FireEye launches cyber security risk assessment service for M&A

FireEye recently announced the launch of Mandiant Mergers & Acquisitions (M&A) Risk Assessment, a service designed to help organisations in an M&A process to understand the acquisition target’s cyber security posture and risk profile, and address the cyber security risks. The new service has been launched with FireEye law firm partner Pillsbury Winthrop Shaw Pittman and is available now.

The M&A Risk Assessment is a week-long service, evaluating key security components to identify cyber security risks earlier in the M&A process, utilising sector-specific best practices and global control frameworks, FireEye’s nation-state grade intelligence, and Mandiant’s decade of experience responding to security breaches. Mandiant consultants generate risk ratings of target security areas and develop recommendations that customers, their legal partners, and other M&A advisors can use for decision-making.

In recent years, the GCC has witnessed a series of cyber attacks targeting leading industries and critical infrastructure. Geopolitical and economic developments are being played out in cyberspace and are indicative of the significant degree of evolution in the cyber risk landscape. In the event of a breach, the level of risk to a company’s intellectual property and finance is apparent. As stated in the most recent Regional Advanced Threat Report for EMEA published by FireEye, the energy and financial sectors along with the governments across the GCC account for 65% of identified cyber attacks. According to a recent study by FireEye, an unfavourable view of a brand is a hidden cost of cyber attacks on organisations, wherein 57% of respondents stated that they would stop purchasing from a compromised company.

Mandiant consultants have developed a distinctive methodology for M&A Risk Assessment that assesses four key security areas:

• Data Safeguards to identify the existence of proper capabilities to determine, protect and monitor high-value organisational assets
• Access Controls to evaluate whether proactive controls have been established to prohibit unwanted access to corporate data
• Threat Detection & Response to assess the efficiency and maturity of a target organisation’s response technologies and processes
• Infrastructure Security to ensure that effective controls are implemented from network to endpoints to avert compromise

“M&A activities are serving as a critical loophole for advanced cyber attacks. The inadequacy of cybersecurity and response technology has made M&A processes increasingly vulnerable to persistent cyber intrusions. Against this backdrop, it is imperative for companies to introduce an intelligence-led security approach to identify and assess risks harboured by target organisations. Our law firm partners support and recognise the need for cybersecurity due diligence, which is predominantly embedded in their legal process. Evaluation of companies for cyber risk during acquisitions and mergers cannot be deemed optional anymore.  The inability to formulate a streamlined process to efficiently manage existing and potential cyber threats can lead to consequential legal and financial challenges in the long run,” said Stuart Davis, Director, Mandiant Services.

For more information about the M&A Risk Assessment service, please visit: https://www.fireeye.com/services/mergers-and-acquisitions-risk-assessment.html.