FireEye has announced the launch of Mandiant Mergers and Acquisitions (M&A) Risk Assessment, a service designed to help organisations in an M&A process to understand the acquisition target’s cybersecurity posture and risk profile, and address the cybersecurity risks. The new service has been launched with FireEye law firm partner Pillsbury Winthrop Shaw Pittman and is available now.
The M&A Risk Assessment is a week-long service, evaluating key security components to identify cybersecurity risks earlier in the M&A process, utilising sector-specific best practices and global control frameworks, FireEye’s nation-state grade intelligence, and Mandiant’s decade of experience responding to security breaches. Mandiant consultants generate risk ratings of target security areas and develop recommendations that customers, their legal partners, and other M&A advisors can use for decision-making.
Mandiant consultants have developed a distinctive methodology for M&A Risk Assessment that assesses four key security areas:
- Data Safeguards to identify the existence of proper capabilities to determine, protect and monitor high-value organisational assets
- Access Controls to evaluate whether proactive controls have been established to prohibit unwanted access to corporate data
- Threat Detection and Response to assess the efficiency and maturity of a target organisation’s response technologies and processes
- Infrastructure Security to ensure that effective controls are implemented from network to endpoints to avert compromise
“M&A activities are serving as a critical loophole for advanced cyberattacks. The inadequacy of cybersecurity and response technology has made M&A processes increasingly vulnerable to persistent cyber intrusions. Against this backdrop, it is imperative for companies to introduce an intelligence-led security approach to identify and assess risks harbored by target organisations. Our law firm partners support and recognise the need for cybersecurity due diligence, which is predominantly embedded in their legal process. Evaluation of companies for cyber risk during acquisitions and mergers cannot be deemed optional anymore. The inability to formulate a streamlined process to efficiently manage existing and potential cyber threats can lead to consequential legal and financial challenges in the long run,” said Stuart Davis, Director, Mandiant Services.
