Cyber risks are no longer just an IT issue. Today, a single incident can bring entire industries to a standstill. When several European airports came to a standstill in September 2025 due to an attack on a service provider, it became clear that a digital incident can bring physical infrastructure to a standstill.
For M&A, private equity and banks, this means that what used to be a side note in technical due diligence can now determine purchase prices, portfolio stability or credit risks.
Pre-deal: If you buy without a cyber check, you're flying blind
The best-known cases show the financial consequences that cyber incidents can have in the transaction context:
- Yahoo: During the takeover by Verizon, a massive data theft became public - the purchase price fell by 350 million US dollars.
- Equifax: An unpatched vulnerability led to one of the largest data leaks - with subsequent costs of around 800 million US dollars.
- Marriott-Starwood: More than 500 million guest data were compromised - penalties, lawsuits and considerable loss of reputation followed.
These cases are no longer an exception. They show that Cyber is a financial risk factor - comparable to an additional balance sheet item. And this doesn't just apply to large corporations. Medium-sized companies are particularly vulnerable: outdated systems, shadow IT, stolen access on the darknet. There is also a new risk: personal attacks on CEOs - from deepfakes to false narratives that can destroy trust overnight.
Post deal: A PortCo can cause the fund to falter
Pressure continues to rise in the private equity environment. A single PortCo with a critical vulnerability can destabilize entire funds - especially in the buy-and-build model. With every takeover, not only the balance sheet grows, but also the digital attack surface.
The latest cases speak for themselves:
- CrowdStrike outage: A faulty update paralyzed Windows systems worldwide - with a massive impact on portfolios.
- Snowflake leaks: data leaks hit banks, retailers and service providers simultaneously - with domino effects in supply chains.
Cyber incidents rarely stop the entire deal - but they shift conditions, delay closing processes and lead to price discounts. Portfolio transparency thus becomes a question of survival.
Banks: Cyber is the new credit risk
Even banks can no longer dismiss cyber as a technology issue. A hacked PortCo can lead to a loan default within a very short time. Regulators are already reacting:
- NIS2: Obliges over 30,000 companies to check supply chains and critical partners for cyber risks.
- DORA: Requires end-to-end cyber risk management in the financial sector - including external service providers.
Cyber is thus becoming a factor in credit checks and financing - just like creditworthiness and cash flow.
IP & reputation: The invisible assets in risk
Cyber attacks no longer only affect firewalls:
- Intellectual property - source code, technical documentation or research results - can be stolen directly.
- Reputation - a CEO who is defamed on the darknet can lose trust and market value within hours.
Every company with Internet access is potentially affected - regardless of size or sector.
From podcast to practical case: How small the leak can be
In the Merge with Caution podcast, an example from everyday life was given: Tailgating - someone holds the door open in the office and a stranger has access. No hack, no malware. Just a little carelessness - with potentially ruinous consequences.
The lesson: Cyber doesn't start in the data center, but in everyday life. And small mistakes lead to major damage - especially during ongoing deals.
Learning from the insurance industry
Cyber insurers have been working with outside-in ratings for years in order to assess risks on the basis of facts. Why?
- Real-time analysis instead of months of testing
- No system interventions necessary (non-intrusive)
- Focus on relevance - no overloading, clear priorities
What has proven itself in underwriting is now becoming relevant for M&A, PE and banks.
Conclusion: Cyber, cash & chaos - and a question of transparency
Cyber rarely brings deals to a standstill - but it does shake them up. Price markdowns, exit problems, regulatory consequences, loss of trust: all real consequences.
The key question today is: How quickly can you gain transparency about the cyber risk of a target or PortCo?
This is exactly where solutions like cysmo® come in. Since 2017, outside-in ratings have enabled an assessment within minutes - without any prior technical knowledge, at the touch of a button and for companies of any size. You can see immediately:
- Was the company attacked?
- Where are the biggest gaps?
- What are the financial risks?
Cyber is therefore not a showstopper, but a controllable factor - from the individual case to the overall portfolio.
This is a guest article by Hannah Victoria Groß, Chief Digital Officer at cysmo.
To the AMBER Directory entry of cysmo
