When one portfolio company gets hacked, you all pay.

Portfolio companies don’t face a single cyber risk. They face a networked risk. A compromise at one portfolio company often exposes shared vendors, credentials, and processes that repeat across the rest of the fund. That’s aggregation. It’s why ransomware and supply-chain attacks scale so efficiently, and why “point fixes” at a single asset rarely solve the real exposure.

Industry threat data backs this up. Ransomware remains a dominant mode of system intrusion in 2025, featuring in a large share of incidents in Verizon’s latest DBIR, which continues to show how quickly a single foothold can be leveraged across interconnected environments. Supply-chain and third-party risk are growing faster than control budgets can handle.

ENISA’s threat-landscape reporting highlights ransomware and availability attacks among the top risks, with supply-chain compromise an enduring driver. Independent research on portfolio concentration reveals how a breach of one supplier can cascade across multiple portfolio companies simultaneously. Insurers and risk specialists are also flagging heightened exposure for PE-backed companies during hold periods and integrations. 

Why is aggregation risk acute in PE

• Shared suppliers and platforms. PE portfolios often converge on the same MSPs, HRIS, billing systems, CI/CD services, and cloud stacks. One vendor breach can hit multiple assets at once.

• Repeated playbooks. Standardised blueprints accelerate value creation but also replicate the same security misconfigurations across assets. NCSC’s guidance for large organisations exists largely because many firms still don’t implement baseline controls consistently.

• M&A velocity. Faster deal flow means risk is inherited quicker than it’s remediated. Reuters’ M&A guidance calls out the need for rigorous cyber diligence and contractual protection to preserve deal value.

• Threat actor incentives. Attackers target smaller, less mature entities to pivot into better-defended brands or into the broader investment network. A recent industry survey reveals high rates of ransomware or extortion attempts across portfolios.

What “good” looks like from asset-by-asset to portfolio-level control

1) Portfolio-wide risk register with supplier concentration mapping.
You can’t manage what you can’t see. Build a single view of third parties used across the fund, highlighting concentration points, and prioritise remediation where a single supplier touches multiple assets. ENISA’s supply-chain work and software supply-chain studies indicate a trend upward, so treat this as an evergreen program, not a one-off. 

2) Minimum control baseline for every asset.
Adopt a common floor that boards will recognise, then tailor it by sector. In the UK, NCSC’s large-organisation guidance and Cyber Essentials controls are practical starting points for endpoint hardening, MFA, backups, and incident preparation.

3) Diligence that tests, not just asks.
Cyber due diligence should move beyond questionnaires. Validate identity controls, backup restore times, EDR coverage, privileged access, crown-jewel data flows, and vendor dependencies. Multiple firms outline pragmatic checklists for PE acquirers, and specialist providers detail what to verify.

4) Contractual protection in the SPA.
If you can’t fully quantify risk pre-close, price it and paper it. Reuters’ legal analysis recommends targeted indemnities, caps/baskets, and escrows for cyber and privacy exposures discovered post-close.

5) Incident response that scales across the portfolio.
Tabletop the scenario where a shared vendor is compromised. Who calls who, how fast can you cut over, and what’s your communications plan with LPs and lenders if multiple assets are hit? DBIR’s trends on speed and lateral movement justify this as a board-level exercise.

6) Value creation via security, not just risk reduction.
Clean identity, auditable controls, and defensible backup regimes improve insurability and reduce friction at exit. UK commentary from NCSC leadership keeps pointing out that basic controls prevent many claims, which translates to better resilience and potentially better multiples.

What to actually implement in Q4

• Central supplier inventory and tiering. One place, one taxonomy. Prioritise vendors reused across 3+ assets.

• Rapid baseline uplift. MFA everywhere, monitored EDR, immutable backups with restore drills, admin tiering, phishing-resistant auth for all privileged users. Align to NCSC guidance.

• Diligence refresh on legacy holds. Re-run a lightweight cyber review on assets acquired more than 18 months ago; threat and stack have changed.

• Paper the gap. Add targeted indemnities on live deals where findings can’t be fixed pre-close.

A note on regulation and expectations

Regulatory pressure continues to rise, even for private companies. ENISA’s reporting underpins EU policy moves, while in the UK, the NCSC continues to push boards to adopt basic controls and improve supply-chain assurance, with discussions of stronger levers for resilience. That direction of travel matters to PE because future buyers, insurers, and auditors will use the same yardsticks.

Bottom line: treat cybersecurity as a portfolio-level system. Aggregation is the risk. Shared baselines, shared visibility, and shared drills are the answer.

Speak to our security team about protecting your portfolio from cross-company cyber risk before it costs you deal value