Key Takeaways
- • Kroll's survey of 300+ global private equity executives reveals cyberattacks cost firms an average of $2.1 million per incident, with 53% of firms facing losses exceeding $500,000 and 13% experiencing losses above $5 million.
- • 94% of private equity firms reported some financial impact from cybersecurity risk, including reduced valuations, lower exit prices, or increased compliance and training costs.
- • 80% of private equity firms experienced operational disruption from cyberattacks during the survey period, with 27% suffering outright business downtime.
- • Significant disparity exists between large and small firms in cyber risk management: 81% of firms with >$25 billion AUM integrate cybersecurity due diligence into transaction processes, versus only 29% of smaller firms.
- • 96% of surveyed firms expect portfolio cybersecurity importance to increase over the next 12 months, with 53% projecting cyberattacks will inflict greater financial damage in coming years.
Summary
Kroll's global research into cybersecurity risk in private equity, based on a survey of more than 300 PE executives, documents cyberattacks as a material threat to deal economics and portfolio value across the entire investment lifecycle. The findings indicate that cyber incidents are both frequent and costly: firms experienced an average financial impact of $2.1 million per cyberattack, with a meaningful tail risk profile—more than half of respondents face potential losses exceeding $500,000 per incident, and one in eight expect losses above $5 million.
The breadth of impact extends beyond direct attack losses. Ninety-four percent of private equity firms reported financial consequences tied to cybersecurity risk, encompassing reduced valuations or exit prices triggered by cyber incidents, as well as elevated spending on compliance infrastructure and employee training programs. Operational disruption appears endemic: 80% of PE firms experienced some form of business interruption due to cyberattacks, with nearly a third suffering measurable downtime that interrupted normal operations.
The research underscores a material capability gap between larger and smaller PE firms in addressing cyber risk. Large firms with more than $25 billion in assets under management have institutionalized cybersecurity due diligence as a standard component of transaction diligence, with 81% reporting this practice; by contrast, fewer than 30% of smaller firms (<$25 billion AUM) have adopted similar protocols. This divide suggests smaller PE players face elevated vulnerability and may face competitive disadvantage in managing cyber-related portfolio risks.
Forward-looking sentiment among PE executives reflects mounting concern. Ninety-six percent of surveyed firms anticipate that portfolio cybersecurity will increase in strategic importance over the next 12 months, while 53% expect the financial toll of cyberattacks to accelerate. These expectations suggest cyber risk management will become increasingly central to PE underwriting, valuation, and exit strategies.
The breadth of impact extends beyond direct attack losses. Ninety-four percent of private equity firms reported financial consequences tied to cybersecurity risk, encompassing reduced valuations or exit prices triggered by cyber incidents, as well as elevated spending on compliance infrastructure and employee training programs. Operational disruption appears endemic: 80% of PE firms experienced some form of business interruption due to cyberattacks, with nearly a third suffering measurable downtime that interrupted normal operations.
The research underscores a material capability gap between larger and smaller PE firms in addressing cyber risk. Large firms with more than $25 billion in assets under management have institutionalized cybersecurity due diligence as a standard component of transaction diligence, with 81% reporting this practice; by contrast, fewer than 30% of smaller firms (<$25 billion AUM) have adopted similar protocols. This divide suggests smaller PE players face elevated vulnerability and may face competitive disadvantage in managing cyber-related portfolio risks.
Forward-looking sentiment among PE executives reflects mounting concern. Ninety-six percent of surveyed firms anticipate that portfolio cybersecurity will increase in strategic importance over the next 12 months, while 53% expect the financial toll of cyberattacks to accelerate. These expectations suggest cyber risk management will become increasingly central to PE underwriting, valuation, and exit strategies.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.