Key Takeaways
- • Data breaches reported in 2024 declined from record highs, according to the Q1 2025 RSM US Middle Market Business Index survey, but PE advisors warn firms should not ease cybersecurity efforts.
- • Kevin Carpenter, principal in transaction advisory services at RSM US LLP, says cybersecurity diligence has evolved from a niche service into a crucial requirement driven by underwriters and investment committees.
- • Anthony Catalano, RSM US principal leading its private equity cybersecurity practice, sees broader PE adoption of baseline controls such as penetration testing and multifactor authentication.
- • Catalano identifies three persistent gaps across PE portfolios: governance and risk management, logging and monitoring, and incident response and business continuity.
- • RSM advises PE firms to prioritize cyber risk management early in the investment lifecycle and maintain ongoing measures post-close.
Summary
Cybersecurity remains a pressing concern for private equity firms and their portfolio companies, according to RSM US. In the Q1 2025 RSM US Middle Market Business Index survey, respondents reported that data breaches in 2024 were down from record highs. RSM's PE advisors caution against complacency, noting that it is unclear whether the decline reflects improved security measures or a temporary slowdown in global cyberthreat activity. Either way, the underlying risks facing PE firms and their portfolio companies persist.
Kevin Carpenter, a principal in transaction advisory services at RSM US LLP, emphasizes a comprehensive approach beginning at the earliest stage of the PE lifecycle. He notes that cybersecurity diligence has moved from a niche offering to a crucial requirement, driven by demand from underwriters and investment committees. Transaction diligence services are responding by incorporating more technical testing, including network scans, dark web searches and compromise assessments, to verify configurations rather than rely solely on management responses. Carpenter argues that the greater challenge is converting diligence findings into actionable integration steps. "From a post-close cybersecurity perspective, PE firms must hit the ground running to integrate and secure the new asset," he said, adding that combining strong diligence with a risk-based cybersecurity program can significantly reduce incident risk across a portfolio.
Anthony Catalano, an RSM US principal who leads the firm's private equity cybersecurity practice, identifies notable improvement in baseline security adoption. More firms and portfolio companies are implementing regular penetration testing and multifactor authentication. Leading PE firms are also moving away from fragmented, ad hoc approaches toward standardized frameworks for portfolio companies, often supported by managed services. Catalano described the model: "Firms with effective cyber breach management provide baseline cybersecurity services to all portfolio companies and then work with each company to elevate their individual security posture." This structure allows resource-limited portfolio companies to benefit from a formal security program.
Despite this progress, Catalano highlights three areas where deficiencies persist based on RSM's work with PE clients. First, governance and risk management remain difficult, as sustainable programs require time, money and highly skilled talent that many firms are reluctant to commit. Second, many portfolio companies either lack comprehensive logging or cannot analyze security data effectively; Catalano noted that uncorrelated firewall and Active Directory logs can leave indicators of attack undetected. Third, many portfolio companies are unprepared for breaches, lacking predefined containment, recovery and business continuity procedures, and often failing to prioritize which systems to restore first, which can prolong disruption and cause financial losses.
RSM concludes that the decline in reported breaches should not lead PE firms or portfolio companies to reduce cybersecurity efforts, as attackers will eventually adapt and exploit unaddressed weaknesses. Prioritizing cyber risk management early and sustaining it throughout the investment lifecycle is presented as critical.
Kevin Carpenter, a principal in transaction advisory services at RSM US LLP, emphasizes a comprehensive approach beginning at the earliest stage of the PE lifecycle. He notes that cybersecurity diligence has moved from a niche offering to a crucial requirement, driven by demand from underwriters and investment committees. Transaction diligence services are responding by incorporating more technical testing, including network scans, dark web searches and compromise assessments, to verify configurations rather than rely solely on management responses. Carpenter argues that the greater challenge is converting diligence findings into actionable integration steps. "From a post-close cybersecurity perspective, PE firms must hit the ground running to integrate and secure the new asset," he said, adding that combining strong diligence with a risk-based cybersecurity program can significantly reduce incident risk across a portfolio.
Anthony Catalano, an RSM US principal who leads the firm's private equity cybersecurity practice, identifies notable improvement in baseline security adoption. More firms and portfolio companies are implementing regular penetration testing and multifactor authentication. Leading PE firms are also moving away from fragmented, ad hoc approaches toward standardized frameworks for portfolio companies, often supported by managed services. Catalano described the model: "Firms with effective cyber breach management provide baseline cybersecurity services to all portfolio companies and then work with each company to elevate their individual security posture." This structure allows resource-limited portfolio companies to benefit from a formal security program.
Despite this progress, Catalano highlights three areas where deficiencies persist based on RSM's work with PE clients. First, governance and risk management remain difficult, as sustainable programs require time, money and highly skilled talent that many firms are reluctant to commit. Second, many portfolio companies either lack comprehensive logging or cannot analyze security data effectively; Catalano noted that uncorrelated firewall and Active Directory logs can leave indicators of attack undetected. Third, many portfolio companies are unprepared for breaches, lacking predefined containment, recovery and business continuity procedures, and often failing to prioritize which systems to restore first, which can prolong disruption and cause financial losses.
RSM concludes that the decline in reported breaches should not lead PE firms or portfolio companies to reduce cybersecurity efforts, as attackers will eventually adapt and exploit unaddressed weaknesses. Prioritizing cyber risk management early and sustaining it throughout the investment lifecycle is presented as critical.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.