clients and how we deliver the work. I’m also involved with our assess-and-recommend work and the more developmental side, for example, exploring how we can deliver our solutions with new platforms or applications, or enhance our existing services and workflow processes with AI.”

 

Unique Insights

With more than half of private equity firms anticipating the financial impact of cyberattacks increasing between now and early 2027, cybersecurity has a vital role to play in the sector’s resilience.

“While cyber was once typically viewed as a cost to the business, I think it’s increasingly recognized as value protection,” comments Owen. “Cybersecurity is a true value-add that enables private equity firms to increase and articulate the improvement within their cyber posture, and allows PortCos to increase their value or, at a minimum, to protect their current value.”

Sean and Owen emphasize the benefits of Kroll’s breadth of expertise in a sector where the financial impact of cybersecurity incidents on deals has been found to average around $2.1 million.

“Kroll’s real strength is the breadth of its service offerings, from digital forensics and incident response to threat intelligence to advisory services around compliance, for example,” states Sean.

“Because all those disciplines sit under one roof, we can apply multiple perspectives and deep insight to the security issues affecting them. Working across so many industries means that when we recognize that problems we observe in one sector might be pertinent to another, we can bring that insight across to bridge the gap.”

Owen adds, “At Kroll, we bring end-to-end services at the private equity firm level, as well as at the portfolio level, whether that’s financial advisory or risk advisory services. I think that sets Kroll apart. The other great thing is that Kroll is nimble enough to try new things out. We can explore delivering services in different ways or developing new types of services, depending on what clients need. There’s a bit of a startup approach here that means we can be more creative, responsive and customer driven in the way we go to market.” 

 

From Aviation to Pizza

Working across industries and businesses as diverse as healthcare, aviation and a local pizza joint plays perfectly to Owen and Sean’s skill sets.

“I’ve always loved being a translator between very technical and very business-minded folks, being the in-between person that can balance the two worlds,” shares Owen.

“I’ve been fortunate to work across a wide range of roles, and that range is genuinely useful in this work,” comments Sean. “I think that range of experiences helps me put myself in the client’s shoes and understand the pressures they’re actually under.”

 

Trusted Advisors

Securing PortCos against increasingly complex threats calls not only for technical acumen but for strong interpersonal skills too, as Owen highlights.

“In an industry that can be very transactional, we like to build long-lasting relationships with PortCos. We aim to have an advisory relationship with PortCos that mirrors their life cycle.” 

“Empathy matters enormously in this role,” remarks Sean. “It involves a lot of listening and understanding what a client is actually facing and then translating a complex security picture into decisions they can act on. That’s how the relationship grows into a trusted advisor partnership.”

 

A Sector Under Pressure

Private equity companies face a demanding commercial environment. With small- and mid-market firms especially vulnerable to deal value destruction as a result of security issues, Sean emphasizes that it is critical to prioritize security at every stage.

“It is vital that investors consider security at the beginning of their acquisitions of PortCos,” Sean says. There’s a heightened period of risk during a transaction, so they should make sure they’re investing in security and implementing those recommendations at that point. From a broader perspective, private equity firms must ensure that security is addressed not just at the inception of a deal, but all the way through.”

As Owen points out, the risk is now significant for private equity companies that underestimate security threats:

“The private equity report we published earlier this year highlighted the fact that a lot of smaller firms, or those that don’t take a proactive approach to managing cyber risk, are the ones seeing the impacts from security incidents. I also think the firms that take a very hands-off approach tend to be the ones experiencing issues. For organizations that haven’t been improving their cyber program and risk management as it relates to vulnerability management and patch management, the evolution of AI, such as Mythos, Fable and the frontier AI models, is going to prove a new challenge.”

 

Learn More About our Services