Cyber risk belongs
in the investment case.

THE VALUE CASE

Make the commercial mechanism visible.

There is a credible case for cleaner diligence, more dependable operations, investor confidence and fewer avoidable surprises at exit. Those are potential benefits of disciplined risk management. They do not establish a guaranteed valuation premium, a fixed price discount or a faster sale.

Report cyber risk alongside financial, legal and operational risks, using a shared language of consequence, uncertainty and accountable action. A threat briefing still has a place, but it needs a clear connection to the investment thesis.

THE FIRST 100 DAYS

Turn findings into an operating plan.

A long remediation list is not a funded programme. Bring the target’s leaders and the investment team together around a short set of material actions, agreed dependencies and clear evidence of completion. The sequence should reflect the consequences of failure, not an arbitrary race to close the most tickets.

• Control access: establish who can administer important systems, how access changes at completion and how emergency access is controlled. Include departing owners, external support and shared accounts.
• Prove recovery: choose a critical service and examine a realistic restoration exercise, the data it needs and the external teams it relies on. A backup-job success message is not the same as a recovered business service.
• Test important exposure: agree a proportionate scope for penetration testing or other validation, repair material findings and confirm the relevant changes worked. A test’s date and coverage belong beside its result.
• Prepare the decision-makers: confirm incident roles, contact routes and escalation authority. Exercise a consequential scenario with the people who would need to make business decisions.

Record the owner, resources, target date, completion evidence and residual risk for each priority. When a transitional service or supplier dependency prevents completion, show the constraint and the contingency. Stabilisation and longer-term improvement can then be managed as different commitments.

PORTFOLIO OVERSIGHT

Look for the dependency that repeats.

A portfolio dashboard can conceal concentration if every company is assessed separately. Several investments may rely on the same managed service provider, identity platform, payroll system, cloud service, or specialist support team. A shared disruption can create competing recovery demands.

Ask operating partners to examine those connections. A useful report identifies the service, the dependency, the plausible consequence, and the action required. A long list of vulnerabilities is less helpful if nobody can explain which finding threatens the business plan.

The right comparison is not whether every company has the same tool. It is whether material risks are understood, actions are funded, and the evidence supports the conclusions being reported.

A consistent dashboard should show meaningful service outcomes and material exceptions, rather than forcing every business into an identical control checklist. NIST’s Current and Target Profiles provide a way to describe where a business is and where it intends to get to. Retain the evidence, assumptions and scope behind any summary score.

EXIT READINESS

Let the buyer trace the conclusion.

Prepare the evidence while the business is being improved. An exit folder assembled at the last moment can expose contradictions between the dashboard, the actual service estate and what management says has been fixed.

An ISO/IEC 27001 certificate and a SOC 2 report are different forms of assurance. SOC 2 is an examination report, not a certification. Check whether the systems, services, period and controls examined are relevant to the target and the transaction. Neither should be presented as a guarantee that the whole business is secure.

Good preparation gives a buyer a more coherent basis for questions and gives management a defensible account of progress. Claims about valuation, buyer preference or transaction speed still need transaction-specific evidence.

CURRENT CONTEXT

Governance has become more concrete.

The UK’s Cyber Governance Code of Practice gives boards a practical starting point for ownership, strategy, response, and assurance. For an investor, the useful test is whether those responsibilities appear in the portfolio company’s actual governance—not simply in a due-diligence folder.

The FCA’s 2025 Cyber Coordination Group insights, published in April 2026 discuss incident response and recovery at scale. They are shared industry insights, not additional regulatory expectations. Their relevance to a deal is the quality of the recovery evidence, rather than a headline maturity score.

AI & CHANGE

Faster discovery does not remove the need for safe change.

The FCA’s September 2026 frontier-AI review reports that firms’ results depend strongly on governance, tooling, controls, and human oversight. It does not establish that an AI product automatically makes a portfolio company resilient.

For a newly acquired business, ask how AI-assisted development, additional integrations, or faster vulnerability discovery affect the change process. Someone still needs to establish what is exposed, decide on priorities, validate a fix, and confirm that the service continues to work.

Apply regulated-sector material in context. A portfolio company does not inherit every FCA requirement simply because its owner operates in financial services; confirm the duties that apply to each legal entity and activity.