- Home
- Industries
- Private equity
Know the cyber risk before you close,
and across every company you own.
Private equity firms, venture investors and acquirers inherit whatever is already inside a target. We find it before signing without touching the target's systems, confirm it after close, and watch every portfolio company around the clock.
Where deals and portfolios get hit.
The risk sits in the target before you buy it, in the transaction while it closes, and in the portfolio once you own it.
Inherited compromise
An attacker already inside the target becomes your problem at close. Stolen credentials and old intrusions rarely show up in IT diligence.
Deal-timed fraud
Attackers watch for transactions and impersonate counsel, sellers or the fund to redirect closing payments and capital calls.
Ransomware across the portfolio
Operators target portfolio companies knowing a sponsor is behind them, and many steal data before they encrypt.
Integration risk
Connecting networks, merging identity systems and sharing admin accounts after close can carry one company's compromise into another.
Fund and investor data
Deal pipelines, investor records and portfolio financials make the firm itself a target, often with a lean internal IT team.
Uneven maturity
Each portfolio company arrives with its own tools, gaps and habits. Without a common baseline, the weakest one sets the risk for the fund.
The rules that follow the deal.
Canadian requirements first, then the sector rules your portfolio companies carry and the US rules that reach SEC-registered advisers.
| Framework | Who it applies to | What we help with |
|---|---|---|
| PIPEDA, prospective business transactions (section 7.2) | Parties sharing personal information to decide on or complete a business transaction | Diligence that respects the written safeguards the section requires, and breach investigation if data is exposed |
| Quebec Law 25 | Acquirers and targets handling personal information of Quebec residents, including in a commercial transaction | Confidentiality incident investigation and the documentation your registers need |
| Critical Cyber Systems Protection Act (Bill C-8, Royal Assent June 2026, not yet in force) | Portfolio companies in designated critical sectors, once designated, which must notify their regulator of material changes in ownership or control | Cyber security programme design, supply-chain risk management and incident reporting readiness |
| Sector rules your portfolio companies carry | Targets regulated under OSFI B-13 and B-10, PHIPA, PCI DSS and similar frameworks | Diligence against the rules the target already answers to, and gap assessment after close |
| SEC Regulation S-P, as amended in 2024 | SEC-registered investment advisers, including Canadian managers registered in the US | Incident response programme design and investigation support for customer-information incidents |
From first look to full portfolio.
Before close
Passive, non-intrusive review of darknet exposure, the external attack surface and signs of compromise, in five to seven business days. We never touch the target's systems.
After close
A forensic sweep of every endpoint before you connect networks, with first findings within 24 hours and a clear verdict: active threat, dormant risk or clean.
Across the portfolio
Each company on MSOC in its own isolated tenant, a common baseline from gap assessments, and a vCISO where nobody owns security.
How we help investors and acquirers.
MSOC
An autonomous SOC for every portfolio company, each in its own isolated tenant, detecting and containing threats in under two minutes, around the clock.
Learn more →M&A cyber diligence
A passive, outside-in review of a target in five to seven business days, with findings for warranties, pre-close fixes and post-close priorities.
Learn more →Compromise assessment
Confirm from the inside that an acquisition is clean before you connect it, with first findings within 24 hours.
Learn more →IR retainer
Pre-agreed terms and guaranteed response from four hours down to one, across the firm and its portfolio companies.
Learn more →vCISO
A senior, accountable security leader for portfolio companies with nobody in the role, reporting to the board.
Learn more →Gap assessment
Measure every portfolio company against the same framework, so the fund sees where risk actually sits.
Learn more →What buyers ask.
Will the target know you are looking?
Not from us. Pre-close diligence is passive and never touches the target's systems, so it can run before the target has been told about the depth of your interest.
Our IT diligence already covers this.
IT diligence asks what the target owns. Cyber diligence asks whether someone is already inside it. The two answer different questions and run well side by side on the same timetable.
A portfolio company has been hit by ransomware. Will you pay?
We never recommend paying. When it helps, our responders negotiate with the threat actor after sanctions screening, to buy time and protect your options while we contain and recover.
Can you cover companies in different countries?
Yes. 100% Canadian-owned, with primary operations in Canada. We deploy to meet each client's data-residency requirements, and Canadian clients' data stays in Canada.
Talk to someone who has worked the deal.
Put a specialist on a call to scope diligence, post-close assessment or portfolio-wide monitoring. No charge, no commitment.