Private Equity Firms Step Up Cyber Vigilance Amid Rising Threats

Facing increasing cyber risk exposure across their portfolios, private equity firms are tightening cybersecurity expectations, improving governance, and reevaluating insurance coverage.
By: | September 3, 2025

As cyberattacks grow in frequency and complexity, private equity (PE) firms are elevating cybersecurity from a back-office IT concern to a strategic priority. With the interconnected nature of digital ecosystems between PE firms, their portfolio companies, and third-party vendors, even a single vulnerability can cascade into significant operational, financial and reputational damage.

According to a recent whitepaper from QBE North America based on a survey of 300 risk managers and CISOs (or equivalent roles) at private equity firms managing between $1 billion and $50 billion in assets, cyber resilience is becoming a core pillar of investment risk management. The report found that PE firms are increasingly performing due diligence around cybersecurity and taking proactive steps to shore up cyber defenses across their holdings.

Cyber Due Diligence Now a Deal Imperative

Before making an investment, many firms are scrutinizing the cybersecurity readiness of target companies. Nearly half (49%) conduct regulatory compliance assessments, and 46% assess third-party and supply-chain cybersecurity. Firms are also evaluating employee training programs, internal policies and procedures, and the target’s technical safeguards, such as endpoint protection and data loss prevention.

This increased focus on pre-acquisition cyber due diligence reflects a growing understanding that portfolio companies can become conduits for attacks that jeopardize the PE firm itself. Given that many target companies may not have mature cyber defenses in place, this early-stage assessment can reveal both risk and opportunity—highlighting where remediation is needed and where additional investment may be required to strengthen the company’s posture post-acquisition.

Cyber Incidents on the Rise

The QBE survey revealed a worrying frequency of cyber incidents among portfolio companies. In the past 12 months, over half of respondents (54%) said that up to 25% of their portfolio companies experienced a cyber incident or attack. An additional 23% reported that between 26% and 50% of their portfolio companies had been hit.

Of those portfolio companies affected, 46% of respondents said that 26% to 50% experienced ransomware or extortion attempts—a reminder that threat actors are increasingly targeting smaller, less protected firms as entry points into larger investment networks. The most commonly cited threats included software/IT vulnerabilities (42%), cloud-security issues (40%), data breaches (35%), business email compromise (32%), and ransomware (32%).

From Mandates to Improvements

In response, PE firms are driving portfolio-wide improvements. According to the report, 95% now require basic technical controls at the company level, including privileged access management and multi-factor authentication. Governance expectations are equally strong, with 96% requiring formal incident response plans, asset classification procedures, and data governance policies.

Nearly all firms (97%) require ongoing visibility into portfolio companies’ cybersecurity incidents and attacks. This level of oversight is paying off: 43% of firms said that 51% to 75% of their portfolio companies have made cyber improvements in response to these requirements, such as strengthening technical controls and refining cyber policies.

Support Doesn’t Stop at Acquisition

Private equity firms are also playing an active role in building cyber maturity beyond checklists. Nearly half (48%) provide cybersecurity awareness training, while 46% support third-party/vendor management. Forty-five percent fund technical cybersecurity protections and offer help with incident response planning. This hands-on involvement helps portfolio companies build resilience while aligning with investor expectations for risk governance.

Cyber evaluations don’t end at the acquisition stage either. Firms continue to monitor cybersecurity practices post-close, with 34% conducting quarterly reviews, 23% monthly, 21% semi-annually and 19% annually. This cadence signals a long-term commitment to cyber governance as a value preservation strategy.

Cyber Insurance: A Work in Progress

Despite the proactive posture, cyber insurance adoption still lags. Sixty percent of respondents said fewer than half of their target companies had cyber insurance. Even among PE firms themselves, only 53% carry cyber coverage.

However, attitudes are shifting. Among firms with coverage, 60% plan to increase their coverage limits in the next year, and 38% are moving from endorsements to standalone cyber policies. Firms are also increasingly leveraging value-added services from insurers, including cybersecurity assessments, vulnerability scanning, and incident response planning.

Building Cyber Resilience as a Lifecycle Priority

The QBE report emphasizes that cybersecurity must be prioritized throughout the investment lifecycle—from initial due diligence to ownership and eventual exit. To that end, the report recommends measures such as:

  • Standardizing cybersecurity frameworks and policies
  • Conducting regular cyber risk assessments
  • Testing incident response plans and capabilities
  • Implementing advanced threat detection tools
  • Offering employee training programs
  • Managing third-party cyber risks
  • Working closely with insurers to understand available coverage
  • Hosting educational workshops for staff

As the threat landscape evolves, private equity firms that treat cybersecurity as a shared responsibility—not just a checkbox—will be best positioned to protect assets, mitigate risk, and sustain investor confidence. &

The R&I Editorial Team can be reached at [email protected].

More from Risk & Insurance