Why Private Equity Has Underinvested in Asset Safety, and Why the Window Is Closing

Half of private equity portfolio companies face elevated or high cybersecurity risks, according to the ACA Vantage Benchmarking Report. A 2026 analysis drawing on cybersecurity risk assessments from more than 300 portfolio companies across 18 industries and 12 countries. Among the riskiest control areas identified: penetration testing, where persistent gaps in external vulnerability identification and remediation remain the norm rather than the exception.

That finding should stop anyone in the industry. Not because it reveals recklessness, but because it reveals a system doing exactly what it was built to do. Private equity cybersecurity risk isn't primarily a story about neglect, it's a story about incentives, hold periods, and a valuation model that has not yet factored in the cost of an unpatched server, a history of poor cyber hygiene and ineffective incident response processes. That's changing quickly, and firms that haven't adjusted are running out of time.

Why do PE firms underinvest in cybersecurity?

The instinct is to blame culture, to assume operating partners simply don't prioritise security the way a public-company board, with its permanent shareholder base and standing risk committee, might. The data doesn't support that story. What it supports is a structural explanation, and structural problems require structural fixes, not finger-pointing.

Short hold periods discourage long-payback CapEx

A typical PE hold period runs three to seven years. Vulnerability remediation, implemlenting a network architecture overhaul, or a redesign of existing authentication mechanisms often carry payback horizons that extend past the exit. When a CFO is deciding between a CapEx line that lifts EBITDA next quarter and one that reduces a risk that might not materialise until after the sale, the math is not close. This is rational capital allocation under a specific ownership structure not indifference to risk.

Incentives are built around EBITDA and multiple expansion

Deal teams and operating partners are compensated on value creation metrics tied to growth, margin expansion, and exit multiples. Portfolio company vulnerability management doesn't show up on any of those dashboards. Security spend is one of the few line items that can be cut with no visible short-term consequence.

Security is decentralised with no group-level mandate

Most PE firms operate a portfolio of independently managed businesses, each with its own IT leadership, its own legacy stack, and often its own risk tolerance. Unlike a conglomerate with a centralised CISO function, there's frequently no group-level security mandate cascading down to portfolio companies, leaving remediation entirely to management teams who are, in turn, incentivised on the metrics above.

Roll-ups import tech debt faster than it can be fixed

Add-on acquisitions are core to the PE playbook, and each one typically bring legacy systems, unpatched software, and undocumented network architecture into the fold. Integration teams and plans are optimised for speed, consolidating finance systems, cross-selling, cutting duplicate costs and not for auditing every inherited endpoint. The result is that platform companies often accumulate security debt at a rate that outpaces any single remediation budget.

Security has been invisible to valuation models

Perhaps most fundamentally: until recently, cyber risk didn't appear in how deals were priced. Diligence checklists covered financials, customer concentration, and legal exposure in exhaustive detail, while cybersecurity posture was, at best, a single line item or a checkbox. If a risk isn't priced, it isn't managed. That’s true of any market, and PE has been no exception.

The three forces closing the window

None of the structural drivers above have disappeared. What's changed is the external pressure now pushing against them and it's arriving from three directions at once:

LP pressure is reshaping due diligence

Institutional LPs; pensions, sovereign wealth funds and are no longer treating cyber risk as a portfolio company's private problem. Cyber incidents at even a single portfolio company can trigger reputational contagion across an entire fund, and LPs increasingly know it. As a close advisor to LPs, Thomas Murray has seen first-hand the growing concern around cyber security.

Cyber risk questions are showing up in Limited Partnership Agreement negotiations, Operational Due Diligence, and ESG-adjacent risk frameworks in a way that simply wasn't standard five years ago. A fund that can't answer basic questions about portfolio-wide vulnerability management is increasingly a harder sell at the next fundraise.

Regulation is tightening the disclosure net

Disclosure requirements around material cyber incidents, modeled in spirit on SEC-style reporting rules are pushing further down-market and into sectors PE has historically dominated: healthcare, financial services, industrials, critical infrastructure. Buyers are starting to run comprehensive, data driven cyber due diligence, in many cases something that the sellers simply did not do at entry, and that asymmetry is starting to show up directly in purchase price adjustments and reps-and-warranties negotiations. A PE cyber due diligence gap that used to be invisible at entry is now a liability that surfaces, with a price tag, at exit.

The threat environment has made PE portfolios a target

State-linked actors and ransomware groups have both learned what PE firms have historically underweighted: mid-market, PE-owned companies are frequently under-resourced on security relative to the level of business change, their revenue and data exposure, making them efficient targets. Add to that the supply-chain reality. A single vulnerable portfolio company can become an entry point into vendors, customers, or even other companies using any shared platforms and the risk calculus for attackers increasingly favors PE-owned targets specifically. The implied levels of trust shared between portfolio companies also becomes a target for attacks.

What this means for the investment lifecycle

The practical implication is that portfolio company risk assessment is moving from an afterthought to a standard checkpoint at every stage of the deal lifecycle; pre-acquisition diligence, throughout the hold period, and again at exit. Firms building this into their operating model early are starting to treat asset safety not as a pure cost center but as a value creation lever: a clean cyber diligence posture supports a stronger exit narrative, fewer surprises in reps-and-warranties negotiations, and a defensible answer when an LP asks how the fund manages this risk across its entire portfolio.

Building an internal risk based cyber due diligence framework, standardizing a group-level expectations around critical controls such as vulnerability management, periodic penetration tests, Endpoint Detection and Response capabilities, an activie and effective third party risk management framework, and ongoing monitoring of external exposure ahead of any add-on integration are no longer differentiators, they're becoming baseline expectations.

The window is closing

The structural reasons PE has underinvested in asset safety haven't gone away. Hold periods are still short and although increasing, incentives still favor growth over risk reduction, and portfolios are still fragmented. What's changed is that the cost of ignoring the gap is now visible, priced, and rising. LPs are asking harder questions, regulators are tightening the net, and attackers have already noticed what the industry was slow to see. The firms that treat asset safety as core infrastructure, not a line item to cut, will be the ones that are able to maximise their return when the rest of the market catches up to what the data has been saying all along.