Half of PE Portfolio Firms Face High Cyber Risk, ACA Report Reveals
Event summary
- ACA Group's report found that half of private equity portfolio companies face elevated or high cybersecurity risk.
- The analysis covers over 300 firms across 18 industries and 12 countries, assessed using ACA’s RealRisk methodology.
- Health Services (56) and Producer Manufacturing (55) ranked highest in average risk scores, while Communications (41) was lowest.
- Third-Party Risk Management and Penetration Testing were identified as high-risk control areas.
The big picture
ACA Group's report highlights the uneven distribution of cybersecurity risks across PE portfolio companies, emphasizing that industry dynamics and governance maturity play critical roles. The findings underscore the need for consistent measurement and oversight as smaller firms increasingly become targets for cyberattacks. This trend is particularly relevant given the growing reliance on complex supply chains and operational technology environments.
What we're watching
- Industry-Specific Risks
- How the 15-point gap in risk scores between sectors like Health Services and Communications will influence PE investment strategies.
- Governance Impact
- Whether portfolio companies with mature oversight structures can sustain lower risk profiles over time.
- Third-Party Risks
- The pace at which firms address third-party risk management challenges amid expanding vendor ecosystems.
Related topics