Estimated reading time: 5 minutes
Kroll’s new global report shows that private equity cyber risk has become a costly issue. The report measures this risk and points out that smaller funds often have weaker cybersecurity governance. These conclusions matter for cyber insurers and brokers, and they help explain why loss costs in private markets are still unclear.
Executive Summary Signals Transaction-Level Exposure
Kroll says the market expects more exits in 2026, which will increase cyber risk. More deals mean firms inherit more systems and face extra integration work, opening up more ways for attacks. The, Cyber Risk at Scale: Safeguarding Portfolio Value in Private Equity, report says, “Cyber risk is no longer merely an operational concern,” and now threatens “deal flow and valuation.”
Kroll worked with Sapio Research in December 2025 to survey 325 private equity portfolio leaders from different regions and fund sizes around the world.
Key Findings: Put Dollar Figures On Disruption
The report finds that cyber events have caused fiscal losses for 94% of firms. On average, each incident costs about $2.1 million, and 13% of firms lost more than $5 million.
The impact shows up in different ways: 62% of firms spent more on compliance or security, 46% had to pay for remediation or consultants, and 26% saw lower valuations or exit prices. These numbers make cyber risk a real factor in deals.
Get The Cyber Insurance News Upload Delivered
Subscribe to our newsletter!
The report estimates that there is a 53% chance a firm will lose more than $500,000, and a 30% chance of losing over $1 million. These ranges are similar to insurance loss curves and help explain why premiums are rising in some PE-backed sectors.
Hold Period Incidents Drive The Most Pain
Kroll points to the ‘hold period’ as the main time when risk is highest, with 80% of firms facing disruptions then. The report calls this the time ‘where value is built, and exits are planned.’
Incident responders often see these types of disruptions: 44% of firms had unexpected remediation costs, 30% struggled to integrate IT across their companies, 29% dealt with compliance or legal issues, and 27% faced business disruption or downtime.
Firms also see more incidents while they own companies, with almost 70% reporting more problems during the hold period and 22% calling the increase ‘significant.’ This suggests attackers exploit longer exposure and integration issues.
Loss drivers differ by region: U.S. firms reported more downtime, while those in Europe and APAC faced more regulatory difficulties. These differences change how severe claims are and how much responses cost.
Pre-Investment And Exit Disruptions Hit Deal Timelines
Cybersecurity issues can arise before a deal closes. About 25% of firms had disruptions before investing, 19% had deal delays because of unresolved cyber issues, 8% saw lower valuations after finding problems, and 2% had deals fall through.
Exits bring more risks. The report warns that finding cyber issues late can hurt returns, with a ‘12% chance’ of exit disruption from a cyber incident. Smaller funds had more exit disruptions.
Big Funds Build Systems, Small Funds Still Wing It
Kroll identifies a clear governance divide based on assets under management. Among firms with AUM above $25 billion, 55% enforce a formal baseline of security controls, compared to only 12% of firms with AUM under $25 billion. Notably, 35% of firms with AUM under $500 million reported having no defined baseline.
Monitoring also shows this divide: 58% of the biggest firms use a dedicated risk platform, but only 9% of smaller firms do. Smaller firms often use manual checks or outside providers, which can miss weak signals across their portfolio.
Due diligence also differs: 81% of the largest firms always do cyber assessments, but only 29% of smaller firms do. This gap means smaller firms are more likely to inherit cyber risks.
Accountability is still lacking in the market. The report says 82% of firms do not have a dedicated cyber risk leader, and 85% have no cyber risk team. This lack of staff slows down fixes and weakens governance.
2026 Outlook Points To Harder Attacks And Higher Stakes
Firms think the problem will get worse: 96% expect cybersecurity to become more important, 53% predict higher financial losses next year, 58% expect more damage to reputation, and 54% think it will be harder to avoid issues.
Kroll leaders link this trend to attackers becoming more innovative. In a press release, Dave Burg, Global Group Head of Cyber and Data Resilience at Kroll, says, “Cybersecurity has evolved into a material transaction risk.” He notes that attackers are using generative AI to increase their impact and adds, “The average financial impact is $2.1 million.” He calls it “the tip of the iceberg.”
WATCH OUR PODCAST – Cyber Risk In 2026: AI Deepfakes, Cybercrime Scale, And Cyber Insurance Pressure
The report mentions well-known cases, like Marks & Spencer’s four months of downtime and Jaguar Land Rover’s five-week production stop, which cost £1.9 billion. These examples show how fast losses can grow.
Loss Data Shrinks The Cost Blind Spot
Cyber insurance often is short of enough loss data. This report gives useful benchmarks for private equity losses. Firms said the average loss per incident is about $2.1 million. The report shows that 53% of events cost more than $500,000, and 13% cost over $5 million. These numbers help insurers set retentions and limits, and help PE teams factor cyber risks into valuations and timelines.
Costs Stack Up Across The Deal Lifecycle
The report’s main value for insurers is its breakdown of losses. Losses affect valuation, compliance costs, remediation, downtime, and legal risks. Integration problems add costs during platform building. Incidents during the hold period lead to repeated spending across companies. Gaps in governance make losses worse after an event. The report’s main goal is to help limit financial effects and protect exit value.
Related Cyber Insurance Posts
- Parametrix Adds Eva Kwan, Albert Huang, And Kerri Colwell Amid Cyber And Digital Insurance Demand
- Zywave 2025: What We Heard, What Matters in Cyber Risk & Cyber Insurance
- What a Difference a Day Makes: Berkley Sues as a Cyber Insurance Subrogee to Recover Claim Settlement
- The Uncomfortable Truth About Cybersecurity: Why Awareness Month Is Not Enough
- The CrowdStrike Outage: A Wake-Up Call for Cybersecurity and Insurance
