Key Takeaways
- • Tech Kooks, a Los Angeles managed IT provider, published a guide (by CEO Karim Karawia) arguing private equity firms face two distinct IT problems: securing the firm itself and managing technology across the deal lifecycle.
- • The guide names business email compromise as the biggest day-to-day threat to deal teams, citing FBI 2025 Internet Crime Report figures of about $3.05 billion in reported BEC losses, up from $2.77 billion the prior year.
- • The guide flags that the SEC's amended Regulation S-P applies to registered investment advisers of every size, with larger advisers required to comply by Dec. 3, 2025 and smaller advisers by June 3, 2026.
- • The guide recommends IT and cybersecurity due diligence before close, with findings feeding purchase price and the 100-day plan, and early planning to exit transition services agreements in carve-outs.
Summary
Tech Kooks, a managed IT services provider based in Los Angeles, has published a guide for private equity firms setting out how deal teams can secure their own operations while managing technology risk from due diligence through exit. The guide, written by CEO Karim Karawia, is aimed at partners, operating teams and compliance leads at private equity firms in Los Angeles. Its central premise is that a firm faces two separate IT problems: protecting the small team that handles sensitive investor data, wire instructions and deal documents, and managing the technology inside portfolio companies that the firm acquires, integrates and eventually sells.
On the firm side, the guide identifies business email compromise as the most significant day-to-day threat. Citing the FBI's 2025 Internet Crime Report, released in April 2026, the company notes about $3.05 billion in reported business email compromise losses, up from $2.77 billion the year before, with wire transfers accounting for most of the money lost. The recommended baseline includes protection against email and wire fraud, phishing-resistant multifactor authentication, prompt offboarding, secure file sharing for deal rooms, managed devices, tested backups and responsive support. The guide also points to compliance obligations, including the SEC's amended Regulation S-P, adopted in 2024. Larger advisers had to comply by Dec. 3, 2025 and smaller advisers by June 3, 2026. The rule requires a written incident response program, oversight of service providers and notice to affected individuals within 30 days of certain breaches. According to the guide, exempt reporting advisers fall under the FTC's Safeguards Rule instead.
For the deal cycle, the guide recommends IT and cybersecurity due diligence before close, with findings intended to inform the purchase price and the 100-day plan. It also covers Day 1 readiness, the first 100 days, carve-outs, add-on integration and exit readiness. Carve-outs receive particular attention: businesses separated from a parent often rely on seller systems under transition services agreements, which the guide describes as expensive and time-limited, recommending that exit planning begin at closing. Karawia said, "A transition services agreement buys time, but the clock starts on day one."
The guide closes with criteria for selecting an IT provider, including private equity experience, clearly defined roles among the firm, portfolio companies and specialist advisers, security included as standard, local presence and thorough documentation. The material is promotional in nature, as it is issued as a press release by Tech Kooks, and the figures cited are drawn from the FBI and SEC rather than independent analysis.
On the firm side, the guide identifies business email compromise as the most significant day-to-day threat. Citing the FBI's 2025 Internet Crime Report, released in April 2026, the company notes about $3.05 billion in reported business email compromise losses, up from $2.77 billion the year before, with wire transfers accounting for most of the money lost. The recommended baseline includes protection against email and wire fraud, phishing-resistant multifactor authentication, prompt offboarding, secure file sharing for deal rooms, managed devices, tested backups and responsive support. The guide also points to compliance obligations, including the SEC's amended Regulation S-P, adopted in 2024. Larger advisers had to comply by Dec. 3, 2025 and smaller advisers by June 3, 2026. The rule requires a written incident response program, oversight of service providers and notice to affected individuals within 30 days of certain breaches. According to the guide, exempt reporting advisers fall under the FTC's Safeguards Rule instead.
For the deal cycle, the guide recommends IT and cybersecurity due diligence before close, with findings intended to inform the purchase price and the 100-day plan. It also covers Day 1 readiness, the first 100 days, carve-outs, add-on integration and exit readiness. Carve-outs receive particular attention: businesses separated from a parent often rely on seller systems under transition services agreements, which the guide describes as expensive and time-limited, recommending that exit planning begin at closing. Karawia said, "A transition services agreement buys time, but the clock starts on day one."
The guide closes with criteria for selecting an IT provider, including private equity experience, clearly defined roles among the firm, portfolio companies and specialist advisers, security included as standard, local presence and thorough documentation. The material is promotional in nature, as it is issued as a press release by Tech Kooks, and the figures cited are drawn from the FBI and SEC rather than independent analysis.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.