Jason Button is a director at Cisco and leads the company's Security and Trust Mergers and Acquisitions (M&A) team. He was formerly the director of IT at Duo Security, a company Cisco acquired in 2018, making him uniquely positioned to lend his expertise to the M&A process. This blog is the second in a series focused on M&A cybersecurity, following Jacob Bolotin's post onManaging Cybersecurity Risk in M&A.

Demonstrating Trust and Transparency in Mergers and Acquisitions 

All good relationships are built on trust. Add in transparency, and the union becomes even more substantial. "Trust and transparency underpin everything we do," says Button, "Cisco takes security, trust, and transparency very seriously, and it's part of our team's fabric."

When Cisco acquires a company, the Security and Trust M&A team looks at not only what they can offer in the way of security but also what unique qualities the acquired company brings to Cisco. These qualities might be related to security, but they're also found in the acquired company's culture, technical knowledge, and processes.

In all acquisitions, the M&A team needs to move fast. In fact, the Cisco team is committed to pushing even faster as long as they never compromise on security. Around 2020, Button and his team began taking stock of how it does things. They evaluated everything from the ground up, willing to tease out what is working and toss out what isn't.

The team is also on a trajectory of identifying how it can digitize and automate security.

"If we were going to do things differently, we needed to be bold about it," says Mohammad Iqbal, information security architect in the Security and Trust M&A team. One of the changes Iqbal proposed to his colleagues is to ensure that an acquired company is integrated into Cisco's critical security controls within three months after the acquisition deal closes.

Focus on Non-Integrated Risks

To successfully meet the three-month target, the M&A team works closely with the acquired company to identify and address all non-integrated risks (NIRs) that Cisco inherits from an acquisition and encompass:

• Visibilityto get the acquired company integrated into the governance process; includes risk assessments and familiarity with all the players involved in the acquisition
• Vulnerability managementto identify and remediate vulnerabilities. Where do the acquisition's crown jewels reside? What does the external attack surface look like? Has it been patched?
• Security operationsto determine such functions as identity, administrative access, multifactor authentication, and basic monitoring.

NIRs are a subset of eight security domains, or operating norms, that align with Cisco's security and trust objectives and top priorities of the larger security community (Figure 1). The M&A team's focus on NIRs steers the due diligence conversation away from identifying the acquisition's security deficiencies and towards understanding the inherent risks associated with the acquisition and measuring the security liability.

"Acquisitions are coming in with these risks, and so we must address NIRs early when we're signing non-disclosure agreements. In doing so, we help put these companies in a position to integrate successfully with all the security domains. And this integration should be done in the shortest time possible within a year of close," Iqbal says.

Building trust and being transparent early on is critical so the acquired company knows what's expected of them and is ready to accomplish its three-month and first-year goals.

"I wish this type of conversation was offered to me when Cisco acquired Duo," Button says. "Being on the Duo side of that deal, I would've been able to say with confidence, 'OK, I get it. I know what's expected of me. I know where to go. I know what I need to do with my team.'"

"We have a limited time window to make sure an acquisition company is heading down the right route. We want to get in there early and quickly and make it easy," adds Button.

Time Is of the Essence

Reducing the manual intervention required by the acquired company is integral to helping the acquisition meet the three-month goal. Here's where automation can play a significant role and the M&A team is looking toward innovation.

"We're working on bringing in automated processes to lessen the burden on the acquired company," says Iqbal. The M&A team realizes that much of the automation can be applied in instrumenting the security controls and associated APIs to help the team move beyond what they have already assessed at acquisition day 0 and gain the visibility they need to get the acquired company to its three-month goal. For example, they can automate getting the acquired company on Cisco's vulnerability scans, using internal tools, or attaining administrative access privileges.

So, Iqbal, Button, and the rest of the team are working on automating processes-developing the appropriate architecture pipeline and workflows-that help acquired companies integrate critical security controls. While the ability to automate integration with security controls is not novel, the innovation that the M&A team brings to the table is the ability to position an acquired target to integrate with security controls in the most expedited way possible.

Automation in Discovery

As with due diligence, the M&A team strives to complete the discovery phase before the acquisition deal close. Here's another step where digitization and automation can simplify and shorten processes. Take the acquisition company questionnaire, for instance.

"Instead of asking dozens of questions, we could give the company an audit script to run in their environment," Iqbal says. "Then, all they have to do is give us the results."

Also, the questionnaire can be dynamically rendered through a dashboard, improving the user experience, and shortening completion time. For example, the number of questions about containers could automatically retract if the acquired company uses Azure Kubernetes Service.

After the Close

Many teams within Cisco compete for an acquired company's time before and after an acquisition deal closes. The acquired company is pulled in several different directions. That's why the Security and Trust M&A team doesn't stop looking for ways to digitize and automate security processes after the close-to continue to help make the acquired company's transition more manageable.

"If we can make processes simple, people will use them and see the value in them within days, not weeks or quarters," says Button.

"The majority of companies we acquire are smaller," Button says. "They don't have large security teams. We want them to tap our plethora of security experts. We want to enable an acquired company to apply Cisco's ability to scale security at their company. Again, we want things to be simple for them."

The M&A team helps facilitate simplicity by telling a consistent story (maintaining consistent messaging unique to the acquired company) to all the groups at Cisco involved in the acquisition, including M&A's extended Security and Trust partners such as corporate security, IT, and supply chain. Because each group deals with different security aspects of the integration plan, it's essential that everyone is on the same page and understands the changes, improvements, and benefits of the acquisition that are relevant to them. Maintaining a consistent message can go a long way toward reducing complexity.

It's All About Balance

The human element can easily get overlooked throughout an acquisition's myriad business, technical, and administrative facets. Balancing the human aspect with business goals and priorities is essential to Button and the entire Security and Trust M&A team. They want to bring the human connection to the table. In this way, trust and transparency are on their side.

"Emotions can run the gamut in an acquisition. Some people will be happy. Others will be scared. If you don't make a human connection, you'll lose so much value in the acquisition," Button says. "You can lose people, skillsets, efforts. If we don't make that human connection, then we lose that balance, and we won't be off to a great start."

One way the M&A team helps maintain that balance is by embracing the things that make the acquired company unique. "It's vital to identify those things early on so we can protect and nurture them," says Button.

He also wants to remind companies that they don't have to be experts at everything asked of them during acquisition. "Cisco has been here for a while. We have entire teams within M&A that are dedicated to doing one thing. We can help acquired companies find out where they're struggling. We can handle the things they don't want to deal with."

"M&A is complex, but complexity is off the chart when you talk about M&A and security. Our team won't be successful if we can't find a way to make things easier for the acquired company. They need to understand where they're headed and why," Button says. "It's up to us to motivate them towards a successful outcome."

Related Blogs

Managing Cybersecurity Risk in M&A

We'd love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!

Cisco Secure Social Channels

Instagram
Facebook
Twitter
LinkedIn