What’s Broken with M&A Cybersecurity

Welcome everybody. The topic of the day is about mergers and acquisitions in cybersecurity because there are some interesting challenges when you have an acquisition and trying to figure out some of those ramifications. So we've got a couple people as part of this. I'm Matthew Rosenquist. I'm a CISO. I also did 24 years at Intel and I built Intel's capability for M&A security and used to manage all of those. About 120 different acquisitions and divestitures, site closures, colocations. And with me, Alex, would you introduce yourself?

Sure. Thank you, Matthew. Alex Rader. I'm a principal at Phoenix 2.0. We're a full-service IT consulting and management firm. Our motto is IT without the drama, and that necessitates paying attention to cyber risk these days. And my interest in the topic is that we've been called in on both sides of the deal table to help with IT and cyber due diligence for M&A. And we've seen some interesting things come out of those engagements. So I'm here to talk about how we all can do those better on behalf of our customers.

Excellent. Justin?

Well, thank you, Matthew. Justin Daniels here. So I am a corporate M&A attorney, but what I'm really passionate about is helping companies manage cybersecurity and data protection risk throughout their life cycle. And obviously today, the M&A moment in your business life cycle is a critical issue when it comes to the intersection of getting the deal done and managing cyber risk.

Yeah, and I've been on that other side where we're going to buy a company and pulling back the covers, lots of potential challenges, not only what you find, but when you pull that back. Let's, guys, let's talk about what bad things can happen if nobody's paying attention to cybersecurity. What bad things can happen? Give me, what are the top 2 or 3 things in each of your guys' minds?

I'll go first. I still find it surprising when I talk to business people that they don't appreciate that cybersecurity risk on most deals is likely to exceed the purchase price of the deal. What I mean by that is if you're a company, oh, we're doing this $2 million acquisition, we're a $100 million company, and you go and buy them. I find it strange that people don't realize that if you integrate that network or the data onto your network, you may have just allowed a threat actor who had already intruded into that target company 3 months ago Now they get to go into a much bigger candy store. So when you get ransomware and you have to deal with maybe a $20 million problem, that's going to far exceed the purchase price for that small acquisition. And that is present on almost every deal, even the Marriotts of the world.

Yeah, especially Marriott, because they've been in the news, right, for events, for specific events. Right. So, yeah, I think, Justin, I think that's the inflection point. Which makes this all a little different than in years past, is that you're right, because of the legislative mandates now, CCPA, GDPR, and all the other states in the country following suit with privacy and breach disclosure laws, fines per record, class action lawsuits, all of this stuff, right? You're right, the, the cost of the cyber event can exceed deal value, right? And so that, I think, just brings it all home as to why this is such a compelling thing to do in terms of, along with all the other due diligence, financial, legal, right, contract, supply chain, all this stuff, right? Like cyber risk is in my mind one of the top 5 categories of risk, right? Like force majeure, financial headwinds, product supply chain from overseas, all the kinds of stuff that business operators worry about. I mean, like you said, it's strange that, you know, the notion of looking at doing IT and cyber due diligence in a deal is still somewhat a novel idea.

Yeah, and I would agree with you both that that's the primary risk. I'm going to add another risk onto it because it was an eye-opener in some of the deals that I worked on, that cybersecurity aspects can actually undermine the value. And it's important even in the negotiation of what you're going to spend. You know, there's been situations where you go in to buy IP from a company and the M&A, you know, deal people are approaching it as this is this company's IP, it's secret, it's great, and I happen to stumble in, or they bring me in a little bit later in the game, and I'm doing a search out there, and I'm finding that IP has already been hacked out of that company, and it's distributed out there, and the value of the deal then dwindles significantly when you know that that company has already been hacked and those trade secrets or whatever are in the wind, right? So I've actually seen deals crater at that moment in time. That becomes a big red flag as well. And if you didn't know that, you may be paying a whole lot of money for common knowledge that's out there. So, but I would agree with you, kind of, Justin, what you talked about, and, and Alex as well. To me, the biggest risk is you, you bring or you acquire, you connect that third party, right, that acquisition and all of the residual risks that it has, that cascading effects to your environment that hopefully you've been trying to keep as pristine and managed, that can go out the window and far exceed the deal value.

Here's the thing, Alex— oh, go ahead, Alex.

Well, I'd like to take a step back and also put a plug in for just IT due diligence, the corporate employee-facing IT, right, or engineering and production systems, never mind cyber risk aside. A lot of times when internal IT resources get wind of something happening at the company, like sales folks, we, you know, I will speak in the first person, I'm, you know, I was an in-house IT person for many years, we tend to get squirmy, you know, and folks will start thinking about their next role in which things they can leverage in their next role. Salespeople have been known to copy data out of CRMs or other kinds of resources. IT folks have the equivalent of that that they have sometimes done. Now, they may not be doing anything intentionally. They may be just because they've been there for a long time or there's been a lot of turnover in IT function. There may not be any documentation there may be unintentional backdoors left in terms of over-provisioned access and all these kinds of things. And if you're inheriting that, you could see how that could be a problem, right? Is there pirated software? Is the data, the intellectual property, the primary data that's being produced, is that being produced using systems that are licensed and approved per the EULA or the use case from the vendor, right? I mean, all these kinds of things can undermine the very stuff that you're buying, right? So I think it's important to start even at basic, the level of basic IT.

And Justin, you were going to say something?

I was just going to add, in most deals, people think, oh, well, I can pick and choose what assets and liabilities I want to take because most deals, not all, but most are asset deals. Problem is you really can't do that with cyber risk. And we could do a whole podcast show on Well, gee, I have cyber insurance, so that takes care of it, right?

That's the impermeable shield that covers everything, right? I mean, that just solves it all. No, not even close. Alex, I kind of like where you were going because a lot of times, especially when I was dealing with the M&A negotiation folks, even about security, their only focus was the external risks, the bad hackers that might get in, which definitely is an issue and risk. But the other discussion is also those insiders. It's the people that you're trusting. And not all the deals that I was on were necessarily friendly. Some of them were considered kind of hostile. Um, and definitely a number of disgruntled employees, uh, either came in or were there as part of the integration occurred. And that introduces a whole new level of pain and risk. Did you guys ever experience any of that in any of the projects you've been in?

Yes, we absolutely— and you put the right words to it. It's that some of these situations are not ideal, at least for some of the people involved who are not involved in the decision-making process, right? So, um, we've run into problems where there's a lot of homegrown systems, kind of ERP with all kinds of plugins and things that have been sort of developed in-house over the years. That are really running the business, right? And the folks that have really set this stuff up have gone. It's being kept sort of alive because it's the sacred cow with all kinds of duct tape and things, right? And then, you know, unless these people are incentivized to stay through the integration process or at least be available for knowledge transfer, which is, you know, a conversation that you need to have with them, right? And make sure they're taken care of, then you really could be up a creek, right? Because this stuff can fall apart, right? During integration, all kinds of things can happen. So really just first of all, having just an inventory of what's in the environment, right? So you can think about an integration roadmap, right? Even often there's like Justin and I talked about on their podcast with, with Jody Daniels. Sometimes we walk in, there's not even a basic network diagram. So it's really hard to get a sense of what's in place.

Yeah, I've seen that a lot. Right. And rogue IT, shadow IT, rogue servers everywhere, not even knowing what's, you know, what's in the data center. No schematics, connections to third-party networks. Nobody knew. All sorts of fun things to discover that have a huge implication to risk from that perspective.

And also tie that into cyber risk. I mean, all of that stuff, it becomes then your attack surface. Right? That's the problem with cyber.

You really do if you're doing a full network connection. Justin, I actually had a question for you with your lawyer hat on. What are the concerns as the intersect of cybersecurity with potential regulatory risks, regulatory violation kinds of risks? You know, you're acquiring a company in another country and they've got different privacy or they're not subject to, I don't know, PCI DSS or, you know, what are the concerns in that space? Are there any kind of blind corners that you're concerned about?

The one that I see the most, so let's say that I want to acquire Alex's company because he's got some great data and I want to be able to work with customers in a different way because of the data that he has. But let's say the privacy policy that my firm has says we do X, Y, and Z with your data, and we're gonna do something different with what we get from Alex's company, but we don't update our privacy notice. So now we're in violation of our privacy notice, and we could subject ourselves because we're now going to collect and use data differently due to our acquisition than what we're representing to the public on our privacy notice. So you could potentially be engaging in a deceptive trade practice because you acquired a company and are now collecting and using data differently than what you are saying you are doing on your, on your website, in your privacy policy. Because a lot of people don't realize you're almost better off having no privacy policy than having one that you pilfered off the internet that you don't follow. That's actually worse. And that is one area that I see companies really just gloss over, that they don't understand the data practices may impact how they are portraying their collection and use practices to the public.

That makes a lot of sense. All right. So that would be horror stories. What are some of the just ugly things that you've seen where risks have come up and manifested and you're shaking your head and you're screaming because you know it's going to be a lot of long nights to try and fix it and meetings potentially with the board and C-suite. What are some of those horror stories that you've had?

I think a good one that Alex and you will both appreciate is I still see companies that make investments into, say, a healthcare or another company, and their IT infrastructure is like circa 2005. And so the problem with that is those systems don't integrate with anything. Their password and cyber protections are zero. And so why didn't you in the due diligence process ask questions about the age of the architecture system and also put reps and warranties in your agreements? So when you actually look at all this stuff and you realize that's what it is, you have recourse. But outside of that, where it all comes home to roost is once you invest in systems like that, you might as well be putting money away for the ransomware event you're likely to have because your systems are so old. The other interesting one that I would love to get your, both of you to comment on is I see a real problem in governance where companies put the security and the IT function in one person because 9.9 times out of 10, keeping the trains running wins out over cyber. And then when we had this big pivot to the remote workforce, it became a huge attack surface, as Alex was saying, to get into the network. And I've seen it on multiple ransomware engagements that I've had, is the IT function was in one person and the security function, and they had expedient IT at the expense of good security practices. And the company didn't really think about it until, of course, you pull back the COVID in a ransomware event And there it is.

And it only magnifies itself in an M&A deal because inherently there can be a conflict of interest between those two roles in some cases, right, where that conflict comes up. But it, it is so common, especially with smaller startup firms or, you know, firms under 100 people, single site locations, things of that sort. The IT person many times was the security person. You know, they didn't call them the CISO, but they were just to make, you know, make sure everything was secure. And in their mind, it was security was equivalent to uptime, not necessarily the confidentiality of data or the integrity of it. It was just the uptime of the systems. And that's how they define success. Saw that a lot, a lot. And that was one of those factors for me, you know, in leading our team to say, you know what, We're not going to connect their network. This is going to be a forklift upgrade. We're going to replace their network, migrate the data and the users and the access. But we're not using their equipment. We're not using their networks. We're not using their internal systems. And who knows, you know, their entire access system, which could just be a spaghetti, you know, kind of, kind of situation. Nope. We're not, we're not going to deal with any of that. We're going to migrate them to our environment. Brand new accounts and everything else. But that was one of those factors that weighed heaviest on me when I would go in and do that assessment, that initial assessment.

I would say a couple things come to mind. There was one, I have a, one of our networking colleagues from ProVisors, which is an organization Justin and I are both active in, Um, was looking to buy a retail business with about a dozen locations in the Bay Area, uh, apparel. And, uh, he came to me and said, look, I typically have like 7 metrics that I look for in a retail, uh, business of this sort. And the, the, the folks that are running the business can't really produce any meaningful metrics for me. And then we start to sort of do a little bit of discovery on what's going on. And it's because they're running the whole thing on QuickBooks. There's no ERP, there's really no financial planning and analysis or anything, any of the kind of meaningful data that, you know, you would be capturing. And so it put the brakes on the whole sort of, you know, deal. And we had to help this organization put some systems in place to start capturing this data, getting some basic reports done. So it may not kill your deal, but it might, you know, push it back by 6 months or a year. And as we know, time kills all deals. So, you know, I would put the onus on the folks, not only just on the people acquiring companies, But if you're a seller and you're getting positioned, right, to, to, um, because you're going to retire, you want to grow through acquisition, whatever you want to do, if you're bringing in, uh, external consultants to help you rehab the business, get your financials in order, and position yourself so you can get a higher multiple, please have somebody do an external IT and security review and, and get yourself on a solid footing so you can, you know, present a polished sort of appearance in that regard. It'll help, it'll make everything else look a lot more appealing, right? You can just take that whole category of risk off the table in your initial discussions with a potential acquirer.

Well, and that also feeds in when you do that IT and security evaluation. That should feed into both the value, uh, of how you're valuing the deal, right? Uh, also the timelines. How long is it going to take to integrate it? How long is it going to take to, to leverage the IP or, or get those engineers running? And it has to be tied to the business value. Why are you buying the company? Sometimes we would buy it strictly for the IP. Well, that makes it real easy. Other times it was strictly for the engineering talent, right? We didn't care about their current projects, didn't care about their— it was just those engineers we wanted, right? That also makes it easy. Other times we actually wanted to go in and take over that business and start adding on to it. Now that's entirely different because you have to maintain customers and environments and and everything else and keep the productivity high. So, you know, those, that type of audit, the IT and the cybersecurity audit goes, has to be a, you know, an input into understanding what is this going to cost, what is it value to us, and how long is it going to take, what kind of business disruption it's going to be. If you don't have the information, you're going in blind.

Yeah. And I would say that these engagements are not you know, these are not large sort of protracted engagements. These are very quick assessments, right? And then getting us a snapshot of, you know, some basic documentation, doing a penetration test, doing a review of, of technical, administrative, and physical controls, looking at policies, etc. You can get a pretty good picture spending, you know, a couple dozen hours, right? You know, somebody looking at the IT side of things, somebody You know, using electronic tools to do some discovery, doing a couple of stakeholder interviews with somebody on the business, somebody on the technical side, getting an external firm to do kind of a gap assessment against a security framework, which could be, you know, 5 to 15 hours. I mean, we're not talking a massive expenditure of resources. These are pretty quick turnaround. It, you know, the cost is, you know, several thousand dollars, but you know, the ROI is, you know, equivalent to, like Justin said, the size of the deal.

So, well, I would challenge that a little bit because I think it depends on the size of the acquisition, right? If you're talking about one office, 30 people, 50 people, you're probably right. Um, if you're talking about an acquisition of 15,000 people in 8 countries with 9 sites, um, now that takes a little bit, a little bit more time. But, you know, the thing that I'll vehemently agree with you on is whoever's doing that assessment has to have the right skills. It can't just be some PM you've plucked off the line and said, so, you know, Joe over here has some free cycles, go figure out the security and IT. That doesn't work. It takes a skill set and preferably a lot of experience to really understand because, and you know, in my experience, I've run into some situations where the acquired company is really trying to hide some of the skeletons in their closet. And if you don't have a good hound dog in there looking at that and going, I smell something over there, something in the DMZ ain't right, right? I need to go dive into that. You're gonna end up with a whole bag of Halloween candy that you really don't want.

Yeah, so, but Matthew, let me ask this question to the both of you. How many times when you represented the purchaser Did you run into a seller who said, sure, we're going to give you access to whatever you want to see on our network, have your engineers come in and do that? Because, well, it's an important point, because when I speak on the topic, when people ask me that, I ask the audience. The answer is no. That's not the answer. The answer is hell no, right?

Um, and even I've actually— we've had a few small acquisitions said yes, come on in, and our answer was no. I don't want the liability of knowing things in your environment because if the deal doesn't close, right, we go on our separate ways, then I don't want to have access to any of that, right? Because then we're potentially liable. So there's always a kind of a meeting and you feel it out as you're approaching deal close and asking for sensitive information, but not super sensitive information, right? Under NDA, you can share some things. But it— that becomes part of that dance. You can't ask too much where you would be in a liability position, but you can't be totally blind either. And so it's get enough to understand what you're probably going to have to deal with. And then on day one, once the deal's signed, right, day one, we now own the company. Now you descend in and you rip everything out and you're looking in the closets and everything else. But you're right, but there has to be some distance there before the deal is closed.

But Matthew, isn't the point that you're really making— and here's where people make the mistake— they close the deal and instead of sending in the IT people, the business people are like, oh, we got to get the ROI, we have to integrate right away. And once that happens, that's when the $2 million acquisition becomes the $20 million ransomware problem. And so I want to be clear with our audience that when Alex and Matthew are talking about this IT, it's either the seller doing it themselves to know what they have so they can put on a, you know, pristine face, or on the back end, once the deal is closed, you just— oh, we're just going to integrate. No, you let Matthew and Alex go in and rip it apart because now you own it and you isolate it so that if you do find something You've isolated the problem and you probably can get indemnified by the seller as opposed to having it move laterally because you've integrated. And I just want to make sure our audience is clear on what we're talking about, because the reality is, as a buyer, you are going to get far short of full knowledge. So you have to make a business decision on whether to close the deal on something far short of full knowledge And then afterward, in the integration phase, right, you have to say, I need to send in my experts so I understand if there's anything that I've missed because now I own it so that I can remediate before I integrate, because that's when the problem becomes potentially a much larger one.

Yeah, that's the difference between day zero and day one, right? Day zero, you close. Day one is when you're actually going to have some type of resolution and functionality. There could be a small or a big gap there. And sometimes you find some ugly things in the closet, right, that you just couldn't have foreseen, right? Even the acquisition didn't know about it. I walked into one and they hadn't realized some of their servers had been hacked and they were hosting warez sites of hijacked and copied third-party software and porn and everything else. And it was being hosted on their servers out of their data center and they didn't know. Right. So again, you've got some very, very interesting things. I've been in on deals where, um, you couldn't have known when you closed the deal, but there were some embezzlers that were embezzling funds out of the company and stealing assets and everything else. And when we matched up the inventory they gave us from the financial system with what equipment was actually there, Lo and behold, you know, there's a lot of equipment missing that's at somebody's house or was sold on eBay, as it turned out. So again, you know, it's, you're not gonna get everything, but you need to have that expertise to at least be able to spot some of the big things.

We didn't talk about the insider threat. Go ahead, Justin.

So I was gonna, oh, I was gonna mention one more thing to kind of cap this point off. So both Alex and Matthew have mentioned that you're not going to have full information. And Matthew just mentioned the embezzling example where you get in there and there's porn or God only knows what. That's where the purchase agreement, where you have the reps and warranties, you have the indemnification. That's where the contract comes into play. And that's why you need to draft it, understanding that cybersecurity is a risk. That you may not find out about until up to potentially a year or 2 years later because there is an incubation period where the threat actor is reconning on the network before they engage in their mayhem. And so what I just want to share with the audience is you need to have a good rep and warranty about cyber and privacy. You haven't had data breaches, you follow your policies. Another big one that we probably have to touch on is, do you go— how much due diligence do you go on to look at your target company's key third-party vendors? Because that's another area of cyber risk. But my point here is that's where your purchase contract and actually having a legal counsel who understands how cyber risk specifically works in your deal is helpful because it is a very different risk than, say, litigation risk, where we know how that works, as opposed to this, which is very much a latent risk. Or if you find out about all the stuff you guys talked about, you have an indemnity, you have a holdback that's specific so that there's monies there to financially compensate you for the nastiness that you found in the closet.

That you now own.

That's right.

Or is now infecting the rest of your environment. Yes.

You got it. Alex, you were going to say something.

Yeah, another important consideration, and it's sort of in the category of insider risk, but things that can happen with internal resources is now with work from home and bring your own device, I've seen situations arise where there's contention around whose work product is it. Especially around the engineering and development function. So, you know, that's something to be considered, right, as well. And if what we're advocating for, I think all three of us, is that the C-suite, private, you know, private equity investors, whoever is sort of involved in these deals, that you approach this in a programmatic way, the way you approach legal and financial due diligence, right? And as part of that programmatic approach, there's just a certain set of questions. A lot of them got thrown out on Justin's LinkedIn post several months ago. There's a litany of questions, common questions that you could be asking that'll get to the heart of all of these things, and one of which is insider threat.

Yeah, and to answer your question, Justin, for third-party suppliers, so back in the day when I built this and I trained the team at Intel, I developed a series of— we call them AOIs, right? Areas of interest for M&A. And it was like 21 or 22 areas, and within there it had just lists of things you had to go look at. Every deal is a little bit different, but these were all the main categories that you had to go evaluate. And third-party suppliers, that had its own separate section because you're inheriting not only, you know, the company you're buying, but all their suppliers and customers and partners. And there can be a lot of risks. We also noticed, because we had worked with some unique M&As and we put controls in place, that once an M&A was announced for our company, we saw an uptick in attacks against that company. And the attackers, including some nation-states, were using the weakness of that acquired company or trying to get into it. So when we connected them eventually, they would then have access to our core systems. So they were trying to lie in wait. And so we, you could see the spike as soon as the news announcement went out, we would always laugh, right? That was the news spike, we called it. You know, hey, we just announced we're looking or negotiating for an M&A deal. And then the number of attacks would go, would skyrocket for that company. So I would actually sit down with, if it was a big enough company, with their CISO and say, get ready because as soon as this becomes public, you're gonna get hammered and this is the things you need to look for and this is what you need to lock down. So, and it was almost every time, every time.

But here's the thing, Matthew, is most companies are not, have the resources to have a CISO or someone as experienced or you as Alex, and the challenge that you face with cyber risk on a deal is the financial people still largely run the deals about the ROI, running the numbers, and they have a deal cadence. These folks with security and cyber risk, I don't understand what an RDP is, I don't understand what a Tor is, and now I'm gonna bring these people in and they're telling me at the 10th or 11th hour when I bring 'em in, 'cause I just need to put a check here, Oh, you need to worry about this or that. You're upsetting the cadence of my deal here, guys. And that's part of the challenge with cyber risk. And unfortunately, once they get ransomware, they are reborn into understanding that this is one of the primary risks. But prior to the ransomware event, because let's be honest, business email compromise is bad. You send a fraudulent wire. That's awful. Ransomware shuts down the company and it's a whole different level of this is bad.

Yeah.

But that's really the challenge.

It's a complete and utter Canadian embarrassment.

Right. This is what we face because we upset the cadence of the deal that's largely driven by financial considerations. And so the audience is like saying, well, how come we're not thinking more about this? Because we interrupt the cadence of getting a deal done. And the whole third-party risk is the toughest because you have to think like an adversary. Why get in the front door at Target when I can just get in through the HVAC vendor? Or what you said, Matthew, is really just another flavor of what the threat actor must have done with Starwood. Hey, we'll just lie and wait until they do a merger or we're seeing it coming and voilà, Marriott, we gotcha.

There you go. I gotcha.

Yeah.

Yeah. I mean, the reality is security isn't relevant until it fails, right? You know, the other thing we talk about, again, sometimes you got to bleed to believe. And the M&A team's driven by the ones holding the purse strings, right? Because they're buying this asset. So it's their money, their schedule. They've got business objectives to hit, so on and so forth. They've got a plan. And cybersecurity can seem like an outside foreign disruption to their plan. And it's almost adversarial at first until they realize, wait, this can, and Sadly, with Intel, it took a few M&A deals before the M&A team realized that, yeah, we actually need our cybersecurity team. We need one built and staffed, and they need to be early in the deal. And we prove value. We help raise red flags that cross deals out and said, no, good thing we found that out now, right? Oh, the IP is in the wind? Yeah. We, we, we don't want that, right? Things of that sort. But, you know, without that tension, without that knowledge and learning and pain, unfortunately a lot of M&A teams aren't gonna go down that road. They've got their schedule, they've got their financial objectives. Let's go fast.

Would it be helpful to talk a little bit about the, the, the, the breach landscape we're in, in terms of the frequency of breaches and the, the sort of the ransom amounts being requested and The scope, because I mean, I think— Sure. I mean, just to sort of bring it back to why are we talking about this now, right? I mean—

And ransomware is just one of them, right? There are so many different attacks. If you're an IP company, you don't want somebody coming in and stealing your IP, right? And products suddenly being mass produced in some third world country, right? You know, if you're providing services, You don't want those services to go down. You're a financial institution. You have to have your, your exchange web page up. You don't want that going down. Right. And so, I mean, ransomware, yes, it is one of the painful, embarrassing attacks, but there are also many, many others. And all of them play when you're talking about acquiring a relatively unknown entity and trusting them. If you're connecting to them, you're trusting them.

Right?

So, well, I guess the simple question I have for the audience is, do the math of how much profit do you lose if your network is down for a week or two weeks on top of how painful it is and the uncertainty of what could happen with regulators, breach notification, and add all that up and come to that number. That's the risk you have if you want to just do acquisitions and don't want to pay attention to cybersecurity, because I appreciate all these other types because I've dealt with them. Double extortion ransomware is the worst, bar none.

Yeah.

Yeah.

And Justin, the one-week to two-week scenario, that's the best case. I mean, it could take a week to restore from backups, right? I mean, just depending on bandwidth available and all this stuff. Sort of stuff, read/write speeds from your storage to whatever your system is that you're restoring. We're talking weeks normally of degraded operating capacity, right? Severely degraded. So, you know, and if not, depending on the scope of the incident, if not worse, right? So I think we're just, it's, all of this started in 2017, I think, with the two large outbreaks of WannaCry and NotPetya. Right? The global sort of wiperware attack that took down Merck and Maersk Shipping and a bunch of other things for a month at a time, right? Billion-dollar losses. And continuing on with Equifax and everything that's followed on the heels of that, we started out 2021 with SolarWinds, right? 14 large government agencies under the umbrella of Homeland Security and others bunch of private sector and public sector organizations. So unfortunately, we're in for— we think the folks that did this, you know, now formally charges have been announced against the SVR in Russia. They've been sanctioned, diplomats expelled, etc. There's the thought now that they're going to hand off whatever access and persistence they have in some of these networks and smaller organizations over to ransomware gangs. To wreak their havoc. So we're potentially in for a really bad year. I think that's why we're talking about this.

And I think the M&A risk existed long before that, to be perfectly honest, because I was working with my counterparts in Cisco. Cisco at the time was the only other tech company that was doing more acquisitions than Intel, and they were on fire, but they were running the same issues. And it's nothing that outside of those, those in-house M&A teams that many people were even talking about. So, but I think because now the, the dependence that most companies have on the internet, on digital services, on all of that, I think it's more relevant to basically any M&A deal that goes on out there now. And it isn't just the high-tech companies anymore, it's everybody. They have to be thinking about this. This because it can impact them.

Well, the bottom line is we're all in the data business now.

Yeah.

Whether people realize it or not, that's their number one asset. So that means cyber risk is right there alongside it. So I guess in the last few minutes, might be helpful, I'd love to hear Matthew and Alex, what would be your closing thoughts on this topic for our audience today?

My basic premise is that Cyber risk is a category of risk that needs to be paid close attention to, like every other risk that you sort of look for when you're evaluating an organization. Have some sort of a basic programmatic approach to analyzing IT and cyber risk in any entity you're looking at. It's really pretty straightforward. There's plenty of content and collateral that's available out there. We're happy to, I think, sit down and talk with anybody in a little bit more depth, but you got to be working this into your deal cadence, as you said, Justin.

Yeah, and, and I would reiterate that, right? I mean, you have to understand this is a problem. You don't want to be blindsided by it, right? It is a problem. It takes skill. Um, it should be integrated in with your M&A process. If you're going to be doing more than one M&A, right, you need to make sure it is tightly integrated and continuously improving in there. And you need to have the skills, you need to have the insight and make sure that it fits in nicely with that other aspects of determining deal value and how long it's going to take to, you know, get a return on your investment. Is it going to require connecting the networks? Are there other opportunities? And, you know, Justin, as you were talking about, understand the risk and you're going to need a cyber person, by the way, to help even know what the categories are in that space. But at the end of the day, you need to be pretty consistent and comprehensive at looking at that because it will play from the very beginning, from evaluating different companies you might be acquiring. That's when I was first brought in. Hey, we're looking at these 10 companies, right? That's when I was first brought in. To the very last day when you are closing up the integration and yes, we are done. The bow is nicely tied and we're back in a normal business operating, I was the last person out the door. I was the one that had to sign off on it, right? So cybersecurity plays a role no matter where you're in there, whether it's day zero, day one, whether it's vetting, whether it's the initial assessment, trying to hook up IT systems, evaluating all of it. You need to have some capability in there. Otherwise you're going to get blindsided. And believe me, you won't like the end result there. So it's much more valuable to think ahead, to be proactive, and to do it right.

I think I'm just going to end with what I said at the outset. Cyber risk on every single deal is literally more than the purchase price. So if we don't want to pay attention to it, you are taking the risk of potentially creating a liability for your organization that will far exceed the purchase price. And it's not likely that insurance is going to bail you out.

You're on your own and you can explain it to the other C-suite members and the board members and the investors and everything else. Oh yeah. Good luck with that one. So. All right. Thank you, gentlemen. Great insights. I'm sure we're going to be hearing more about, you know, stuff like this in the industry at some point. We should get back together again and and share more best practices. Thank you much.

Thank you, gentlemen. Good to be with you.