Delivered by a practicing CISO, not a retired one.
Private equity has a Financial Operating Partner, a Human Capital OP, often a Technology OP. It does not have a Portfolio CISO. So cyber gets handled episodically: Big 4 at close, then silence until something breaks. We run the seat you’ve been missing. One operator across every portco. One number to the LP. One phone to call at 2 a.m.
Big 4 runs a closing assessment. For 24 months, no one owns the program. Then a client audit lands, an IR firm sends a ransom note, or a late-stage buyer’s diligence team flags gaps. The deal gets repriced, or slips a quarter. This happens every third or fourth portco.
PE firms need another tool. A CRQ platform, a GRC platform, a new scanner to solve portfolio cyber.
You need an operator who is already the CISO inside companies like yours, who runs one program across all of them, and who shows up on your Operating Partner call with a single number.
Sits at the portco leadership table quarterly. Not a deliverable. A seat.
FAIR-based loss modeling, rolled up to a single fund-level number each quarter.
Tiered pricing per portco. One contract at the fund, simple allocation across companies.
24/7 escalation hotline. A known operator on the phone, not a ticket in a queue.
SEC cyber disclosure (2023), NY DFS Part 500, and the LP cyber questionnaire all landed inside 18 months. Fund-level cyber is not a portco problem anymore. It is a fund compliance problem.
Anthropic's Project Glasswing coalition (Apple, Google, Microsoft, AWS, CrowdStrike, JPMorgan, Linux Foundation) confirms it: AI is finding and exploiting vulnerabilities faster than defenders can patch. Episodic cyber programs cannot keep up.
Cyber findings in late-stage diligence are repricing deals by 3 to 8 percent of enterprise value. A single incident during hold period can cost more than ten years of continuous program spend.
Choose a tier per portco. Tiers can shift quarterly with 30 days' notice. One MSA at the fund, per-portco SOWs underneath.
Reports are generated in the VALTY platform and built for Operating Partners and LPs, not security teams.
Not a former CISO who consults now. Not a retired executive.
20+ years operating inside PE-backed and financial-services security programs. Active CISO seat at a PE portfolio company today, not a consultant who used to be one. Pioneered FAIR-based EBITDA-at-Risk modeling while building VALTY, the platform that powers this advisory practice. Everything I ask your portcos to do, I am doing this week.