Steps To Protect Against Cybersecurity Threats During Mergers and Acquisitions

Transactions involving U.S. targets and acquirers continue to represent a substantial percentage of overall deal volume, with U.S. M&A exceeding $1.26 trillion in 2023, according to research from the Harvard Law School Forum on Corporate Governance. Stakeholders must consider various factors, including political agendas and regulation rules, to ensure mergers are approved. While cybersecurity may not be at the top of the list of hurdles companies must overcome during a merger, it should be. Frequently, while two companies are working closely to merge, cybercriminals are taking advantage of security gaps.

Company leaders must take a holistic view of cybersecurity to ensure a successful merger. To understand a company’s capabilities to identify, protect, detect, respond, and recover from cybersecurity threats, companies should focus on three core areas:

• Protect against potential data breaches.
• Simplify integration of critical operational and security systems.
• Take a security-by-design approach.

Protect Against Potential Data Breaches

The role of cybersecurity is more important than ever. Hackers are located worldwide, are equipped with the most advanced technologies, and are always looking for system weaknesses and vulnerabilities, which makes safeguarding corporate systems and data challenging. Companies entering or are currently engaged in a merger must prioritize cybersecurity measures to minimize security breaches, as these incidents can greatly reduce company valuation. Strong data security measures include planning on multiple levels and the implementation of processes, controls, and technology, such as access controls, network security, operation systems integration, and encryption.

One of the primary areas to focus on is securing systems that integrate personal and business data and business-critical information. These systems contain essential data critical to a company’s success, and exposing sensitive information could be disastrous. It’s prudent to first focus on systems related to HR, benefits, and payroll, as they house sensitive personal information. Breaches in these areas can result in legal actions, substantial financial losses, and erosion of employee and investor trust. Additionally, cybersecurity issues can lead to public data leaks, damaging the company’s value and market reputation.

Management must adopt robust cybersecurity strategies to protect employees, customers, partners, and investors. This strategy should include thorough risk assessment, implementation of advanced security measures, and ongoing monitoring of newly integrated systems to ensure that all sensitive data is protected.

 Simplify Integration of Critical Operational and Security Systems

Companies should take four steps to overcome security challenges: pre-merger, execution, transition, and post-merger integration. Addressing these challenges in four distinct phases helps ensure a smoother transition.

1. Pre-merger: Create an overview of the company’s cyber landscape, both currently and what is expected during the next few years. Examine all systems to determine the starting point and work closely with experts to follow essential regulations.
2. Execution: After examining all systems, identify potential threats and establish steps to address them.
3. Transition: Develop an integration strategy that includes addressing system redundancies. Pay attention to fixing weaknesses in the system.
4. Post-merger: Once the transition has been completed, troubleshoot any new issues and identify what worked and what surprised the IT team.

Take a Security-by-Design Approach

One of the primary challenges during the M&A process is promoting awareness among all employees about the importance of cybersecurity. Developing and implementing a thorough merger integration plan, one that is supported by management and IT, along with input from the corporate compliance team, is critical to achieving success. Attention to detail, particularly regarding how system integration affects daily business operations, is crucial.

Collaboration between the two companies is essential. The acquiring company must give the target company the flexibility to adopt the integration and cybersecurity strategy without disrupting existing business processes. Doing so will benefit everyone, ranging from increasing employee collaboration to alerting all employees to the importance of adhering to cybersecurity policies.

One option during the M&A process is to consider insurance for cyber risks. While the coverage depends on the potential impact of damages, the focus should be on “cost per record”. If a breach happens and bad actors demand a ransom, the question is, what is typically the average cost per compromised record? Understanding the sensitivity of data being managed is the primary issue. There are different types of insurance coverage for this situation, so research options thoroughly before making any final decisions.

Lastly, include other teams in the integration discussion, including management teams. These teams can contribute in many ways, from ensuring future operating models to addressing daily business processes.

Planning for Today Leads to a Better Tomorrow

M&A is challenging enough for both companies, let alone the implications of IT integration and addressing cybersecurity issues. Identifying and addressing existing cybersecurity threats before the merger puts the new company in a stronger position to succeed.

Having a carefully designed integration plan, based on the four steps outlined above, helps ensure that both companies are better protected. Seamless integration is never easy, yet it is critical to protecting the integrity, reputation, and profitability of both companies. Shining a light on the importance of cybersecurity throughout both organizations and building a solid culture around cybersecurity dramatically reduces risks and sets the new company up for success.

About the Author

Saugat Sindhu is the Senior Partner and Global Head, Advisory Services of Wipro Limited. He leads a diverse group of practitioners globally, providing management consulting and business advisory services at Wipro focused on cybersecurity and risk, and related technology integration and transformation services for commercial and public sector clients. He is responsible for leading strategy development and execution planning, industry motions, solution innovation, and client service for Wipro’s Cyber Advisory business. His major industry expertise includes Media, Technology and Telecom. Saugat can be reached online at https://www.linkedin.com/in/saugatsindhu/ and at our company website https://www.wipro.com