Why cybersecurity must be top-of-mind during M&As

MERGERS and Acquisitions (M&As) have been heating up across the globe. In Singapore alone, there were a record S$23.2 billion in deals in the first half of this year, up 154 per cent from the same period a year ago.

While this high activity level might indicate a rosy outlook for companies and the market overall, M&As can also bring significant risks to an organisation. The due diligence process is designed to help mitigate that risk as best as can be done. But evaluating newer areas of risk that come with the digital age, like cybersecurity, has been slower to catch on.

In our M&A cybersecurity risk survey "The Role of Cybersecurity in M&A Diligence", we found that more than half of IT and business decision makers globally reported that their organisations encountered a critical cybersecurity issue or incident during an M&A deal that put the deal in jeopardy. Furthermore, 65 per cent of respondents in Singapore said their companies regretted making an M&A deal due to cybersecurity concerns.

The hallmark example of such troubles is the fraught Marriott-Starwood merger, in which Marriott acquired many new hotel brands but also unwittingly inherited a mega data breach affecting more than 500 million customers due to a hack of Starwood's customer reservation database prior to the acquisition deal. This resulted in not just loss of trust from their customers, but also a S$169 million fine from the UK Information Commissioner's Office and a federal class-action lawsuit in the US.

Cases like this spell the need for businesses to conduct a more thorough assessment in order to have oversight into their acquisition target's cybersecurity posture. In doing so, they can better understand the risks that can come with such a deal and avoid a potential catastrophe down the line.

Bridging the cybersecurity gap

Traditional due diligence during the M&A process involves a heavy focus on areas such as finance, legal and human resources - with cybersecurity often coming in as an afterthought. Only 36 per cent of respondents globally said they strongly agreed they were given enough time to thoroughly review a target's cybersecurity posture before completing an acquisition.

Cybersecurity risk assessments should be an ongoing activity from the very beginning of the M&A process all the way through to post-acquisition because vulnerabilities can develop at any time as the target company continues to operate. But not all companies do this. For instance, fewer than half of respondents indicated that cyber assessment began at the start of the acquisition process. It is imperative that companies engaging in M&A reconsider their mindset towards cyber risk due diligence, and instead make a complete and thorough cyber assessment an ongoing part of the acquisition process.

Balancing risk and resources

Even with the right mindset, businesses may not have the right talent or skills to complete an adequate cybersecurity assessment. Pressing cybersecurity threats have increased the demand for cybersecurity professionals, making those with the right skills scarce or expensive to employ. Only 37 per cent of Singaporean IT decisions makers (ITDMs) strongly agree that their IT team has the skills necessary to conduct a cybersecurity assessment.

Companies looking to undertake acquisitions should set the groundwork by investing ahead to equip internal IT teams with the skills needed to conduct a thorough cybersecurity assessment. While limitations in resources are understandable, cutting corners here can spell serious issues later on during M&A deals. Another alternative can be to bring in external vendors with the right experience to help with the cybersecurity assessment.

Accounting for the Internet of Things

Nonetheless, even with an experienced team at the helm, a full cybersecurity assessment can be a tough undertaking, with human error and connected devices among the top risk factors. Internet of Things (IoT) devices were also identified as a top challenge because device and asset inventory during a cybersecurity assessment can pose a huge problem, especially as more and more devices are added to company networks. More than half of ITDMs say they find unaccounted-for devices after completing the integration process of a new acquisition. While traditional IT devices are relatively easier to locate, IoT and Operational Technology (OT) devices may also be unaccounted for, as these devices are often smaller or run legacy software that can be hard to detect and patch.

These devices can potentially introduce new vulnerabilities or vectors of attack to company networks if they are not identified. It is imperative to develop a full asset inventory with the right expertise and resources during the acquisition process in order to fully understand the scope of cybersecurity risk.

M&A deals have always come with some level of risk, which today is exacerbated by cybersecurity issues that have now come to the forefront. Companies must make the effort to run a continuous and adequate cyber assessment, or risk serious consequences further down the road.

Although time is always of the essence during acquisitions, certain diligence matters simply cannot be rushed. A hurried, uninformed or scope-limited cyber evaluation can have very real financial implications for both parties involved in the M&A deal. Conversely, when an experienced team is on board with enough time to conduct a full assessment and the right tools to develop full device visibility, they will smooth the path toward a successful acquisition.