A&D News

It’s increasingly a familiar story in aerospace and defense M&A: a potentially lucrative deal gets tanked when cybersecurity becomes an issue. Due diligence reveals a pattern of issues, and the buyer either backs out entirely or demands a decrease in the price. As ransomware attacks surge, the pattern is sure to accelerate. Whether a seller experiences a cybersecurity breach years before deal or in the midst of one, the consequences are potentially massive. It doesn’t have to be this way. A thoughtful, proactive approach can help lessen the potentially damaging impacts of cybersecurity threats on mergers and acquisitions. 

Practice Full Disclosure 

Sellers must be honest and upfront about any prior or current cyber incidents. Anything less than full, immediate disclosure erodes trust and is an immediate deal breaker for most buyers. Disclosing breaches gives you the opportunity to explain exactly what you have done to manage them. This can build trust and prove that you’re committed to full security. 

Be Proactive

While it’s good to respond intelligently to breaches, it’s much better to prevent incidents in the first place. Invest in quality antivirus software, cybersecurity insurance, and penetration testing. Consider how much a breach would cost you, and don’t cut corners when working with a skilled cybersecurity team. 

Practice Cybersecurity Due Diligence 

Most organizations rely heavily on digital data during the due diligence process. Consequently, this is a prime time for attacks. Moreover, many buyers include a cybersecurity assessment as part of the due diligence process. Buyers are mindful of the increase in ransomware threats, and are focusing more on cybersecurity than at any prior time in history. 

Sellers must be prepared for a due diligence process that considers: 

• prior incidents and incident responses 
• digital assets, including your understanding of network and system architecture
• data flows
• specific vulnerabilities, including via third parties such as vendors and contractors 
• regulatory compliance via internal cybersecurity programs
• your ability to withstand an incident and respond to whatever damage it causes 
• how you will produce financial and other statements if there is a breach during due diligence 

Preparing to Take Action

Cyber incidents are inherently disruptive. During M&A, they are immensely harmful, with the power to cause severe delays and losses, and potentially destroy entire deals.

Aerospace and defense contractors have unique obligations, since a breach can affect national security as well as millions of individuals. There is simply no longer any excuse for outdated or nonexistent security practices. If you want a competitive edge, you must be prepared for the challenges of 21^st century cybersecurity. 

The right security infrastructure—including quality technology and knowledgeable people—are integral to your deal. Ensure you hae them in place at the beginning, so you can head off threats before they occur.