Top
Authors: Isabelle Mast and Greg Heywood
A cyber attack can erase a year of operating profit in a matter of weeks, making cybersecurity a defensive necessity.
As digitalisation continues, artificial intelligence (AI) accelerates, and geopolitical tensions persist, the frequency, sophistication and financial consequences of cyber attacks continue to rise. Companies across sectors – not only those traditionally viewed as high-risk – are now exposed. For long-term investors, the relevant question is not whether cyber risk exists, but whether companies are prepared to manage it.
In 2025, we applied our proprietary cybersecurity assessment framework to certain portfolio companies that we consider relatively exposed to cyber risk, with the objective of assessing this potentially financially material risk at a corporate level.
The threat landscape
Cybercrime is projected to cost $10.5 trillion in 2025, outpacing cybersecurity investment by nearly 50x.1 Credit bureau Equifax provides an effective illustration of the increasing frequency of attacks: in 2024 it responded to more than 15 million cyber threats - that’s nearly 175 hostile attempts every second and a 25% increase from 2023.2 High-profile incidents continue to illustrate the scale of potential damage. In the UK, ransomware attacks in 2025 disrupted operations at major corporates, contributing to hundreds of millions in lost profit and remediation costs.
At the same time, many executives acknowledge that preparedness gaps remain. A survey of Chief Information Security Officers3 indicate that a majority expect a material attack within the next 12 months, yet a significant proportion feel underprepared to respond.
Widespread digitalisation means that every company is now a data company. As a result, the size of companies’ attack surfaces – the number of possible points where an unauthorised user can access a system and extract data – has increased. Additional factors that may also expand a company’s attack surfaces include:
- Extensive automation and the Internet of Things (IoT)4
- Greater reliance on cloud and hybrid infrastructure
- Increased dependence on third-party vendors
- More complex global supply chains
- Larger and more distributed workforces
- Ongoing M&A5 activity
Human error remains a leading cause of successful breaches, but supply chain vulnerabilities are becoming equally significant. For acquisitive companies in particular, inadequate integration of cybersecurity due diligence can introduce hidden risks.
Game-changing new technologies
AI is reshaping cybersecurity. On one hand, generative AI (GenAI) lowers the barrier to entry for attackers. Phishing campaigns are more convincing, vulnerability scanning can be automated at scale, and malicious activity can be deployed with greater speed and sophistication. On the other hand, AI-enabled defences can significantly reduce the time required to detect and respond to threats. Research suggests that organisations using AI within their cybersecurity defences experience lower average breach costs and faster containment.6 However in our view, companies must also consider the additional security requirements of AI tools, as research identified AI-related vulnerabilities as the fastest-growing cyber risk in 2025.7
Quantum computing presents a longer dated but potentially transformative threat. The prospect of “harvest now, decrypt later” attacks – in which encrypted data is stolen today to be decrypted in future – introduces risk to sensitive data with long shelf lives, including financial records, intellectual property and health information. However, defences are already in development. In 2024 the U.S. National Institute of Standards and Technology (NIST) released its first Post-Quantum Cryptography (PQC) standards and U.S. cyber agencies are already urging organisations to start quantum readiness work. Given that cryptographic transitions historically take many years, we believe early preparation for post-quantum cryptography is prudent, particularly for companies holding long-duration sensitive data.
Proprietary cybersecurity assessment framework
To evaluate cybersecurity in a structured and comparable way, we developed a proprietary assessment framework. The framework assesses positive and negative indicators across six pillars:
1. Governance: In our view, best practice includes cybersecurity oversight at board level, directors with relevant expertise, and clearly defined accountability. We believe cybersecurity must be embedded within enterprise risk management, not treated as a siloed IT function.
2. Resources, Training and Culture: Technology alone is insufficient. In line with our framework, a mature approach includes specialist teams, phishing simulations – with retraining for employees that fail, and a corporate culture built on cyber awareness.
3. Third-Party and M&A Risk: Within our framework, we focus on evidence of a resilient ecosystem, including supply chain due diligence, contractual safeguards, and the integration of cybersecurity analysis into acquisition decisions.
4. Processes and Controls: Positive indicators include alignment with recognised frameworks, as well as signs of controls such as identity and access management, endpoint detection and response, and threat and vulnerability management. AI-enabled defences and awareness and early planning for post-quantum cryptographic standards are also positives.
5. Response Preparedness: The speed of containment often determines financial impact. Our framework considers whether companies conduct regular incident response testing, executive-level simulations and scenario planning.
6. External Assurance: We look for independent audits, certifications (such as ISO 270018), cyber insurance and transparent quantitative disclosure, which provide additional validation of internal controls.
In 2025 we engaged with 10 companies in our portfolios that we deem to be more in the frontline of cybersecurity risk. While a material cyber attack can never be ruled out, our view is that these companies are generally managing the risk appropriately. Examples of best practice include:
- Deployment of AI-enabled defences, significantly reducing the mean time to detect and respond to incidents.
- Termination of vendor relationships and even rejection of acquisitions when cybersecurity standards fell short.
- Adoption of a dual-sourcing strategy to build supply chain resilience.
- Implementation of controls to limit the “blast radius” of an attack, for example through network segmentation and multi-factor authentication.
- Learnings from previous incidents, demonstrating a culture of continuous improvement.
- Obtainment of independent assurance of controls (e.g. with ISO 27001)
- Disclosure of quantitative metrics to improve investor transparency.
- Early-stage performance testing of Post-Quantum Cryptography standards.
Investment implication: risks and opportunities
The accelerating threat environment is driving structural growth in cybersecurity spending. Industry forecasts project global cybersecurity expenditure to exceed $200 billion in 2025 and continue expanding at double-digit rates.9 A survey of corporate CIOs indicated that cybersecurity budgets are increasing faster than overall software spend.10
This environment creates both risk and opportunity. From a risk perspective, companies that underinvest in cybersecurity defences face greater risk of a financially material attack. From an opportunity perspective, scaled cybersecurity providers and platforms embedded within enterprise ecosystems may benefit from sustained demand growth.
Within our portfolios, we hold companies with significant cybersecurity exposure, including:
- Microsoft, which operates the largest cybersecurity business in the world, worth an estimated $30 billion, having more than doubled in the last three years.11
- Visa, which is leveraging its expertise in payments security and fraud prevention to provide cybersecurity advisory services to clients.
- Alphabet, which is poised to deepen its exposure to cybersecurity through its pending $32 billion acquisition of Wiz, a leading cloud security platform.
- Experian, whose identity verification and fraud prevention solutions helped businesses worldwide avoid an estimated $19 billion in fraud losses.12
Cold comfort reality
No cybersecurity system can guarantee complete protection. However, in our view, the distinction between companies that are prepared, and those that are not, is becoming increasingly consequential. Cyber resilience is both a defensive necessity and a potential competitive advantage. Companies that embed strong governance, invest in advanced defensive capabilities and proactively adapt to technological change are, in our view, better positioned to protect their operations and shareholder value.
Featured Insights
