Cybersecurity Mergers & Acquisitions - Crown Jewels and Red Flags

Thanks for tuning in to Simplifying Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And I'm Todd Wilkinson.

I'm Brendan Kern.

All right, Brendan, I think this is your first time on the show. Thanks for joining.

Yeah, thanks.

Good to have you. I know, uh, you've had a lot of experience in mergers and acquisitions and cyber, so we're excited to have you on this show. And Todd, you've been on the corporate side, as have I, with Cody, you've seen it on a number of different regards. So we're excited to dive into this conversation today and really jump in. We'll jump in right into the conversation. Let's start with like, Brandon, let's just define what is an M&A diligence assessment? Give us a little bit of the landscape of what we're talking about when we think about the cyber aspects of doing a deal.

No, good question. So cyber in the context of an M&A deal is all about risk-based, uh, identi— or risk identification throughout the transaction. So in the due diligence phase, you're, you're really examining the targets of the acquisition. You're looking for major red flags, prior incidents, any kind of risks that once the transaction closes, you're going to have to clean up or otherwise remediate.

And simplistically, could we think about this very simplistically as like a home inspection? Yeah. You make an offer, initial offer to buy a house. You have that 4 or 5-hour home inspection, you get a bunch of findings, and then you decide like, hey, how much am I going to reduce the price for this? Am I gonna— like, recently my parents walked away from a home purchase.

Exactly.

Thankfully, because they live on a lake and they were looking to not live on the lake. I know, I know. It's a good thing. I'm glad that inspection was negative.

Yeah, exactly. You're looking for red flags. You're looking for things that are going to cost you, right, in the end as the buyer. Basically things that you can either use to lower the cost of the acquisition, or again, you know, if it's major enough, if there's IP loss, right? I don't— I'm buying the IP. If it's already exposed, I no longer want to buy it.

So Todd, we talk a lot about business-driven risk management, or the old-school term is crown jewels. You've been multiple decades as the buy— maybe not multiple, double decades on the corporate side.

40 years.

How great is it?

Oh my gosh. But, you know, you think about crown jewels. Critical risks. Talk about when you're looking at an acquisition target or you're looking to divest, what do crown jewels have to do with M&A focus?

It typically, or at least I've seen typically, when you're going to go make an acquisition, there's one or two reasons that you're driving this acquisition. I may want a product, I may want something in the pipeline, or quite frankly, I may want to buy out the competition. Those are things that typically drive that. So you're not going in necessarily thinking I care about the whole entire estate.

It depends.

It depends. But you are going in and saying, all right, the asset that I want to buy, is it really there? Is it— does it have associated risk associated with it itself, that product or that manufacturing line or whatever it might be? So that's what you're going in to verify. Is the thing I want actually there? And then the second piece of that story is, okay, how much distractions am I buying? And it could very well be they've got a lot of risk on other parts of the business, but I don't really care about that. So part of my story might be to make the acquisition as quickly as possible, get rid of that other stuff that I don't—

Staying on you, Todd, just because you've been on the corporate side, you've done these, you know, been part of these large deals from a cyber standpoint. How do we align the cyber due diligence that we're doing from an overall business standpoint as well as regulatory?

Okay, so two things about that. I think one, is from the alignment of the risk. I think a key piece is if you're coming in going, we've made an offer and sometimes you're coming in, the offer has already been made, or at least there's been some facilitation of a price, or maybe there's not. But you are going to look at that and go, okay, how much, how much problem children are underneath the covers there? And you actually bring that back into the deal, say, hey, I'd love to make this offer, but there's $20 million worth of work that we have to do that was unanticipated or not part of that original conversation. We need to adjust the price. That's a big deal at a table. So you got to come in ready to go. This is the actual issue. I think the second piece of that story is you're going to close that deal. What follow-on work do you have to do on day 1 versus day 60 versus day 365? Using that early diligence to map out what that acquisition actually looks like long term can really accelerate the deal and the closure of it, which is the longer that deal takes to close, Longer and the more money you're spending to keep things going. So you want to close the deal as much as possible and then get the integration stuff out of the way.

Well, and sometimes it's going to happen. So it's just whether you know about it earlier or later, but it will happen. But it's nice to know the surprises before you acquire it.

And Cody, I swear this isn't going to be like the Saturday Night Live sketch, What's Up With That? with Lindsey Buckingham, where they come to him at the very end and then they run out of time. I will not do that to you. But going back to Brandon, just because you have the experience kind of on the the big consulting, you know, you spent a number of years on that space before you joined Reveal Risk and really expanded your horizons into much cooler stuff. But when ideally should a buyer, from your experience of what went well and didn't, bring us, Cyber, or the Cyber support, into a deal lifecycle to get the most value and why?

Yeah, good, good question. I'll start with, with a slightly different question is, when do we typically get brought in? And that's too late, right? The earlier the better. You know, as Todd's mentioned, and, you know, you brought up the home inspection, right? You want to know all of these red flags. You want to know these things upfront so you can then integrate that red flag or that challenge into other streams' challenges as well, right? Finance may have their own things, HR have their own things, but if we can kind of look under the covers and kind of all come together on, you know, we're all going to have to be compliant to this regulatory requirement. Then you can almost piece cyber into that as well. So to answer your question, it's all about how early can you get cyber involved? And a lot of times it rides on IT being involved, which is looking more at like the network side of things, the connectivity of things, the, you know, technical structure of the organization where, you know, cyber, you want to, again, identify those risks as early as possible so you can start to plan for those and start to remediate those if you can.

So Cody Buckingham, I told you I wouldn't do that to you, so I'm going to bring you right in right now. All right. So let's assume assume you have your home inspection, you've made the deal offer, you got back the inspection report, it's not so great on cyber, and you're helping a client right now with diligence deals and negotiation, and there's a deal that they passed on, not only based on cyber, but some other stuff, but talk to me about how does cyber come into whether you pass, whether you reduce the price, like how does that work?

Yeah, so I think a lot of things. Nice that you're seeing now, like security kind of come outside of IT before it was kind of under IT nested as like a you get 3 questions in the IT meeting. So it's nice now to kind of get like your own kind of time to the table. I think the key thing is, um, a lot of like compliance and regulatory things are like, if I'm going to chase business or I need to, to keep this revenue stream going, what do I need in place? And especially if the target may be, uh, more mature than like the acquiring body. And so now I— now the mothership has to level up real quick. So it kind of gives a, a— to your point, like that 30, 60, 90, 120 of like What do we got to do real fast to either maintain business or keep chasing business? Because end of the day, when you're buying a company, you're not looking to, to pull back. You're looking to kind of chase forward. So I think it helps to know where to focus. And in a, in a world where we all have the fighting for priority, you got to make sure that this is why it's priority.

This is what we're going to keep doing.

So it gives some support to that.

Yeah, that makes sense. So Todd, what are the biggest misconceptions that clients or business partners that are doing these deals have about an M&A cyber due diligence and maybe seeding the clouds, how do we reset some of those expectations that you might be about to tell us?

Yeah, so having been in the room with some of those, they tend to get nervous when the security professionals are there, 'cause they're gonna feel like they're gonna get a long laundry list of things they have to do. But I try to seed it a different way. You're either buying revenue, buying people, or buying a product. And when you purchase a company, the longer it takes to do that acquisition, the longer that gets drug out, the more that revenue drops off. It just does. Acquisitions are a distraction for everyone involved until you get into the normal rhythm. So one of the things that helps is how can you use security to focus on the, what are the things we're going to take risk on fast and move? Like how do I get people going on day 1, day 2, day 3 as quickly as possible and say, we're going to accept some risk, we're going to recommend you accept that risk, not just play a, here are the risks and then pivot back and going, Hey, we did buy some stuff. There's some warts under the covers. They need to get on the roadmap of being fixed, but these things can probably wait 30 days or 60 days. You know, building the house analogy. Hey, I bought a house and the furnace is trash, but it's April. It's okay. I can wait till October to fix the furnace versus the air conditioner's bad. Let's fix that day one.

I'll add an example. I remember talking with one of the VPs at one of the companies I worked with that may or may not have been on this show and asking her, Why is cyber last to the table or too late to your point of like, it seems to be always too late. And it's really the need for speed and business people want to do deals fast and they want to, they're eager to make the deal and they may not want the distraction, even, even if the, you know, the money reduction opportunity is there, they'd rather get the deal done and then sort it out on the back end, even though we all know that could be costly. You could end up with the money pit house from a company analogy standpoint that you've gotta spend $5 million that you didn't think about to even get them integrated with your environment.

I was gonna say having a bias to action is helpful because that's what everybody's there for. How quickly can you make a decision and can you do it in the room while you're there? Not give us a week to come back.

So knowledgeable, agile professionals that can be lean in and out. Get what you need, not spend extra weeks elongating a deal. It's all about efficiency, having a playbook, which we've done a lot of, and then really making it seem seamless with the rest of the process, not the longest bull in the tent.

And I remember our conversation too, when you were saying like, sometimes you don't get all the time. It's like, hey, you get like 30 minutes, 30, 45 minutes, and they'll give you what you give you. But what are those few questions you're asking? Like say, hey, you don't get to have a full hour, you get 3 to 5 questions. What are you looking at when you walk in?

How are people going to work day one? And this is a simple question. Are you going to hand them new laptops? Are they going to use the laptops that they used before? Or are you going to have some new way through virtual desktops or their phones that they're going to work? Or was that not thought out? That quicker to get that day one scenario for the employees on the ground using security as a spearhead to think through that, that way your IT partners can think through it, your logistics folks can be ready to go. That's a huge win just to keep the business flowing. That day 2 question is, where does that ERP data go? How will the financial transaction gonna happen? Are you gonna bridge networks together or are you gonna keep systems separate? Which drives into the third piece of that is, what things are you gonna get rid of versus what things you're gonna keep? 'Cause that drives cost down really quickly. If you can better paint a picture of what people are gonna use and what things they're gonna give up and they're gonna use the new systems or you're gonna replace them, The more they can start thinking through, this is what my life is going to look like in the new environment, and I can better facilitate how to get there.

So we talked about the perception of the impediment of speed and slowing down the deal. What is our approach when we engage in a cybersport to balancing speed and thoroughness or detail during that deal, especially when the buyer's under pressure to close?

Well, I, part of, we've got a deep bench of expertise where we've been through this on both sides of it. So being able to ask the right questions quickly so we're not asking 100 questions over and over again to the same party, I think that's a key trick that we bring to the table. And two, how do we arise to the top of here's the 3 or 4 things that we must focus on for day 1. The rest of these things can be a day 60 or a day 180 type of a question. I think that's a huge part of the deal conversation.

Yeah, I think your first point there is the key differentiator that I've seen from where I'm at now and where I have been in the past life. But, you know, it's asking the questions about the product, the revenue stream, or the, you know, the piece that you're actually buying. But it's nice to know that they have secure policies and they have all these things in place at the parent company that you're looking to buy either a part of or even the whole thing of it. In the end of the day, it doesn't matter, right? You're going to replace that with your own. Or if it does matter, great, hit on that. But that's not the part you're buying. You're buying, again, the product, the stream, the customer base, something like that.

Absolutely.

So, so focus on that rather than focusing on getting to know how secure is the target company overall.

Yep. So maybe taking that need for speed, and if you're first, you're not— if you're first, you're la— if you're first, you're last. If you're not first, you're last. I totally butchered that Ricky Bobby. Take it back. I know. So, and then revealing and highlighting those risks and then turning them into actual post-close plans. How do you effectively do that and be relevant within the deal process? What have you— maybe starting with Todd, what have you seen to kind of full end-to-end be there, throw those things up on the table, influence, and then make sure that they're used versus like, oh, we knew that, but we didn't actually negotiate the reduction in spend.

Take the step away from that cyber focus for a second. Bring that knowledge to the table, but put yourself in the shoes of the people doing the work. That is super helpful. Live and breathe like they have to get the job done themselves. Use that lens and that helps shape how quickly can we move and how can we keep them productive. Because if you're acquiring a company or divesting a company or merging, at the end of the day, if you've irritated the ploys along the way, they're not gonna be as productive and everything becomes a— So that's the first step. And I know, That's overly simplistic, but it matters in the field of cyber 'cause not everybody understands what we do. And the more we can be empathetic to their work, yep, there's 2 or 3 things that we gotta focus on, but keep them functioning. That's really step 1 that matters. And then the second piece of that is how quickly, and if you can do it in the room, paint that picture to the key stakeholders. I mean, the IT folks and the business leads that are getting the work done. Here are the 2 or 3 things that I need you to do those first 60 days, and this is how people are going to get that work done and you can paint that picture, people can then follow.

So not everything can be perfect. You might not have the perfect negotiation to reduce or give you the, the budget from the reduction to solve the things you're going to solve. But what should quickly be decided around the deal time versus a few months from the deal versus year into the deal versus never? What are some examples, maybe Brandon, from your side on the, the big consulting vantage point, and then Todd on the corporate practitioner having to live with the integrations years later or months later.

So yeah, I've seen, I've seen a lot of, um, you know, big consulting kind of suggest that to add it to a TSA or, you know, a service agreement of just keep it as is, right? Or keep it operational, which, which works when it, when it works, right? But if it doesn't work, then you have to make a temporary service if needed, or you have to quickly, like Todd's saying, integrate into whatever it is that you're going to— it doesn't necessarily have to be the final end result, but it has to be how can we get these folks back to work day 2 or 3, right? We can't have them sit for 90 days just asking, you know, hey, how do I do my job now? You know, they have to be able to do their job on day 1, preferably day 2 required, right? So it's a temporary service, it's a temporary fix sometimes that may get wiped out completely, may get evolved into the final one, but But the more granular you can get in your detailed planning at the task level, right? At the technical task level of, you know, we're going to do this, this, and then this, and show folks that roadmap, I think really helps kind of the transition and again, applies speed but thoroughness in that transition as well.

So maybe pivoting that question and for your guys' perspective, I want both of your opinions dealing with like, here's all the things you could do, the lift and shift, the, put in a bubble and let it sit for a couple years. Cody, I know you've had, or Todd, you've had a couple examples of that versus other tactics. Like how do you manage the options knowing not everything is going to be perfect and you're not going to get everything that you're recommending?

This is a less technical answer, but it starts out with, and I had a leader share this with me. He goes, these, you mentioned TSA, you may have TSAs, you may have small deals that don't require these things. It's like acquire over pull them in, right? But a lot of times you do. Those TSAs should be uncomfortable and they should feel like divorce paperwork because the longer you're in them, the more expensive it gets. And you should make it uncomfortable for all parties. So you want to get out of the TSA hard, make them difficult, and it's okay. And saying that out loud helps people go, yep, yep, this TSA is irritating. I would like to get out of it. That's the feeling you want. Stating out loud faster and sooner up front, this is what we're going to lift and shift, this is what we're going to get rid of, and this is what we're all going to head towards for new solutions, helps everybody get comfortable early of how they're going to have to change their work, because that uncertainty is what kills productivity. So if you're going to kill a solution off and say, we're all using something new, make that statement early so you can start those organizational changes and people can head towards that same direction versus sweating it for a long period of time.

Yeah, one thing I think I see too, we forget about, and I was talking to a cyber leader just last week about this, was like, what does life look like post for himself? So I'm acquiring these companies and they're getting, you know, 4 or 5 companies in one year. And he's like, I'm acquiring these companies, but I'm not getting headcount. I'm getting budget for this.

How does that change the cycle?

I'm getting budget for the integration, but now I've got more headcount and things look different. And I still have my day job that I'm doing too. So I think in the integration part of go fast, be quick on the integration, but like, What does life look like on the other side? I got— I have 3 more tasks I got to do with my team and figure out who's going to maintain that. So that's, I think, where those questions come in. I think maybe we're a little differentiated. We know we all, but on our other side, built the programs before and ran them. So you've got that experience on the execution side of like, it's going to get to the integration, but we're going to have more to do. And like, how do we plan for that? Is that a— and the budget request got to come in early because if you do that post-close, you're late in the game. You're there for a year or so before you even get the response.

Yeah.

Well, If you're given no budget and it can't grow, that paints a clear picture towards, I'm not duplicating solutions. That is a financial picture towards, we are heading towards one path and the faster we get there so you don't have two MSPs, you don't have two endpoint environments, you don't have all the different tooling that's out there, different processes. You're heading towards one and everybody needs to get behind that. They may not like it and they may push back. Hey, I like the way I did it before. That's great. Nobody's paying for that.

I think you, you call a good point. One thing I think I see a lot about is that I like the black hole is like third parties. When I buy this company, I'm looking at the technology, the IP, the employees. But one thing you forget about is what is already contractually obligated to and who's coming to this party that maybe was not invited or just getting figured out. So on my, in my previous life as, as the MSP of being on the acquiring side and the purchase side, you're not pulled into a company that's like, hey, welcome to the party. What are you doing? What's your contract terms? How fast can we snip you as a, as a, as a, as a contract? Or while you're here, how do we get the max value you out of it. So it's like you have this new stakeholder management on day one of like, now you're with a new person. It's like, it's like a forced relationship for X amount of time.

So Todd, you, you referenced the divorce analogy. You're using the marriage ref— you know, analogy, like you're getting married. Have you interviewed the family members and extended family members that are coming to this party? Cause you're going to have to live with them for the next 40 years or maybe less. I mean, it's America, 50/50, you know, who knows.

All right.

Pivoting a little bit. Well, here's a scenario and this is a jump ball question. Didn't have a whistle, but just assume we'll add that in post. A large healthcare company acquires a startup. Post-close, Reveal Risk is helping integrate security operations, but the acquired team, cyber team, is pushing back hard on how we're recommending or mandating policies and tools. How are we going to handle this? What questions are we going to ask to who?

Take first stab here. I think one thing we forget in cyber a lot of times is like the OCM factor of things. Like you can have process, policy, tools, but it's also hearts and minds campaign because you've got people that are a lot of parts of the company that are non-IT, not cyber, marketing, legal, finance, ops, and like what is the messaging and what's the, um, org change management process to bring them along to the party? Here's what we're doing, here's why we're doing it, and here's the value to the company. I think to your point of like when you get in the situation and you get doing something real quick and people aren't necessarily on board or they don't understand the why, they're gonna be resistant to say no. And even when they know the why, they still may not go along, but at least you've got more context to hope you might get more to the party.

And if it's, if it's the cyber team at the startup or, or whatever it might be, by bringing them into the decision, not to say that they get a full vote, right? Or, or whatever it might be, but, but to say if we went this route, what would that cause your day-to-day look like? You know, how would that affect you? We still may go that route even if they say, hey, that's going to be a headache, like we're going to need this, this, and this. But at least you know up front and you can plan for we need this, this, and this. Yeah, it's not, it's not a surprise later down the road whenever you've made the decision, you've invested a little bit of money into it or a lot of money into it, and then all of a sudden it's like, well, we can't do that because of XYZ.

Yep. So we Reveal Risk, unique team. Tad, you've had more than 2 decades, not 3, sorry to make you seem old earlier, of corporate experience. You've been through many, many deals. Cody, you being a CTO, you've helped companies both sides of the table with these deals. Brandon, ninja M&A, spent a lot of your early career days in doing cyber diligence and getting a lot of reps. We've had some good experiences with clients and we've gotten the feedback that, wow, that was better than a lot of the big consulting options that we've used in the past. What makes us different? What are we doing that differentiates us from kind of the rest of the options that might be the, you know, the first things you might think of, of, hey, I'm going to call big name one.

Yeah. I mean, I think first off is our team is not too large in the sense of we don't bring folks on that aren't going to add value to the deal or add value to the decisions being made.

Exactly.

Exactly. Helpful in the first part of your career, right? And first part of my career, I definitely benefited from being brought along. Not to say that we don't bring folks along to teach them, but if they're not making a decision, if they're not helping make a decision, you know, they're not needed in the room. And then we don't waste time in the interview process, right? Like I said, like we don't ask about the policies, we don't ask about things that don't apply to the deal and don't apply to the business reason for the deal, the deal thesis.

Gotta brass tacks, they call it.

Exactly, exactly. Like we're not there to just be there. We're there to get answers and work for the client specifically instead of just, you know, conduct the due diligence to conduct the due diligence.

Yeah.

I would say because of our background on building programs, we know like no cyber budget is bottomless. They don't have unlimited people, process. Even if I had those things, I don't have a limited change capacity. So we're taught, we're learning our experience like find the critical crown jewels, focus on those immediately. That's your focus. And so M&A is somewhat very similar as like acquiring company, find the crown jewels, get those secured, report those back, key things in integration to watch for, and then we'll get to the next things. But like, we don't have this like, you know, unlimited time to go after and budgets. Like, find the big things, orient— what they call OODA in the Air Force, observe, orient, decide, act. And so I think that your experience plays into that ability to, to get speed and to focus at like the, the right point there.

Yep. Great. I'm going to give one more scenario and maybe Cody, this one's for you, but anybody can chime in. Uh, private equity firm is acquired by a small but strategic tech company. They want to close in 30 days. So the speed we talked about, there's little time for a deep technical assessment. And they're asking us or our team or a team like us for a quick pulse, quick pulse on cyber risk exposure. What are we doing? What's the minimum viable product?

That's a great point. Private equity acquiring a small tech firm, I think you're looking at again, what are we purchasing? I think, is it market share? Is it buying competition? Um, what is the IP? You're diving in, you know, it's not gonna be such a small tech firm. They're gonna be focused on revenue generation. So I think getting in, asking those 3 to 4 questions, where are the crown jewels? How are we protecting those? And then at that point, you're looking at like, how fast can I bring this company in and absorb into my culture? And, and again, from a PE firm, you're putting dollars in, you have a little more control on the PE versus the VC side where VC may be more of just like a bet. If it loses, I'm okay. In the PE side, you're taking a, a little bigger chunk with an operational or a long-term plan. So I think having that clear picture of what do we need to protect revenue and what do we need to get more revenue. And if those two things aren't covered in your first few questions, then you're not focused. 'Cause PE doesn't buy firms just for the fun of it. It's to make money and protect money. So I think having those two things tied together.

I was going to say, Cyber tends to look at things from the confidentiality, the integrity, the availability picture, and that is still important. But during these acquisitions, these M&A deals, that revenue piece needs to be a piece of that puzzle. So we're keeping that central focus because that's the end goal.

Yep.

Awesome. Well, I think that wraps it up for this discussion. Thank you everyone for participating. If this resonates with individuals that are at companies that are looking to do deals, bring in expertise to help augment their, uh, or their cyber team's ability to work through these deals. We're here for you. So, um, you'll— there'll be more on our website around M&A, but thanks for tuning in. If you have any questions, you can reach out to any of us or contact us via our website.