After the Deal Closes: Classes Discovered in M&A Cybersecurity

Healthcare

After the Deal Closes: Classes Discovered in M&A Cybersecurity

eylco

27 October 2023

After the Deal Closes: Classes Discovered in M&A Cybersecurity

[ad_1]

Jason Button leads the Cisco Safety and Belief Mergers and Acquisitions (M&A) group. He was previously the director of IT at Duo Safety, an organization Cisco acquired in 2018, making him uniquely positioned to lend his experience to the M&A course of. This weblog is the continuation of a collection targeted on M&A cybersecurity listed on the finish of this publish.

This newest weblog publish will revisit the subject of Shifting Left to Proper: Cybersecurity Practices and Outcomes in M&A Due Diligence and classes discovered from implementing Cisco’s M&A Cybersecurity Framework final yr.

Measurement Issues

On this yr alone, Cisco has made ten acquisition bulletins, starting from small, agile start-ups to well-established, publicly traded corporations. The various dimension and complexity of the businesses we’re seeking to purchase entail that we determine, assess, and alter for threat in another way.

Our M&A Cybersecurity Framework has allowed us to scale and streamline our discovery and threat evaluation processes to raised align with the extent of safety threat a deal poses. Utilizing commonplace safety guardrails, tooling, techniques data, and different automated processes to display and assess non-integrated dangers, we are able to draft a Discovery Threat Evaluation earlier, thereby releasing up groups to concentrate on assessing extra advanced acquisitions and probably larger safety dangers.

Accelerating Integration

Proper-sizing your threat evaluation method has extra advantages, together with the power to determine areas of integration threat to speed up integration after the deal closes. An instance is the Valtix acquisition earlier this yr, the place we performed an aggressive and thorough discovery investigation to shut the deal earlier than the tip of April. The driving issue was the chance to debut a vital product integration demonstration in early June at Cisco Dwell, our flagship buyer occasion.

To satisfy this timeline, we wanted to make sure that the safety threat was manageable and that we had stakeholder buy-in. We labored intently with cross-functional groups to determine and prioritize threat mitigation in order that we might meet our dedication. By having a sturdy framework in place, we had been in a position to speed up the combination course of whereas enabling the Valtix staff to be simpler and productive in a brief period of time.

One other lesson we’ve discovered is prioritizing visibility into the acquired infrastructure earlier within the course of. Deploying instruments like Wiz.io and JuniperOne helps educate us about new environments and permits us to determine dangers sooner. That is important when triaging and prioritizing efforts between the corporate being acquired and the enterprise it is going to be absorbed into. For the Armorblox and SamKnows acquisitions, we had been in a position to concentrate on high-priority dangers and spend much less time spreading efforts throughout a number of work streams. Having a framework that helps us prioritize dangers is what’s most vital and finally makes for higher, safer merchandise.

Trying Again to Energy Ahead

One other vital lesson discovered this yr was learn how to apply the M&A framework to re-visit earlier acquisitions to evaluate and perceive threat. Going by this course of with out time constraints or diligence pressures allowed us to hone our investigative strategies and refine our practices. For instance, we labored with the Meraki staff, a mature group that was acquired over ten years in the past and a big contributor to Cisco’s portfolio. We combed by a decade’s value of information to tell how we might simplify and streamline key areas of our integration framework and enhance our general safety stance.

Securely Enabling Enterprise Progress

One of many driving elements for Cisco to accumulate corporations is to determine and put money into new improvements that may enhance the safety and efficiency of our answer portfolio. The M&A Cybersecurity staff works intently with Cisco’s Company Improvement Integration staff to evaluate and handle threat all through the invention, diligence, and integration course of.

The M&A Cybersecurity Framework has been a useful instrument to make sure that enterprise, engineering, and operations leaders align and concentrate on integration effectively earlier than the deal closes. Operational alignment with IT, Safety, and different capabilities has helped floor vital points, comparable to addressing workflows and person and buyer identities earlier than the combination course of. We’ve additionally discovered that by elevating safety early within the M&A course of, we’re serving to the enterprise take away obstacles that might get in the best way of enterprise objectives and obtain its worth drivers quicker, which results in accelerated enterprise development.

Incomes and Sustaining Belief

Management skilled Simon Sinek has steadily acknowledged, “A staff just isn’t a bunch of people that work collectively.  A staff is a bunch of people that belief one another.”

Our M&A Cybersecurity Framework is a useful instrument to assist securely allow the mergers and acquisition course of. Nonetheless, you may’t underestimate the non-public elements wanted to make it a hit. Constructing belief throughout a staff takes time and requires specializing in growing relationships, being empathetic, and demonstrating respect for an organization’s tradition.

The press launch asserting Cisco’s intention to accumulate Splunk cited one of many key worth propositions: “Unites two “Nice Locations to Work” with related values, sturdy cultures, and gifted groups.” The M&A course of is way more than the mental property and know-how being acquired; the human capital and cultural strengths are sometimes probably the most useful property.

Trying again this yr, my colleague Mo Iqbal summed it up greatest, “We will’t perceive the applied sciences till we perceive the individuals and tradition that enabled them to be so profitable.”

If you’re fascinated by studying extra, please learn Greater than an Asset: The Folks Facet of Mergers & Acquisitions.