Financial Services Acquisition Due Diligence
How BCyber supported a private equity firm with cyber due diligence for a $10 million acquisition consolidating Australian financial services businesses.
The Challenge
A private equity firm was consolidating several Australian financial services businesses into a single platform. As part of the $10M acquisition of a financial planning firm, they needed to understand the cybersecurity posture and any risks that could affect integration or ongoing operations.
The target firm managed client portfolios and held sensitive financial data subject to Australian Privacy Act requirements and APRA prudential standards. The PE firm needed practical insights to inform deal terms and post-acquisition planning.
Key Questions from the PE Firm
- What is the current state of cybersecurity controls?
- Are there any immediate risks that need addressing?
- What budget should be allocated for remediation post-acquisition?
- Can the target be integrated into our existing platform securely?
BCyber's Approach
We deployed a focused 2-person team to conduct a practical assessment covering governance, technical controls, and compliance alignment.
- • Reviewed policies, procedures, and security documentation
- • Interviewed IT manager and operations staff
- • Mapped technology stack and third-party vendors
- • Assessed data handling practices
- • External vulnerability scan
- • Cloud configuration review
- • Access control and identity management assessment
- • Risk prioritisation and remediation roadmap
Key Findings
Client data stored across multiple systems without consistent encryption. Backup procedures needed formalisation. Staff training on data handling was informal and undocumented.
Shared credentials for critical systems. No multi-factor authentication for remote access. Former employee accounts still active. Password policies not enforced consistently.
Good endpoint protection in place. Regular software updates maintained. Staff showed strong security awareness despite lack of formal training. No evidence of previous security incidents.
Outcomes
Deal Impact
- $180K remediation budget factored into deal model
- 60-day security roadmap agreed as condition
- Deal completed with clear understanding of risks
Post-Acquisition
- MFA deployed across all systems within 30 days
- Access review completed and dormant accounts removed
- Successful integration into PE platform
“BCyber gave us exactly what we needed - a clear picture of the risks and a practical plan to address them. No over-engineering, just straightforward advice that helped us complete the deal with confidence.”