It is not surprising considering the tsunami of threats and attacks this year alone. Consider that in just the last 6 months:

• The recent National Security Agency (NSA) announcement detailed the top 25 vulnerabilities that are currently being consistently scanned, targeted, and exploited by Chinese state-sponsored hacking groups.
• Remote work can increase the cybersecurity attack surface. According to an article titled "COVID-19's Remote Workforce: Protect Your Rapidly Growing Attack Surface" in Security Intelligence, the shift to remote work caught many security leaders off guard, and employees that used their home computers were exposing the company to potential cyber-attacks. 
• The latency and limited scope of CVSS scores from the National Vulnerability Database (NVD) represent an additional risk in a faster pace threat environment.

As companies, advisors, and banks consider their M&A roadmap, an assessment of a target company’s cyber risk profile is now a business-critical element of the due diligence and valuation process. In addition, senior managers and organizational consultants will need to increasingly consider how to bring two different IT Security shops together and establish a baseline approach to policies and procedures.

“From a growing attack surface and the increased use of open-source software to legacy organizational vulnerability deficits and labor-intensive, manual remediation management, it is challenging to scale up an IT security organization in the face of today’s cyber threat environment, said Mark Fidel, RiskSense Cofounder. It really is all about understanding each company's Vulnerability Risk Rating as well as assessing each company’s IT Security policies and procedures.”

Ok, so you have concluded additional focus and expertise are needed to more fully address potential cyber risks in your M&A plans. But how do you actually perform an assessment given the often large scale and scope of a company’s attack surface, different IT security tools and programs, and the inherent friction of two different IT Security teams viewing things differently?

Earlier this year, Gus Fritschie, Vice President of Security Services, of Bulletproof, a GLI company assisted two major publicly traded companies in a pre-merger cybersecurity risk assessment. He had to address several business-critical considerations; how to quickly and effectively manage a large sample size of recent scan data from across each organization and then apply a vulnerability risk assessment methodology that would be objective, substantive, and instructive from an organizational perspective.

To speed the assessment and communicate the results in a way that both organizations would be on the same page, Gus brought in the vulnerability risk experts from RiskSense to utilize their nationally recognized platform and automated prioritization engine. Working with each of the merger partners’ IT Security teams, Gus and Glen Bradly, RiskSense Senior Solutions Engineer, ingested recent vulnerability scans performed by the target organizations from over 70,000 IT assets from each company. Using the RiskSense platform’s flexible capabilities for grouping and filtering, and applying their unique Vulnerability Risk Rating (known as the “RS3” score), the merger partners received detailed reports customized for their respective organizations, while also having access to the RiskSense dashboards for detail, including links to recent threat intelligence and remediation recommendations. At the same time, Gus performed an audit and assessment of each organization’s IT Security policies and procedures.

When considering mergers and acquisitions, the urgency of making cyber risk management a key priority is clear. In addition to considering leading vulnerability solutions like RiskSense and Zero Trust innovators like NetFoundry, it is business-critical to align business and cybersecurity considerations and objectives.

Jim Watts PMP, Client Service Delivery Lead, Cyber Risk Management Group, has supported key IT projects at major companies such as Home Depot, AT&T, and Fiserv. Over his 30 years of experience in technology and IT Project Management, and most recently supporting the implementation of best-practice based cyber risk management programs, Jim stresses the importance of aligning technology and business objectives.

“Having technology and business alignment managed through a governance process in a post-merger organization is a key success," said Jim. "By leveraging a comprehensive 'Process Governance', leaders can ensure alignment between technology and the business is in place, and key measurement cyber risk management indicators can be used to measure progress toward goals and keep work efforts on track. When it comes to the financial, business, and liability implications of cyber attacks, the cyber risk for mergers and acquisition represents a key area for improvement. It was once said that 'The second kick of the mule should not be educational.'"