Top 5 Cyber Threats To M&As

Global mergers and acquisitions (M&A) activity continues to accelerate at a rapid rate¹ in both private and public markets as the world recovers from the lows of the pandemic while analysts predict that the 2023 M&A market could represent a return to healthy volumes².

This accelerated M&A activity is also being characterized by complexity, with transactions including features that would have been unfamiliar to dealmakers just a few years ago, such as the prominence of ESG considerations, ferment in public markets, and digital technology becoming more central to most business models³.

The rising influence of these factors on M&A demands new ways of thinking about value creation and risk. “For instance, with digital so undoubtedly central to how businesses operate and drive revenue today, digital assets and capabilities will be under even greater scrutiny,” says Alistair Lester, Aon’s global co-CEO for M&A and Transaction Solutions. “Buyers are now looking closely at how an acquisition target runs its IT and other processes.”

“We can expect more scrutiny and critical challenges around deals going forward,” he adds.

Top five cyber risks that can potentially threaten M&A

Deals can implode over cyber security

“You do not only acquire a company, but also its cyber security risks,” says Ian McCaw, Aon’s head of Digital, M&A and Transaction Solutions. “Today, every business has a cyber story that you should know early in the deal lifecycle,” McCaw explains. “We have seen compromised customer data for established online brands, single points-of-failure in major digital ecosystems, multi-million-dollar cyber investments required for industrial firms and a plethora of critical vulnerabilities.”

Yet, Aon research and analysis has found that as organizations navigate rapid digital evolution, only 17 percent have adequate security measures in place. Also, while 42 percent of respondents said that failure to identify cyber security and technology risks in M&A targets could prevent a deal from taking place, only a quarter cited cyber security as an important focus area for due diligence. This could be a result of insufficient knowledge and expertise in the workforce to identify and highlight potential cyber security issues.

For some deal teams, cyber is not considered material enough to look at during pre-deal, being pushed to post-deal analysis at best. Some mistakenly believe IT due diligence covers cyber due diligence. More worryingly, deal teams can become blinkered, having already emotionally bought into the target business and preferring not to know.

“No deal has ever been made worse by performing cyber due diligence; a process that reveals a spectrum of cyber-related strategic deal issues, hidden costs, and operational risks before finalizing an investment in a business,” says Adam Peckman, Aon’s head of Cyber Solutions for APAC. “Cyber due diligence provides new insights to detect ‘bad eggs’, thereby helping to reduce risk to investor capital, whilst offering deal teams a competitive edge to enhance returns.”

How can executives and deal teams create a competitive advantage?

So, how can executives and deal teams solve the cyber puzzle? “The key is to address and manage cyber risk as a balance sheet liability from an early stage of a transaction,” Peckman advises. “Cyber diligence can uncover potential additional costs, liabilities, and operational risks, bringing significant ROI, saving deal costs and enhancing returns.”

While value creation opportunities in M&A transactions are abundant, so are the risks of leaving value on the table or worse, if litigation follows. Dealmakers are listening and increasingly considering investing more in due diligence when considering a transaction. However, this process could lead to delays, and ones that last more than four months can cost parties an average of 16 percent of deal value.⁶

“Today every deal is a technology deal,” says McCaw. “Executives that can think about cyber risk in capital terms at the get-go will be ready for the next stage of the journey, avoiding delays in deal completion and unnecessary risk on investment capital and future returns.”

¹ C-Suite Series: M&A report – Better decisions for deal value
² Bloomberg Law: 2023 M&A Market May Reveal a Return to Pre-2021 Levels
³ C-Suite Series: M&A report – Better decisions for deal value
⁴ Cost of a Data Breach Report 2022 | IBM
⁵ The Cyber Loop: Managing cyber risk requires a circular strategy
⁶ TMF Group: Cross-border carve-outs 2020 – Why one third fail and how to get them right

Disclaimer
This material has been prepared for informational purposes only and should not be relied upon for any other purpose. You should consult with your own legal and information security advisors or IT Department before implementing any recommendation or guidance provided herein.