Insider Threats: An M&A Dealmaker's Nightmare

Because data has never been more portable, taking it has never been easier. And that's a huge problem during mergers and acquisitions.

Joe Payne, President and CEO at Code42

July 9, 2019

5 Min Read

When it comes to insider threats, business and security leaders are facing a harsh reality. Last year, there were 50,000 mergers and acquisitions (M&A) transactions worldwide, with a total value of about $4 trillion. The biggest concerns for dealmakers? They were not what you might expect. For more than a quarter of them, it wasn't typical issues related to valuation, integration, or execution; instead, it was insider threat and other cybersecurity issues.

The risk of data loss or data theft increases during M&A. Employees, especially at the sell-side company, will hedge their bets and prepare for the worst. "What does this deal mean for me? Is my job safe?" In times of uncertainty, even the best employees may take actions that are out of character in order to keep data that they believe belongs to them.

Consider a developer with high-demand skills at an artificial intelligence startup that was just acquired by the market leader. As part of the deal, the buy-side company announces a reorg. Hearing about the pending layoffs, a recruiter for the competition begins poaching talent with the promise of a big compensation package. Worried about losing his job, the developer accepts the offer. Before he leaves, he transfers some source code to personal cloud storage, thinking it might be useful in his new role. Now, your intellectual property (IP) has walked out the door.

Investing big in a merger or acquisition only to discover that you've lost valuable data is a dealmaker's nightmare. And because data has never been more portable, taking it has never been easier. Employees can store hundreds of gigabytes on their mobile devices, put 1TB or more of data on removable media, or, like the developer, quickly transfer data to personal cloud storage services.

When you consider Deloitte's estimate that IP can account for as much as 80% of a company's value, it should not be surprising that securing the transition of that data will directly affect the success — or failure — of an M&A deal. To better protect their investment, it's time for buy-side companies to take a more holistic approach to data loss protection from insider threats.

Demise of the Castle Metaphor
Since the dawn of technology, security has been built around a castle metaphor. The idea is that your network and data is inside a castle that you need to fortify and safeguard. If you build a big enough "moat," everything will be fine. This philosophy assumes that cybercriminals and malicious attacks are outside the moat, and that anything and anyone inside the walls of the castle should be inherently trusted.

However, the notion that you can trust everyone "inside" and prevent all of your sensitive or confidential data from being exfiltrated or compromised is flawed thinking. Data loss "prevention" is a ridiculous promise. Losing data is inevitable.

The Broken Promises of Legacy DLP
To guard against insider threat and data loss during M&A, many buy-side companies opt for a traditional data loss prevention (DLP) solution. They install DLP software on the endpoints of the sell-side company and put strict policies in place to ensure sensitive data doesn't leave the castle.

The problem is that these restrictive policies get in the way of employees getting their jobs done. The policies fail to account for new data being created as the companies work together through the M&A process. They also throw off alerts every time a user moves data that has been classified as sensitive. For many employees, however, moving sensitive data is a completely normal and necessary part of their everyday work. The end result for security teams? Rigid classification rules that simply can't keep up and a flurry of false alerts that are nothing more than noise.

Protect Everything and Trust No One
There is a better way to safeguard data and streamline the M&A process. Rather than trying to identify and tag select files as sensitive, organizations should have visibility to all their data and where it lives and moves.

This approach fundamentally shifts the emphasis of a data security program from prevention to protection by focusing on speed of detection and response. It works based on the assumption that all data is important. Sales pipelines, forecasts, competitive campaigns, customer contact information, product road maps, prototype drawings — they're all critical IP. And when you buy a company, you should be entitled to all the parts.

This next-generation approach to DLP also assumes that you trust no one. In other words, next-gen DLP software doesn't care if an employee is a trusted user or not. It works at the data level, tracking and monitoring all data activity and flagging anomalies, while keeping copies of all files for fast retrieval and analysis. In an M&A situation, you want to see the data you're paying for, keep it, and protect it if it is threatened. Data blind spots will only leave your deal open to more risk.

When done right, M&A is a great way to grow a company and gain a competitive edge. Having the right data security strategy and tools in place will keep your process on track, while protecting your investment. You don't want to find yourself in the middle of a data security investigation the next time you're ready to strike a deal.

Related Content:


Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.


About the Author(s)

Joe Payne

President and CEO at Code42

Joe Payne is the President and CEO of Code42 Software. Joe is a seasoned executive with more than 20 years of leadership experience and a proven track record leading high growth security and technology companies. With a passion for identifying and solving emerging market needs, Joe engages personally in product strategy and direction, while growing and providing vision and guidance to a world-class team of security executives. Previously, Joe served as CEO of eSecurity, the first SIEM software company. He also served as the president of iDefense prior to its acquisition by VeriSign. At iDefense, Joe led some of the best white-hat security researchers in the world and worked with the top financial institutions and government agencies in the United States to improve their risk profile.

Joe also has held additional executive positions at eGrail, MicroStrategy, InteliData and Eloqua. As CEO of Eloqua, Joe led the team to $125 million in revenue, a successful IPO and a subsequent acquisition by Oracle. Joe currently serves on the Board of Directors of First Focus Campaign for Children, a non-partisan, not-for-profit advocacy organization. Joe previously served on the boards of Dealertrack (NASDAQ: TRAK), Cornerstone OnDemand (NASDAQ: CSOD), Eloqua (NASDAQ: ELOQ), Workfront, TrackMaven, Plex, e-Security, eGrail, and Ecutel.

Joe is a co-author of Inside Jobs: Why Insider Risk Is the Biggest Cyber Threat You Can't Ignore, which shines a light on insider risk and details what business and security leaders can do to keep their workforces productive and data protected.

Joe received his Master of Business Administration from the Fuqua School of Business where he was a Fuqua scholar. He is a magna cum laude graduate of Duke University. When not hard at work, you can find Joe cheering for the US National Soccer Team or his beloved Duke Blue Devils. Joe is married with four children.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights