Every investment committee we have ever sat in has spent time on customer concentration, key-person risk, and working capital. These are not just technical diligence items. They are durability questions. Will the revenue hold? Will operations continue? Will cash flow be predictable? These are the questions that ultimately determine what a business is worth.
We want to make an argument that belongs in that same conversation: not in the IT section of a diligence report, but at the investment-committee table. The argument is this: for mid-market businesses today, cyber resilience has become a durability characteristic. A company that cannot protect its earnings from ransomware, cannot survive a vendor outage, and cannot pass buyer diligence without surprise is not just a company with a security problem. It is a company with a business-quality problem.
That reframe, from IT risk to business quality, is the lens through which we increasingly think about cyber and operational resilience across our portfolio and our deal underwriting. This edition of Wind in the Willows explains why, and what we believe it means in practice for owners and operators.
The Evidence Is No Longer Theoretical
Kroll surveyed 325 private equity executives earlier this year on the financial impact of cyber incidents across their portfolios. The average financial impact was $2.1 million per incident. Fifty-three percent of respondents faced losses above $500,000. Thirteen percent experienced impacts above $5 million. Eighty percent reported cyber-related disruption during the hold period: business downtime, unexpected remediation costs, litigation, and integration problems. And 26% of respondents reported a reduced valuation or exit price directly attributable to a cyber incident.
That last figure deserves to sit for a moment. One in four PE-backed businesses in this survey experienced a measurable reduction in transaction value because of a cybersecurity event. Not a near-miss. A realized loss at the exit table.
What Kroll also found, and what we find equally important, is the governance gap between large and small PE firms. Among firms with more than $25 billion in AUM, 81% treated cyber due diligence as a standard part of transaction underwriting and 55% maintained formal portfolio-company cyber mandates. Among smaller firms, the peer group most relevant to the lower middle market, those figures were 29% and 12%, respectively. Larger firms have already internalized cyber as a value-protection discipline. For smaller PE operators, it remains largely reactive.
We think that gap is an opportunity, not just to protect against downside, but to operate with a level of discipline that buyers notice and reward.
The Middle Market Is the Target, Not the Exception
There is a persistent assumption among mid-market business owners that cybersecurity is primarily an enterprise concern, that attackers focus their attention on large companies with large paydays. The data does not support this.
RSM's 2026 Middle Market Business Index cybersecurity report found that 18% of middle-market executives said their organization suffered a data breach in the previous twelve months. At the same time, 96% of those same respondents said they were confident in their current security measures. That gap between perceived safety and actual breach experience is not a footnote. It is the central finding. The companies most likely to underinvest in resilience are the ones most confident they do not need to.
The threat environment reinforces this. Verizon's 2026 Data Breach Investigations Report found that software-vulnerability exploitation has now surpassed stolen credentials as the leading breach entry point, accounting for 31% of breaches. Ransomware appeared in 48% of Verizon's incidents. Third-party supply-chain breaches jumped 60% year over year and now account for 48% of total breaches. AI is accelerating attacker capabilities, reducing the time from vulnerability discovery to active exploitation from months to hours.
IBM's 2026 Cost of a Data Breach Report puts the global average cost of a breach at $4.99 million, and $6 million for breaches involving AI-generated attacks specifically. IBM also found that organizations making extensive use of security AI and automation experienced breach costs nearly $2 million lower than those using none, a finding that is particularly relevant for mid-market companies trying to do more with leaner security teams.
The picture that emerges from this data is not that the middle market is uniquely vulnerable. It is that the middle market is no longer flying under the radar, and the cost of a breach has climbed to a level that can genuinely impair a company's earnings trajectory.
From Risk Management to Value Creation
The most important shift in how we think about this is moving the conversation from 'what can go wrong' to 'what does a well-run company look like.' These are related questions, but they lead to very different investments and very different ownership behaviors.
The same principle applies at the mid-market scale, even if the dollar figures are different. A business that is adopting AI tools, integrating an acquisition, modernizing its technology stack, or entering a regulated customer segment has a choice about when to bring discipline to bear. Earlier is cheaper, faster, and produces better outcomes. Security that arrives after a system has been built is always more expensive than security that shapes the design.
This is what we mean when we say cyber resilience is part of business quality, not just a hedge against bad outcomes. A company that knows its dependencies, enforces strong access controls, monitors its environment continuously, and has rehearsed its response to a serious incident is a company that is running well. Those characteristics (operational continuity, management depth, process maturity) are exactly what buyers ultimately capitalize.
The Diligence Reality Has Changed
The sell-side reality for mid-market businesses has shifted meaningfully over the past two to three years. Buyers, particularly PE buyers, are now conducting more structured cyber diligence than they were, and the results of that diligence are affecting deal economics in ways that were less common before.
The most immediate value-protection opportunity is not building the world’s most sophisticated security program. It is not having a material, undisclosed cyber problem show up during a buyer’s diligence process. Late-stage surprises in cyber diligence tend to produce one of three outcomes: a price reduction, an expanded indemnification, or a delay that creates its own costs and risks. None of these outcomes is in the seller’s interest, and all of them are at least partially avoidable.
A portfolio company that enters a sale process with a current security assessment, a documented remediation history, a clear answer to who owns cybersecurity, evidence that multi-factor authentication is actually enforced, a tested backup and recovery capability, and a record of how incidents have been managed, that company is not just more defensible in diligence. It is demonstrating a kind of operating maturity that sophisticated buyers look for across all aspects of how a business is run.
The goal, stated simply: cyber resilience at exit should look like evidence of a well-run company, not a pile of security software purchased in the twelve months before marketing.
AI Deserves Specific Attention
We want to address artificial intelligence directly, because the speed of AI adoption in mid-market businesses has outpaced the governance frameworks surrounding it in a significant number of cases.
RSM’s 2026 report found that only 35% of middle-market executives have implemented formal AI governance frameworks, even as AI adoption accelerates broadly across the segment. The specific risk this creates is what RSM and others call shadow AI, employees using unapproved tools or placing sensitive company, customer, or financial information into public AI models without understanding where that data goes or how it is used. This is not a hypothetical concern. It is an active and largely unmanaged exposure in a large share of mid-market businesses right now.
The business context matters here. AI adoption is a genuine value-creation opportunity, and we are not arguing against it. We are arguing that AI adoption should be treated like any other major strategic initiative: move quickly, but build the controls that allow you to scale safely. An AI tool that a company does not know is being used cannot be governed. Data that leaves the organization through an unapproved channel cannot be recalled. And an AI system that is granted broad access will act on that access, intended or not.
Identity and access management, knowing who and what can access which systems and ensuring that access is appropriate and actively monitored, is arguably the most important control environment as AI becomes embedded in operations. RSM found that only 23% of middle-market companies identified digital identity as a cybersecurity priority in 2026. That figure, more than any other in the research, describes the gap between where the risk is and where the attention is.
How We Approach This as Owners
We want to be honest that we do not position ourselves as the Chief Information Security Officer of our portfolio companies. That is not our role, and pretending otherwise would not serve our management teams well. What we do bring is an ownership framework: a consistent set of questions, expectations, and accountability structures that we apply across the investment lifecycle.
At entry, we treat cyber as part of investment-thesis diligence, not just technical review. We want to know what material risks exist before they become our problem, and we want a remediation plan with a budget attached to it as part of the first hundred days. During the hold period, we track cyber health alongside operating metrics, not because we are trying to run the security program, but because a business whose cyber posture is deteriorating while we own it is a business whose quality is deteriorating while we own it. Before exit, we want our companies ready to answer buyer questions quickly and credibly, which means doing the work before the process starts rather than scrambling when it does.
The companies we admire and try to build are the ones where cyber resilience is visible not as a separate function reporting into IT, but as an expression of how seriously management takes operating continuity, data stewardship, and customer trust. Those characteristics compound over time, and they are recognized at exit by buyers who know what a well-run business looks like.
The Question Has Changed
For years, the cybersecurity conversation in private equity started with: how much risk can we eliminate? That question is still worth asking. But it is no longer sufficient.
The better question, and the one we try to ask ourselves as owners, is: what kind of business are we building? A company that knows its dependencies, enforces access controls, continuously reduces exposure, rehearses disruption, and can demonstrate all of this to a buyer is not simply more secure. It runs better. Security, understood that way, is not a cost of doing business. It is part of the quality of the business itself, and business quality is what buyers ultimately capitalize.