Good day. Though tech-savvy, startups aren’t immune to costly data breaches, ransomware and other cyberattacks. And these hacks aren’t just a headache for a startup’s founders: Their investors are often on the hook for emergency funds to cover immediate damage control.
Beyond that, as shareholders in the company, investors may also face legal battles over data-privacy regulations or lawsuits brought by a startup’s customers. A serious hack can also damage a startup’s reputation, stalling follow-on funding rounds and dampening its valuation.
Despite these risks, too many investors have little or no oversight over how their portfolio companies manage cybersecurity, according to Starr Drum, a privacy and cybersecurity lawyer at national law firm Polsinelli who works with startups and investors alike.
WSJ Pro recently spoke with Drum about the role investors should take in protecting their startups from hackers. Edited excerpts below:
WSJ Pro: To what extent should investors be concerned about cybersecurity at their portfolio companies?
Drum: While venture-capital and private-equity firms aren’t typically involved in [the] day-to-day oversight of their portfolio companies’ cybersecurity and privacy compliance, it’s an important consideration at all stages of each company’s lifecycle, as gaps in this space can have a material impact on the value of an investment. Firms that understand the risks in this space will often take proactive measures to understand the scope of each portfolio company’s risk and provide resources and guidance to help manage those risks.
WSJ Pro: What risks do these gaps pose for investors?
Drum: There is, of course, significant expense involved in defending lawsuits and regulatory investigations tied to privacy and cybersecurity gaps, and those are compounded by expenses associated with remediation of those gaps. Even without litigation, these issues are scrutinized in diligence and can impact the value of a transaction. Less quantifiable is the reputational damage that these gaps can create.
WSJ Pro: Are cybersecurity issues having an impact on dealmaking?
Drum: While I have seen some uptick in potential deal activity tied to companies with various types of AI-based solutions, I’ve seen some of these deals die when diligence exposes potential gaps in the privacy or security protections surrounding the data leveraged to train those solutions.
WSJ Pro: What can investors do to better manage these risks?
Drum: If there’s been recent privacy and cybersecurity diligence on an investment, the issues flagged during that process should be reviewed and prioritized.
|