Deals at Risk: The Growing Cyber Risks to Private Equity Firms and Their Portfolio Companies

Private equity firms have always managed risk, but cyber risk has fundamentally changed the equation. What was once a peripheral concern has become a direct threat to deal economics: according to a February 2026 global study of 325 PE executives by Kroll, cyberattacks now cause an average of $2.1 million in financial impact per incident, with a 53% chance a firm will lose more than $500,000 and a 13% chance the impact will exceed $5 million.

The attack vectors targeting PE firms and their portfolio companies have also shifted dramatically. In 2025, eSentire's Threat Response Unit (TRU) observed credential-based attacks emerge as the dominant initial access method, fueled by Phishing-as-a-Service (PhaaS) platforms and Adversary-in-the-Middle (AiTM) toolkits that can bypass legacy MFA and move from credential theft to active exploitation in minutes. Attackers are also increasingly weaponizing the interconnected nature of PE operations: a breach at one portfolio company can serve as a gateway into the broader network.

In our new threat intelligence report, eSentire's TRU shares a detailed analysis of threat data from security investigations across our global customer base throughout 2025. Key findings include:

• The VC & PE sub-industry recorded an 86% intrusion ratio in 2025 — meaning the vast majority of intrusion attempts resulted in successful breaches, making it one of the most targeted sub-industries across the entire financial sector.
• Credential Access via Account Compromise was the #1 threat type observed for the Finance industry, with credentials sourced from email phishing and AiTM toolkits making up 38.89% of Finance sector initial access cases.
• VC & PE was the second-most affected sub-industry for identity-related threats, specifically Credential Access and Account Compromise, reflecting both the high value of deal-related data PE professionals hold and the maturity gap between PE firms and their portfolio companies.
• Browser-based and drive-by attacks accounted for approximately a third of Finance sector incidents, with ClickFix emerging as a particularly prevalent delivery mechanism for NetSupport RAT and other malware.
• 26% of PE firms reported that cyber incidents resulted in a reduced valuation or exit price, underscoring that cyberattacks are now a direct threat to deal economics and investor returns.

Download the full report from eSentire's Threat Response Unit (TRU) to get a comprehensive understanding of the current threat landscape targeting PE firms and their portfolio companies, including the most prevalent attack vectors observed, actionable recommendations for protecting your entire portfolio, and guidance on implementing 24/7 threat detection and response, identity security controls, and Continuous Threat Exposure Management (CTEM) to stay ahead of the threats targeting the PE sector.