You are three weeks from close on a lower-middle-market SaaS platform, and the cyber section of the data room is thin: a two-year-old penetration test with all findings marked “remediated,” a SOC 2 report that expired last quarter, and a founder-CTO who answers every security question with “we’ve never had a breach.” That is not evidence. That is the absence of a story, and in a leveraged deal the absence of a story is a priced risk you are about to inherit without a number attached to it.
A portfolio cyber assessment in private equity is not a compliance checkbox and it is not the same product a CISO buys to sleep better. For a deal partner it answers one question: does the cyber posture change the price, the reps, or the first-100-day plan? For an operating partner it answers a second: what has to be fixed before Day 100, who owns it, and what does it cost? This piece gives you a framework to commission the right assessment, read the output like an investor, and avoid paying for a report that tells you nothing you can act on.
1. Why cyber shows up as EBITDA risk, not IT hygiene
The reason cyber belongs in the investment committee conversation and not just the IT backlog is that the failure modes are financial. A ransomware event that takes the production platform offline for a week is a revenue interruption and a churn event. A data breach in a company holding regulated customer records is a regulatory exposure, a notification cost, and a contract-loss risk with enterprise customers who have security clauses in their MSAs. A single hardcoded credential in a legacy codebase is a live path to the customer database.
None of those read as “IT hygiene.” They read as revenue at risk, EBITDA at risk, and multiple compression at exit. Bain’s annual Global Private Equity Report has tracked how operational value creation, rather than multiple arbitrage, now carries most of the return thesis, and cyber posture is a direct input to whether the operating plan survives contact with reality. McKinsey’s private capital research has made the same point about diligence rigor tightening as holding periods stretch.
The practical translation: you are not assessing whether the company is “secure.” You are assessing whether an incident inside the hold period is likely enough, and expensive enough, to change what you should pay or how you should structure the deal.
2. The four decisions a deal partner actually needs
Before you commission anything, be clear about what output would change a decision. In my experience the cyber portion of technology due diligence only earns its cost when it lands on four decisions and nothing else:
- Price. Is there a finding material enough to justify a purchase-price adjustment or an escrow holdback?
- Reps and structure. Do you need a specific representation, a warranty, or an indemnity around a known exposure the seller cannot cleanly resolve pre-close?
- Walk vs. proceed. Is there an existential item, an active compromise, an undisclosed breach, a fundamental architecture flaw, that changes the thesis?
- Day 1 to Day 100. What must be funded and owned in the integration plan, and what is the run-rate cost of getting to an acceptable baseline?
If a cyber report cannot be mapped to one of those four, it is describing activity, not informing a decision. That is the line I hold when scoping any private equity engagement: the deliverable has to move a number or a clause.
3. The four-tier assessment framework
Here is the framework I use to structure a portfolio cyber assessment so it produces evidence, not adjectives. It runs in four tiers, each answering a sharper question than the last. You do not always need all four pre-LOI; you almost always need all four before confirmatory diligence closes.
Tier 1, Exposure and blast radius
What is externally visible and attackable, and what would an incident actually reach? This tier maps the internet-facing surface, the data the business holds, and where the crown-jewel systems sit. The output is not a vulnerability count. It is a plain statement of what a competent attacker could reach and what it would cost the business if they did. If the company holds regulated data, this is where you size the notification and regulatory exposure.
Tier 2, Controls and evidence
Does the company do what it claims, and can it prove it? This is where SOC 2 reports, penetration tests, and policy documents get read as evidence rather than accepted as assurance. An expired SOC 2 is a data point about the security program’s discipline, not just a stale certificate. A pen test with every finding marked “remediated” and no retest is a claim, not a fact. Tier 2 separates the two.
Tier 3, Architecture and code exposure
Where does the technical debt create security debt? This tier connects to the broader architecture and scalability review because the same flaws that block scale often create attack paths. A monolith with shared credentials, a database with no access segmentation, secrets committed to a repo: these come out of the same review that a serious code quality assessment runs. Security is not a separate discipline from engineering quality. It is one reading of it.
Tier 4, People, process, and incident readiness
If something happens, who does what, and how fast? Most lower-middle-market targets have no incident response plan, no tested backups, and one person who understands the whole system. That concentration is itself the finding. Tier 4 tells you whether the company can survive an incident operationally, which is a different question from whether it can prevent one.
4. How to read the output like an investor
A cyber report full of red, amber, and green cells is easy to produce and easy to ignore. The version that changes a decision does three things a color-coded matrix does not.
It classifies each finding by consequence, not severity
A “critical” CVSS score means nothing to an investment committee. What matters is: is this a revenue-interruption risk, a regulatory-exposure risk, a contract-loss risk, or a cost-to-remediate item? Each maps to a different lever, price, reps, walk, or Day 100. If your report is not doing that translation, you are doing it yourself in the IC meeting under time pressure.
It separates realized, run-rate, and one-time costs
Getting to an acceptable baseline usually has two cost shapes: a one-time remediation spend and an ongoing run-rate for tooling, monitoring, and headcount. Those hit the model differently. A one-time $200K remediation is a capex conversation; a $180K annual run-rate for a managed detection service is an EBITDA line every year of the hold. Conflating them overstates or understates the real drag.
It names an owner and a date for every material item
A finding with no owner and no date is a note, not a plan. This is the distinction between an advice deck you can ignore and a plan someone is on the hook to deliver. The whole point of the assessment is to feed a risk register the operating partner can actually work from.
5. Pre-LOI vs. confirmatory: right depth, right moment
The most common scoping mistake is running the same depth at every stage. You do not need Tier 3 code review to decide whether to submit a bid. You do need it before you wire the money.
Pre-LOI (screening). The question is: is there a deal-killer, and does the cyber posture materially change our number? A tight, low-cost pass at Tiers 1 and 2, exposure and evidence, answers that. This is the level our $5K pre-LOI screen is built for. It is designed to surface the “walk away” and “reprice” items before you commit real diligence spend.
Confirmatory (5-day tech DD). Now you are pressure-testing the whole picture: all four tiers, costed remediation, an owned Day 100 plan. This is where the full buy-side technology due diligence lives, and where the cyber findings get integrated with architecture, code, and team risk into one view rather than four disconnected reports.
6. An illustrative scenario, and how it should read
To make this concrete, here is an illustrative scenario, not a client outcome. Imagine a vertical SaaS target, $9M ARR, sold as “SOC 2 compliant, never breached.”
A Tier 2 read finds the SOC 2 lapsed eight months ago and the last pen test was scoped to only the marketing site, not the application. A Tier 3 read finds database credentials shared across environments and one former contractor’s access never revoked. A Tier 4 read finds no incident response plan and backups that have never been restore-tested.
Read as consequence, not severity, this produces:
- Contract-loss risk: the lapsed SOC 2 puts three enterprise renewals at risk, which the report ties to a specific ARR figure the deal team can model.
- Regulatory / breach exposure: shared credentials and stale access are a plausible undisclosed-incident risk, which becomes a reps-and-warranty conversation.
- Run-rate cost: re-attaining SOC 2, adding monitoring, and getting to tested backups carries a one-time and an annual number the operating partner folds into the value-creation plan.
None of that shows up in “we’ve never had a breach.” All of it is a decision input. The seller’s silence was hiding a repricing conversation and two structuring items.
7. Feeding the first 100 days, not the filing cabinet
The assessment’s real second life is after close. Every material finding should arrive in the first 100 days plan as an owned workstream with a date and a cost, not as a PDF that gets archived. This is where a lot of cyber diligence dies: the report is filed, the deal closes, and nobody touches the findings until an incident forces the issue.
The remediation work also needs a permanent owner, not a one-time consultant who leaves with the deal. For most lower-middle-market portfolios, that is where a virtual CIO or a part-time CTO seat earns its keep, because the decision rules that keep security debt from re-accumulating need someone accountable enforcing them. Advisory that leaves nobody on the hook is why the same findings reappear at the next diligence.
Aligning that remediation with the rest of the operating agenda, engineering, product, and revenue operations, matters too, because security fixes compete for the same engineering hours as the growth roadmap. Getting engineering, product, and RevOps aligned is what keeps cyber remediation from being perpetually deprioritized against the next feature.
8. What this means at exit
Cyber posture is priced twice: once when you buy, once when you sell. A buyer’s diligence team will run exactly the assessment described here on your portfolio company, and the gaps you tolerated during the hold become the gaps they price down. The tech and GTM gaps buyers price down at exit almost always include a security program that was never built past the minimum.
The governance angle is not cosmetic either. The Harvard Law School Forum on Corporate Governance has published extensively on board-level cyber oversight expectations, and the SEC has tightened disclosure rules around material cyber incidents. A portfolio company sold into a strategic or a larger sponsor will be measured against those expectations, and a documented, well-run security program is a value marker, not a cost center, in that conversation.
Treating cyber as an exit-readiness workstream from Day 1, rather than a diligence fire drill at Year 5, is the difference between a finding you fixed and a finding a buyer discovers. This is one more reason embedded digital capacity beats one-off advisory across a hold period.
9. A checklist for commissioning the work
Before you approve a cyber assessment scope, confirm it will deliver these. The two-week technology and revenue audit I run against portfolio companies uses the same discipline, and it holds here:
- Findings classified by consequence (revenue, regulatory, contract, cost), each mapped to a decision lever.
- Costs split into one-time and run-rate, so the model reflects both shapes.
- An owner and a date for every material item, ready to drop into the Day 100 plan.
- Depth matched to stage, Tiers 1-2 pre-LOI, all four tiers confirmatory.
- Integration with architecture, code, and team risk into one view, not four disconnected reports.
- A clear statement of what would change the price, the reps, or the walk decision.
Conclusion
A portfolio cyber assessment in private equity is worth commissioning only if it produces evidence tied to a decision: what you pay, how you structure, whether you proceed, and what you fund on Day 100. Reports that hand you a severity matrix and no owner are the vendor register the market has learned to ignore. Reports that classify by consequence, split cost by shape, and name an owner for every item are the ones that survive the IC meeting and the exit diligence alike. Data providers like PitchBook and S&P Global Market Intelligence keep confirming what operators already feel: diligence rigor is the differentiator when entry multiples stop doing the work.
If you have a live deal and the cyber section of the data room is thin, get the right depth at the right moment: a $5K pre-LOI screen to surface deal-killers and repricing items, or a $15K 5-day tech DD that integrates cyber with architecture, code, and team risk into one costed, owned view. See how the DevriX private equity practice scopes and delivers that assessment, and bring it in before confirmatory diligence closes.
