By Adil Karam, Founder & CEO of Valty
An alert lands in the operating partner's inbox. The security team recommends stronger identity controls. The CFO asks what to fund first.
That last question is where private equity cyber risk becomes an operating decision.
Kroll's September 3, 2026 email, "Recent Threat Activity Targeting Private Equity Firms," warned about voice phishing and identity abuse, including threats to deal, investor, and portfolio-company information. Its practical message was to review attack paths, identity controls, and response readiness.
For a sponsor, the next step is to turn that warning into a specific decision: which gaps matter at this company, who owns them, what will fixing them cost, and how will we know the work helped?
What the threat reporting tells us
CrowdStrike's 2026 Threat Hunting Report summary states that observed vishing intrusions doubled in the first half of 2026 compared with the second half of 2025. That is a trend in CrowdStrike's observations, not a probability that a particular portfolio company will be breached.
Its research on CORDIAL SPIDER and SNARKY SPIDER describes attackers posing as IT support, steering users toward fraudulent sign-in pages, and abusing access to connected cloud applications to steal data. A campaign can therefore create loss without encrypting a server.
The recovery path matters too. Kroll's earlier analysis of MFA bypass, published in 2023, describes attackers persuading help desks to reset passwords or change authentication methods. That older research explains a mechanism; it is not fresh evidence of how many PE firms are affected today.
The lesson is more precise than "MFA does not work." Phishing-resistant authentication remains important. Enrollment, account recovery, permissions, and response need protection alongside it.
Start with one company and one loss scenario
Keep the sponsor's own environment separate from each portfolio company's environment. A PE firm's deal room and a manufacturer's customer files may face related threats, but they have different users, owners, and access controls.
Shared ownership does not mean shared identity infrastructure. Shared technology or providers may create dependencies, but those dependencies need to be established, not assumed.
For a newly acquired company, use a concrete scenario such as: an attacker takes over an employee account and exports sensitive customer or financial files from a connected application. Then ask:
- Which accounts can reach those files, including administrators, guests, and support providers?
- How can those accounts be recovered or given a new authentication method?
- What recent configuration, access, and activity evidence supports the answers?
- Who can investigate and revoke access, including outside business hours?
This identifies the work to assess. It does not establish that the company is compromised. If suspicious activity suggests an active incident, involve the company's responders immediately. Do not wait for a budget exercise.
Ask for evidence of the recovery path
"MFA enabled" is a starting point, not a complete answer. A useful review follows an account through normal sign-in, a lost authenticator, a helpdesk reset, and enrollment of a replacement.
Microsoft's cloud identity incident-response guidance describes why privileged reset permissions and changes to authentication details deserve scrutiny. Ask the technical owner to show who can make those changes, how identity is verified, and how exceptions are reviewed.
Microsoft also documents Conditional Access protection for security-information registration. Registration is a distinct control surface. Deploying a passkey does not, by itself, demonstrate that every enrollment and recovery route is protected. Test policy changes before enforcement and preserve a controlled emergency-access process.
The decision evidence should name the accounts and applications tested, the date, the method, and the exceptions. Missing evidence should remain an open question with an owner, not become a green status.
Decide what to fund first
First establish mandatory protections and address urgent exposure. A financial comparison is not a reason to defer contractual requirements or a known critical gap.
Then compare incremental treatment packages against the same scenario. Start with controls already licensed and people already responsible for them. The relevant cost includes configuration, testing, support, and operational disruption, not just the next software invoice.
For example, a company might sequence work this way:
- Harden recovery and enrollment. Review reset permissions, strengthen identity checks, and test exception handling. Pair this with phishing-resistant authentication for the relevant users.
- Reduce access to sensitive data. Review unnecessary access and stale guest accounts, then test that legitimate work still functions.
- Improve detection and containment. Confirm that relevant identity and application events reach a monitored process, with an owner able to act.
These are complementary controls, not three interchangeable products. Their order depends on the company's evidence and existing protections.
Consider an illustrative post-close decision. A security team requests a new monitoring tool, but the review also finds an untested helpdesk recovery process. The operating partner needs to understand whether the proposed tool closes that gap, whether existing tools can supply the missing visibility, and which work can begin immediately. The answer may be a combined plan, not a winner-takes-all purchase.
Make the financial assumptions challengeable
A useful decision record separates external threat information from company-specific inputs.
External reporting describes observed attack patterns. Company evidence describes account access, control coverage, response capability, and the business data involved. Neither a headline nor a control checklist, alone, supplies an annual loss estimate.
If the team uses a financial model, state the scenario, time horizon, loss categories, assumptions, and uncertainty range. Identify which inputs come from external data and which are calibrated to the company. Avoid counting the same cost twice, such as lost revenue and the full associated margin impact.
Compare the current scenario with each treatment under consistent assumptions. Ask whether the preferred choice changes when uncertain inputs move. Where the evidence is too weak to rank options confidently, fund the specific assessment or test that could change the decision.
Do not present modeled reduction as realized savings. If insurance is considered, show gross loss and retained loss separately and make the coverage assumptions explicit.
Define acceptance before approving the spend
The funding decision should fit on one page:
- Decision: the company, scenario, and treatment being approved.
- Cost and timing: implementation effort, recurring cost, dependencies, and responsible owner.
- Expected effect: the gap the treatment addresses and the assumptions behind any modeled change.
- Acceptance evidence: a scoped test, authoritative configuration readback, or response exercise that will demonstrate the intended behavior.
- Exceptions and review: what remains unresolved and when the sponsor and company will review it again.
For a recovery-control change, closing a ticket is not enough. An authorized test should show that an unverified requester cannot obtain the intended access, while a legitimate user can still recover an account. Keep sensitive identity evidence with the appropriate company owners; the sponsor needs a decision record, not unnecessary copies of personal data.
This is also the basis for recurring portfolio reviews. Acquisitions, new administrators, provider changes, and access exceptions can make an earlier answer stale. Revisit the decision when its underlying evidence changes.
Where Valty fits
Valty is being built for this recurring sponsor decision: connect control evidence to financial loss scenarios, compare treatments, and retain the approval and follow-up record. The entry point is one post-close cyber-budget decision at one company.
That complements the work of identity platforms, security teams, and specialist advisers. It does not replace incident response or claim to prevent a named threat group.
The question for the next operating review is simple: Which identity gap are we funding, who owns the change, and what evidence will let us accept it?
Inspect the sample Proof Pack for an illustrative decision artifact, or request a portfolio briefing to discuss one company's post-close budget decision. Product imagery on this page uses illustrative data, not evidence of a customer incident or outcome.
Source note
This is Valty's independent analysis, prompted by Kroll's September 3, 2026 advisory email. The linked Kroll, CrowdStrike, and Microsoft publications support the threat and control discussion. The proposed PE decision process is our interpretation, not a recommendation or endorsement by those organizations. No named portfolio company or first-party incident is asserted.
