Insight

The cybersecurity risk multiplier in M&A

Name: Yep Digital
Price range: $

Mergers, acquisitions and divestments create new cyber risks. During the transaction period the business and workforce are changing rapidly, often against a strict timetable. The deal itself can increase visibility of the companies involved, potentially attracting more attention from cyber criminals. This is why early involvement of the cyber team is critical.

In this article, we consider some of the key issues that, in our experience, businesses should be aware of both during the transfer period and beyond.

The risk profile changes

Bringing companies together doesn’t mean simply combining their risk profiles. It creates an entirely new risk profile, because the new company is different. If a smaller company is merging with a larger, higher-profile one for example, the attention it receives from cyber criminals might be very different from what it experienced before.

Added to this complexity, the companies involved will each have third-party suppliers, so you are combining two or more ecosystems, which creates a multiplier effect. The period of the business change itself will probably also involve additional consultants to support the transaction. All these elements together present additional risk for the cyber team to contend with.

You can’t protect what you don’t see

One of the early priorities during M&A is scoping out all the systems, applications and users that exist across the businesses involved. Over time they might get combined and rationalised, but in the early stages, the number of elements that need to be protected will expand.

This baselining activity will form part of the technology transfer. From a cyber perspective, the team are effectively protecting a moving target, so they need visibility of the changing estate. Information needs to be available early on to make sure that protection is expanded to cover the entire estate.

Bringing companies together creates an entirely new risk profile, because the new company is different.

Integration isn’t immediate

Each organisation involved in the deal will have its own tools, processes and policies regarding cybersecurity. The initial assessment of the technical estates is where these will be reviewed. It isn’t necessarily that one approach should take precedence over the other, but about working together to decide the best solution for the new organisation.

In all likelihood, across the technology estate as a whole, there will be a period when old and new systems will have to coexist. The cyber team will be working on BAU as well as the merger so rationalising systems where possible will help with the demands on their team.

Ambiguity creates risk

The process of the M&A brings with it change. For example, communication methods between companies can differ – Teams, WhatsApp, email etc. Where the population of a company changes, suddenly employees are getting messages from people they don’t know, potentially in formats they don’t usually use. While normally this might be a cause for concern, the ambiguity of the business change might mean people let their guard down, particularly if they are keen to support the new enterprise. Unusual becomes normal for a while, and this can be where the risk lies.

While the systems that protect a business need to be expanded during a period of M&A, the awareness and vigilance of the people also needs to stay high. In one transaction we dealt with, an employee received an unexpected WhatsApp message purporting to be from a senior colleague. Luckily they flagged it to the cyber team and it did turn out to be an impersonation attempt. It is very easy to see how things like this could slip through so the people element of cybersecurity is even more important during these periods.

There isn’t one best approach to cybersecurity, it is about building layers.

New ways of working

As a company changes, new processes and systems will be developed. This can cause confusion and frustration among people who want to work the way that they did before. Informal ways of working can become a security risk: great technology cannot make up for confused or frustrated people. Training and embedding are particularly important at this point. If people try to find workarounds, this can hinder productivity and present a real cyber risk.

A company-wide cyber awareness campaign across the newly formed organisation would be highly beneficial. Management endorsement is key to its success, with leaders regularly reinforcing the importance of the training through town halls, weekly meetings, and team briefings. Consistent messaging from leadership helps encourage greater engagement across the business.

This will help people to understand changes to processes, MFA and what to do when things don’t look right. In a major M&A we dealt with, one of the ways we approached this was by line managers reinforcing the messaging about the phishing reporting button with their teams. This resulted in a marked increase in reporting. Simple interventions that are embedded into everyday working practices are just as important as technical tools.

There isn’t one best approach to cybersecurity, it is about building layers. Technology, threat intelligence, governance and people all need to work together so that if one layer fails, the others are there to protect the business. This becomes even more important during a period of significant business change.