Acquiring a Company? 5 Reasons to Adopt CAASM for M&A
Acquisitions have grown at an ever-increasing rate over the past few years. According to research by PwC, 2021 was the biggest year ever for global mergers & acquisitions (M&A), with more than 60,000 publicly disclosed deals. And while acquiring new companies may make your organization stronger financially or strategically, one thing is certain: it can create headaches for cybersecurity teams. Recent research from Accenture showed that 92% of CIOs say their cybersecurity due diligence uncovered key risks or resulted in a material impact in their deals.
Why is this? Simply put, acquiring new companies requires accepting additional risk exposure from the acquiree. Every potential red flag that is missed during the M&A due diligence phase—exploitable vulnerabilities, non-compliant systems, or unreported breaches— now becomes the problem of the acquirer and their security team.
One of the largest examples of this came in 2017 when Verizon had a deal in place to acquire Yahoo for $4.48 billion. During the negotiating phase, the deal almost fell through over two data-breach scandals that were uncovered, and the price of the deal had to be reduced because of it.
Why adopt CAASM for M&A?
Traditionally, some form of asset inventory has been part of the M&A process. While this is an important step to help understand the total number of IT assets being acquired, this can prove to be an outdated process. The focus is placed on physical devices without contextual data, and often comes in the form of a static list.
Instead, whether taking place during the due diligence phase or sometime after the acquisition takes place, the acquirer must make it a point to compile a dynamic, up-to-date inventory on what’s out there, both physical and virtual, and ensure they have complete visibility of all assets and key cyber context that goes along with it.
While it’s becoming a cliche saying, it really is true that “you can’t secure what you can’t see”. Although your organization may have been provided a static list of assets and their current posture from your acquiree, there is no certainty that that list is a) fully comprehensive, and b) up-to-date as of this instant. Yet, if you are a security leader for the acquirer, you are responsible for securing everything, whether it is on the inventory or not.
Therefore, a CAASM solution can be vital to help organizations undertaking M&A activity to ensure they can reduce the cyber risk brought on by an acquisition.
Top 5 Reasons CAASM Belongs in Your M&A Due Diligence Strategy
A CAASM solution can help throughout each stage of the M&A process to:
- Obtain a comprehensive and unified view of the acquiree’s assets, across cloud and on-premises. And while simply obtaining an asset inventory is critical, a CAASM solution like Noetic can provide each asset’s current cyber posture, which can help to highlight coverage gaps and policy violations critical to reducing risk during and after M&A transactions.
- Map all newly acquired assets, including critical cyber context on each asset. This allows security teams to drill down by machine, user, network, IP and more to ensure they have the most up-to-date information about the acquiree’s assets.
- Leverage automation to apply unified security controls across both the current security environment as well as the newly acquired entity’s cyber estate to quickly identify gaps and blind spots and automate remediation. Noetic uses a graph database that leverages high-fidelity, correlated data, through which teams can build repeatable processes to reduce manual workload, fitting for the busy times during the post-acquisition integration phase.
- Continuously improve the overall security posture of the newly formed entity. The acquiring team can create and schedule powerful queries that identify policy and configuration misalignment. By running continuous queries, teams can not only identify these assets, but can remediate changes bringing newly acquired assets to an approved state, in line with existing internal security policies.
- Gain visibility into the cyber posture of a newly acquired company in hours, not weeks or months. A CAASM solution that is agentless and integrates with 3rd party security and IT management tools through standardized, extensible APIs can quickly provide visibility, asset intelligence and actionable insights during the busy post-M&A period.
If you are at an organization that engages in M&A activity and you think Noetic may be able to help you get a full asset inventory across both your existing estate, and your newly acquired entity, we encourage you to request a personalized demonstration today.
About The Author(s)
