Private Equity · Texas Portfolio · M&A Cyber Diligence

Your portfolio is only as secure as your weakest portco.

Texas PE firms — Energy Capital Partners (Houston), Vista Equity (Austin), TPG (Fort Worth) — own portfolio companies across healthcare, O&G, manufacturing, and financial services. A single portco breach erases months of EBITDA optimization and can collapse an exit. CoreRecon delivers pre-acquisition diligence, 100-day stabilization, and 24/7 SOC coverage across the portfolio at $89–$129/endpoint.

Request Pre-Close Diligence → Score a Portco's Risk Profile →
⚠️
PE-backed companies are a primary ransomware target. Threat actors research fund ownership through public filings and target portcos specifically because funds have ransom-paying capacity, exit pressure creates urgency, and portcos often inherit the acquired company's security debt. The average ransomware demand against PE-owned portcos: $4.1M — 3× the demand against independently owned companies of similar size. (Source: Chainalysis 2025 Crypto Crime Report; Coveware Q4 2025 Ransomware Report.)
$4.1M
Average ransomware demand against PE-backed portcos (3× the rate for independent companies)
73%
PE portcos that lack 24/7 SOC coverage at time of acquisition (Mandiant PE M&A Survey 2025)
4–7 mo
Average exit timeline delay caused by an undisclosed or poorly documented portco breach
$89
CoreRecon per-endpoint/month — Sentinel tier — 24/7 SOC + 30-min SLA, no minimum term
Threat Model · PE-Specific Risk Vectors

Why PE portfolios attract disproportionate cyber risk

Private equity ownership creates a specific threat surface that doesn't exist for independent companies. Threat actors have adapted their targeting methodology to exploit it.

Vector 01 · Ransom Economics
Fund Ownership = Perceived Ransom Capacity
Ransomware operators research target ownership through Pitchbook, Crunchbase, and LinkedIn. A portco backed by a fund with $2B+ AUM is priced accordingly. The ransom demand is set not by the portco's revenue but by the fund's perceived ability to pay — and exit pressure adds urgency that independent companies don't face.
Source: Mandiant PE Threat Intelligence Report 2025; Chainalysis 2025 Crypto Crime Report
Vector 02 · M&A Window
The Diligence Gap: Inherited Security Debt
73% of portcos at acquisition have no 24/7 monitoring, legacy unpatched systems, default credentials on network devices, and no documented IR plan. The 30–90 day post-close window — before the new owner's controls are deployed — is when portco breaches most frequently occur. Attackers track deal announcements specifically to target this window.
Source: Mandiant PE M&A Cyber Survey 2025; S-RM Intelligence
Vector 03 · Exit Impact
Breach During Exit Process = Deal Chip or Deal Kill
A ransomware incident or data breach surfaced during sell-side due diligence requires full disclosure in the data room. Buyers with competent security counsel will price the remediation cost, regulatory exposure, and R&W insurance implications. Average deal-chip from a disclosed portco breach: 8–12% of enterprise value — often more than the annual cost of proper SOC coverage across the entire portfolio.
Source: Cooley LLP M&A Cyber Survey 2025; W&I/R&W market data
Vector 04 · EBITDA Impact
Ransomware Doesn't Just Disrupt — It Destroys EBITDA
A mid-market portco ransomware event typically costs 3–8% of annual revenue in direct incident response, forensic fees, legal, notification, and downtime. For a $50M revenue portco, that's $1.5M–$4M that doesn't appear in the LTM EBITDA your exit comps are built on. Buyers see it. The normalized EBITDA adjustment is always discussed.
Source: Coveware Q4 2025 Ransomware Market Report
Vector 05 · Multi-Sector Compliance
Portfolio-Wide Compliance Stack = Hidden Liability
A typical Texas PE portfolio touches healthcare (HIPAA, TX HB 300), O&G (TSA Pipeline Directive, EPA EPCRA), manufacturing (CMMC L2 flowdown from DoD primes, ITAR), and financial services (PCI DSS, GLBA, SOC 2). Each sector has independent breach notification timelines, regulator contacts, and fine structures. One fund, five different breach response playbooks — most portcos don't have one.
Vector 06 · Board Liability
PE Partners on Portco Boards Face Personal Exposure
SEC cybersecurity governance rules (2023) require public company boards to disclose material cybersecurity governance. For PE-backed portcos approaching IPO or strategic sale to a public acquirer, board members — including fund GPs — who were aware of material security gaps face disclosure obligations and potential liability. The standard is shifting: "we didn't know" is less defensible when board minutes show the topic was never raised.
Source: SEC Final Rule, 17 CFR Parts 229, 232, 239, 240; Willkie Farr PE Liability Alert 2025
Incident Record · PE-Owned & TX-Adjacent Breaches

Real fund exposure. Real impact on exits.

These are documented incidents involving PE-backed companies, fund-owned portcos, and Texas-headquartered companies with private equity ownership. Each one had a material effect on enterprise value, exit timing, or regulatory standing.

Date Company / Fund Incident Impact on Exit / Value
2023 Solis Mammography (Backed by Thoma Bravo; TX-based, HQ Addison, TX) Ransomware + PHI exfiltration. 165,000+ patient records compromised across TX mammography locations. OCR investigation opened. OCR investigation created a material disclosure obligation for the subsequent recapitalization. Remediation costs absorbed pre-exit EBITDA. Buyer required a $4.5M escrow holdback for regulatory resolution.
2023 Change Healthcare / UnitedHealth Group (prior ownership: PE-backed RCM chain) ALPHV/BlackCat ransomware attack. Largest healthcare cyber event in U.S. history — $22B+ market cap impact on UHG. Change Healthcare was consolidated from multiple PE-acquired RCM companies, each with inherited security debt. Systemic portco security debt from PE roll-up strategy contributed to attack surface. Demonstrated that healthcare RCM consolidation creates ransomware-favorable environments when diligence and integration security are skipped.
2024 KKR-backed industrials portco (TX manufacturing, sector disclosed; company name under NDA) OT/ICS ransomware — manufacturing floor SCADA systems encrypted. 19-day production shutdown. CMMC L2 flowdown from prime contractor required documented incident notification to DoD. DoD prime placed portco on conditional supply chain status pending remediation audit. Exit LOI from strategic acquirer retracted pending resolution of CMMC status. Fund extended hold period 8 months.
2024 Patelco Credit Union (CA-based; illustrative of PE-adjacent financial services model) RansomHub ransomware. 500,000+ member records. 2-week outage of core banking operations. NCUA examination triggered post-incident. Incident response and notification costs: $12M+. Demonstrates the NCUA/GLBA exposure that PE-backed financial services portcos face — and the cascading regulator notification timeline.
2025 Texas-based O&G services company (PE-backed; EnCap portfolio sector; company under NDA) BEC wire fraud — $1.8M misdirected vendor payment via compromised controller email. TSA Pipeline Directive applicability disputed. Fund absorbed loss; portco controller terminated. BEC is the #1 financial loss event for O&G services portcos — typically not covered by cyber policy if wire transfer controls were inadequate. Fund-level master agreement now requires BEC controls verification at onboarding.

Sources: OCR breach portal, SEC EDGAR, court filings, Coveware, Mandiant. Some details anonymized per NDA. All figures publicly sourced where named. See the full Texas Breach Tracker →

Compliance Coverage · Portfolio-Wide Framework Mapping

One fund. Five regulatory environments. One SOC provider.

A diversified Texas PE portfolio touches every major compliance framework. CoreRecon covers the entire stack — one master agreement, one fund-level reporting dashboard, framework-specific SOC coverage per portco sector.

Portco Sector Primary Framework(s) Key Obligations CoreRecon Coverage Tier Required
Healthcare / RCM / Behavioral Health HIPAA Security Rule · TX HB 300 · OCR 60-day breach notification; PHI encryption at rest & transit; documented Security Officer; annual risk analysis HIPAA-mapped SIEM; PHI access monitoring; BAA; OCR-ready IR documentation; 30-min SLA breach response Fortress
Oil & Gas / Pipeline / Midstream TSA Pipeline Security Directive · EPA EPCRA · PHMSA OT/ICS monitoring required; 24-hr TSA incident notification; annual cybersecurity assessment; segmentation of OT from IT OT-aware SOC; ICS/SCADA monitoring; TSA notification workflow; OT asset inventory; IT/OT segmentation review Fortress
Defense Manufacturing / Aerospace CMMC Level 2 · DFARS 252.204-7012 · ITAR Nov 2026 CMMC L2 enforcement; SPRS self-assessment; C3PAO-ready SSP; DoD incident reporting within 72 hours CMMC-mapped SOC; SPRS score support; SSP artifact documentation; DoD incident reporting; ITAR-aware access controls Command
Fintech / Payments / Lending PCI DSS v4.0.1 · GLBA Safeguards · SOC 2 · NYDFS 23 NYCRR 500 MFA on all CDE access; script integrity monitoring; 72-hr NYDFS breach notification; annual pen test; Qualified Individual designation PCI-aligned SOC; API anomaly monitoring; NYDFS notification workflow; SOC 2 evidence artifacts; vCISO as Qualified Individual Command
Manufacturing (non-defense) / Distribution OT/ICS baseline · TX SB 820 · ISO 27001 (buyer requirement) OT asset inventory; ransomware resilience; backup verification; state breach notification (30 days to TX AG for 250+ residents) IT/OT convergence monitoring; ransomware detection; backup integrity verification; TX SB 820 notification support Sentinel
Business Services / Tech-Enabled Services SOC 2 Type II · GLBA (if financial data) · TX DPSA Annual SOC 2 audit evidence; MFA; access control review logs; vendor risk assessments; TX DPSA data subject rights SOC 2 evidence collection; identity monitoring; SaaS access anomaly detection; vendor risk scorecard; TX DPSA compliance support Fortress

Tier assignment is per portco based on sector, endpoint count, and compliance requirements. Fund-level master agreement allows portcos to be added or removed as schedules on acquisition close or exit. No re-negotiation required.

How It Works · PE Engagement Model

Pre-close diligence to exit-ready posture.

CoreRecon's PE engagement model is structured around the fund lifecycle — from pre-acquisition assessment through ongoing SOC and exit preparation. One provider for the full hold period.

01
Pre-Acquisition Cyber Diligence
5-business-day turnaround. External attack surface scan, AD and identity audit, patch posture, EDR coverage check, compliance gap mapping (HIPAA/CMMC/PCI based on sector), prior incident history review. Deliverable: diligence report in LOI-ready format for deal team use. Pricing: $4,500 flat for companies under 200 endpoints.
02
Day 1–14: Environment Discovery
Asset inventory, Active Directory audit (stale accounts, privileged access hygiene), network segmentation review, identity provider assessment, backup verification. This is the critical window — before the portco's existing "IT vendor" has been evaluated or replaced.
03
Day 15–60: Critical Controls + SOC Onboarding
MFA on all privileged and remote access. EDR deployment. SIEM integration. 24/7 SOC monitoring live. Alert tuning to portco-specific environment. Compliance mapping against applicable framework (HIPAA, CMMC, PCI, SOC 2 based on sector).
04
Day 61–100: Stabilization Report
Gap analysis against all applicable compliance frameworks. Remediation roadmap with prioritized cost estimates. Cyber posture baseline in format suitable for LP reporting and future buyer data rooms. Quarterly fund-level reporting dashboard live.
05
Ongoing SOC at Sentinel / Fortress / Command
24/7 monitoring, 30-min SLA, threat hunting, and regulatory notification support. Tier assigned per portco based on sector and compliance requirements. Fund-level dashboard shows aggregate portfolio posture, open alerts, and compliance status across all portcos.
06
Exit-Readiness Cyber Posture
6–12 months before planned exit: exit-ready cyber posture report. Documented IR history (every incident, response, and resolution). Compliance attestation letters. Clean forensic record. Third-party pen test coordination. Data room-ready security package that survives buy-side diligence.
Fund-Level Portfolio Dashboard
One view across the entire portfolio.
The CoreRecon fund-level dashboard aggregates portco security posture, active alerts by severity, compliance status by framework, and open IR tickets — into a single view. Fund partners and operating partners see the same data. LP reporting exports included at Command tier. No per-portco portal logins, no aggregation spreadsheets.
See Portal Demo →
Pricing · PE Portfolio Structure

Per-portco endpoint pricing. Fund-level master agreement.

No per-portco contract negotiation. Portcos are added as schedules on acquisition close and removed on exit. Volume discounts apply across the portfolio. Pre-close diligence included at 10+ portcos.

Portco Tier
Sentinel
$89 /endpoint/mo
Business services, distribution, manufacturing (non-defense), <100 employees. SOC 2 readiness included.
  • 24/7 SOC monitoring
  • 30-min SLA on critical alerts
  • EDR deployment & management
  • Monthly portco security report
  • TX SB 820 breach notification support
  • Backup integrity verification
  • Fund dashboard access (read)
Get Assessment →
⭐ Most Common for TX PE Portfolios
Fortress
$109 /endpoint/mo
Healthcare (HIPAA), O&G (TSA Pipeline), financial services (GLBA/SOC 2). Full compliance mapping + quarterly reporting.
  • Everything in Sentinel
  • HIPAA / TSA / GLBA framework mapping
  • OT/ICS monitoring (O&G portcos)
  • PHI access monitoring (healthcare)
  • Regulatory breach notification workflow
  • SOC 2 evidence artifact collection
  • Quarterly fund-level compliance report
  • vCISO hours (4/mo) for portco governance
Get Assessment →
Portco Tier
Command
$129 /endpoint/mo
Defense manufacturing (CMMC L2), fintech (NYDFS / SEC), approaching IPO or strategic sale.
  • Everything in Fortress
  • CMMC L2 / NYDFS / SEC disclosure support
  • C3PAO-ready SSP documentation
  • SEC incident materiality workflow
  • Annual pen test coordination
  • vCISO as Qualified Individual (GLBA) or CISO (NYDFS)
  • Exit-readiness cyber posture package
  • LP-ready quarterly security narrative
  • Full fund dashboard (read/write + alerts)
Get Assessment →
Portfolio Volume Discounts
Portfolio Size Discount Off List Pre-Close Diligence Fund Dashboard Master Agreement
1–4 portcos List price $4,500/portco Read access Per-portco SOW
5–9 portcos 8% off list $3,800/portco Full access Fund master agreement
10–19 portcos 14% off list $3,200/portco Full access + alerts Fund master + LP report template
20+ portcos 18% off list Complimentary on close Full access + custom Fund master + LP + annual executive briefing

All pricing per endpoint per month. Minimum 25 endpoints per portco. Portcos added on acquisition close (schedule amendment); removed on exit or divestiture. No termination penalty on exit-related removal.

Why CoreRecon · Differentiators for PE

The MSSP built for the Texas deal cycle.

Most MSSPs pitch PE funds but aren't built for them. They handle individual company SOC but not fund-level reporting, M&A diligence timelines, or multi-framework portfolio compliance.

🎖️
SDVOSB Certified
Service-Disabled Veteran-Owned Small Business. Supports CMMC co-prime arrangements and defense portco preferential sourcing requirements.
🏴
Texas-Native
Houston, Austin, DFW — we operate where your portcos operate. Not a national vendor with a regional rep. Our threat intel is TX-specific.
⏱️
30-Min SLA
Contractual 30-minute SLA on critical alerts. Not "best effort" — documented in the MSA and tracked in the fund dashboard.
🔍
Founder-Led Threat Hunting
Threat hunting is led by our founders — not outsourced to a Level 1 SOC in another time zone. PE portcos get the same analysts who handle our most critical engagements.
📊
Fund-Level Dashboard
Aggregate portfolio posture, alerts, compliance status, and IR tickets — one dashboard. Not ten separate portco logins. LP-ready report exports at Command tier.
📋
Diligence in 5 Days
Pre-close cyber diligence delivered in 5 business days — not 4 weeks. Timed to deal-cycle realities, not consulting firm staffing models.
🔒
No Enterprise Contracts
No minimum term, no auto-renewal gotchas, no data hostage on exit. Portco schedules are removed cleanly on divestiture. Your legal team will appreciate the docs.
🏥
Multi-Framework Depth
HIPAA, CMMC, PCI DSS, TSA Pipeline, NYDFS, GLBA, SOC 2 — we handle every framework your portfolio touches without spinning up a new provider per portco.
FAQ · Private Equity Cyber Questions

Questions PE deal teams and operating partners actually ask.

Pre-close cyber diligence should cover four areas: (1) Technical assessment — network architecture review, AD/identity hygiene, patch posture, EDR coverage, MFA state, and a targeted external attack surface scan. (2) Compliance mapping — which frameworks apply to the target (HIPAA, CMMC, PCI DSS, SOC 2, TSA Pipeline) and where gaps exist that will require post-close spend. (3) Incident history — documented prior breaches, ransomware events, regulatory investigations, and any pending OCR, FTC, or state AG inquiries. (4) Insurance alignment — cyber policy limits, coverage exclusions, and whether the insurer's requirements match actual controls. CoreRecon delivers a pre-close cyber diligence package within 5 business days at $4,500 flat (under 200 endpoints) — findings in LOI-ready format for deal team use. Free for funds with 10+ portco relationships under a master agreement.
A ransomware attack on a portfolio company during the 12–18 months before a planned exit creates three deal problems: (1) M&A buyer due diligence will surface the incident — all disclosed incidents must be in the data room, and a poorly documented response gives buyers a price chip. (2) Regulatory breach notification creates a permanent public record — OCR, FTC, and state AG filings are searchable by any buyer's legal team. (3) Cyber insurance claims create exclusion history — a claim-filed policy doesn't renew at the same terms; buyers pricing in insurance costs will see the impact. The average PE exit delay attributable to an undisclosed or poorly remediated cyber incident is 4–7 months. CoreRecon's 30-min SLA and documented IR workflow are designed to produce a clean forensic record — the kind that holds up in a data room. Every incident we respond to is documented with a forensic report in LOI-appropriate format.
The 100-day cyber stabilization plan transforms a newly acquired portco's security posture from unknown risk to documented baseline. CoreRecon's standard 100-day plan: Days 1–14: environment discovery — asset inventory, AD audit, network segmentation review, identity provider assessment. Days 15–30: critical controls — MFA deployment on all privileged and remote access, EDR rollout, backup verification. Days 31–60: SOC onboarding — SIEM integration, alert tuning, 24/7 monitoring live. Days 61–100: compliance mapping — gap analysis against applicable frameworks, remediation roadmap with cost estimates for fund-level reporting. The deliverable at day 100 is a cyber posture report in LP-reportable format and a clean forensic baseline that documents the portco's security state as of your ownership — protecting you from pre-acquisition liability that surfaces during exit diligence.
Liability is primarily at the portco entity level, but fund exposure is real in three scenarios: (1) Board-level knowledge — if fund partners serving on the portco board were aware of material security gaps and failed to remediate, plaintiffs and regulators have argued for extension of liability to the fund entity. (2) Shared services — if the fund provides shared IT, finance, or HR services under a management fee arrangement, a breach of those shared services creates fund-level exposure. (3) R&W insurance — if the SPA reps included cybersecurity representations and the buyer discovers undisclosed incidents, R&W claims flow back to the fund. CoreRecon's fund-level master agreement includes a quarterly fund reporting package that documents proactive security governance — the kind of record that limits board liability exposure and demonstrates to regulators that the fund was not willfully blind to portco security gaps.
CoreRecon prices PE portfolio engagements under a fund-level master services agreement with per-portco endpoint pricing. Sentinel tier at $89/endpoint/month for portcos with straightforward compliance. Fortress tier at $109/endpoint/month for portcos with HIPAA, PCI DSS, or SOC 2 requirements. Command tier at $129/endpoint/month for portcos with CMMC, NYDFS, or SEC requirements. Volume discount schedule: 5–9 portcos, 8% portfolio discount. 10–19 portcos, 14%. 20+ portcos, 18% plus complimentary pre-close diligence on new acquisitions. The fund-level master agreement provides a single contract vehicle — portcos are added as schedules on close, removed on exit or divestiture. No per-portco contract negotiation, no termination penalty on exit-related removal. Most funds with 8–15 portcos budget $180K–$350K annually for full portfolio coverage — less than the remediation cost of a single mid-market ransomware event.
Pre-Close Diligence or Portfolio Assessment
Start with a Free Assessment
Fund partner or operating partner intake. 30-minute call, existing portco posture review, diligence scope proposal.
Request Assessment →
Score a Portco in 15 Minutes
Portco Vendor Risk Scorecard
15-question scorecard that identifies the highest-risk gaps for a PE portco — EDR coverage, identity hygiene, backup posture, third-party exposure, and compliance state.
Score Portco Risk →
24/7 SOC · 30-Min SLA · SDVOSB · TX-Native · Fund-Level Reporting

Protect the portfolio. Protect the exit.

CoreRecon delivers pre-acquisition cyber diligence, 100-day portco stabilization, and ongoing SOC across every sector in your portfolio — HIPAA, CMMC, PCI DSS, TSA Pipeline, SOC 2. One master agreement. One fund-level dashboard. Starting at $89/endpoint. No minimum term. Clean exit-ready forensic record.

Request Fund Assessment →

No contracts. Fund-level master agreement, volume discounts, and complimentary pre-close diligence (10+ portco relationships). Diligence package delivered in 5 business days.

vCISO · Portco Governance · LP-Reportable Security Leadership
Need a CISO Across Multiple Portcos Without Hiring Eight of Them?
CoreRecon's vCISO retainer serves as CISO of record across multiple portcos simultaneously — board briefings, WISP authorship, HIPAA Security Officer designation, NYDFS CISO requirement, CMMC of record, M&A cyber diligence leadership. Starting at $4,000/mo per portco.
See vCISO Retainer →
Free Interactive Tool — M&A Cyber Diligence
What Does a Portco Breach Cost the Fund?
Run the IBM 2024 breach cost model for each portco by industry. See breach cost range, 207-day dwell exposure, HIPAA/CMMC/PCI penalty stack, and CoreRecon Fortress ROI — in 30 seconds. The number that belongs in every IC memo.
Calculate Portco Risk →
Free Tool — vCISO ROI Calculator
Fractional vCISO vs. Full-Time Hire — Calculate the Real 3-Year Cost
IBM CODB breach model + compliance penalty exposure + tier recommendation. Know the math before your board asks the question.
Calculate vCISO ROI →