Cyber risk shows up in portfolio value long before a breach makes the headlines. For Operating Partners and Value Creation teams, the hard part is seeing that risk consistently across companies with different systems, maturity and priorities.
Thomas Murray gives you one view of cyber risk across your whole portfolio. Our Orbit platform rates every portfolio company weekly on a 0-1000 scale and benchmarks it against sectors peers. Our specialists then work with PortCo management to fix what matters most, and report progress back to the fund.
We work with 8 of the 10 largest private equity funds by AUM, and our research into 500+ PE firms shows where the industry's blind spots are. From acquisition to exit, you get evidence of improvement, not just assurances.
Continuous Monitoring
Our Orbit Security platform and Dark Web Monitoring tools provide continuous monitoring of a company’s public cyber security posture, enabling it to respond to threats before they are exploited.
- 0–1000 weekly cyber ratings, long-term trend analysis, and benchmarking against sector peers
- Actionable reports highlighting the highest-risk vulnerabilities
- Dark Web Monitoring (DWM)
Cyber Risk Assessment
External monitoring can be complemented with periodic deeper-dives to assess portfolio companies’ IT and cyber governance, people, controls, and infrastructure.
- Assessments aligned with the portfolio company’s chosen standard, e.g. NIST
- Carried out by experienced professionals, not juniors
- Actionable, concise findings designed to help portfolio companies strengthen their cyber security
PortCo Engagement
Thomas Murray can work with a portfolio company’s Risk and InfoSec teams to help test and improve their cyber security.
- Tabletop exercises: training, testing and validating an organisation’s ability to respond to threats
- Testing: penetration testing, red/purple teaming, phishing simulations
- Consulting: virtual CISO support, risk and compliance assessments
- Monitoring: internal monitoring tools to detect unusual behaviour, e.g. EDR and MDR
24/7 Incident Response
Automated, external monitoring of companies to detect breaches, vulnerabilities, and misconfigurations that could be exploited by threat actors.
- 0–1000 ratings
- Long-term trend analysis
- Benchmarking against sector peers
Cybersecurity Checklist for Private Equity
For private equity partners and portfolio managers focused on value creation, understanding and mitigating cyber security risk is critical. This 10-step checklist demonstrates how to identify and quantify cyber risk at both portfolio and company levels—turning an intangible threat into measurable financial value.
Find out more
Our experts
Insights
Private Equity Has a Cyber Risk Blind Spot
Private equity has become much better at assessing cyber risk, but it may be looking in the wrong place.
Beneath the Asset – Out of Sight: The State of Cybersecurity in the Private Equity Industry
The UK’s smallest investment funds are weak security link in protecting the IP needed for national growth, new Thomas Murray study finds.
Fool me once: What the Apollo breach tells private equity about the threats it now faces
Apollo’s August breach was one data point in a five-week campaign mapping 200+ private capital firms. What it means for fund-level cyber risk.
From Red Flag to Redline: How Cyber Findings Actually Change Deal Terms
A cyber finding rarely kills a deal, it can and does, however what it does far more often, is move it: from a line in a due diligence report to a redline in the SPA.