01Ownership record
Before close
Separate management claims from observed evidence. Preserve material exposure, stale proof, open incidents, and the unknowns that still need an owner.
Private equity
Know the cyber risk you are buying. Prove whether post-close work changed it.
VitalSec gives deal teams and operating partners a continuous security history from diligence through ownership: what was actually observed before close, the Day 0 baseline, what changed by Day 30 and Day 100, and which problems repeat across the portfolio.
Before close
What is known, what is claimed, what is still unknown
Day 0
Seal the ownership baseline
Day 30 / 100
Measure whether the plan changed the security state
Portfolio
Find recurring exposure and concentrate operating attention
Private equity portfolio operations
Make cyber diligence useful after the deal closes.
VitalSec turns diligence into an ownership record. The deal team sees what the evidence supported before close; the operating team inherits a sealed Day 0 baseline; later reviews show whether the work actually changed security state across the portfolio.
02Ownership record
Day 0
Seal the security state at ownership so the starting point cannot be rewritten later.
03Ownership record
Day 30 / Day 100
Compare remediation, retests, incidents, evidence freshness, and exposure with the Day 0 baseline. Show what actually moved.
04Ownership record
Hold / renewal / exit
Keep the record alive for portfolio reviews, cyber insurance, operating-partner decisions, and later diligence instead of rebuilding the story from memory.
Investment committee → operating review
The evidence should survive the meeting.
The people approving the investment and the people responsible for post-close improvement should be able to work from the same security record — what was known, what remained uncertain, what management committed to change, and what the evidence later proved.
The Day 0 baseline
Value creation is a delta, not a completed-project list.
A sponsor can spend heavily on cyber and still be unable to show whether a company became safer. A sealed Day 0 turns post-close work into measurable change.
Before ownership
Claims, evidence, unknowns.
Preserve what management represented, what available evidence actually supported, and what could not yet be verified.
Baseline
DAY 0
Under ownership
Change, retest, proof.
Compare later state with the baseline and keep the evidence showing whether remediation, controls, incidents, and exposure actually moved.
What was true at close
What management committed to fix
What changed by Day 30 and Day 100
What remains materially exposed
What can be proven at renewal or exit
Portfolio operating view
Standardize the measurement. Do not force every company onto the same stack.
Portfolio companies can keep different security tools and operating models. VitalSec gives the sponsor a consistent view of evidence, exposure, control state, and change without taking over each company's security environment.
Where is the urgent exposure?
Which companies have active critical or high vulnerabilities, open incidents, failed tests, or aging remediation right now?
What keeps repeating?
Which CVEs, missing controls, or dependencies are appearing across multiple companies and deserve sponsor-level attention?
Did the 100-day plan work?
What changed from the sealed Day 0 baseline through Day 30, Day 100, and the current operating state?
Where is proof weak?
Which companies look acceptable on paper but have stale, missing, or incomplete supporting evidence?
Where should the sponsor focus?
Which companies are deteriorating, carrying older material exposure, or accumulating the same control gaps as peers?
Who is heading into renewal exposed?
Which companies have upcoming insurance renewals while important evidence or security work remains unresolved?
Sponsor authority boundary
Portfolio visibility does not give the sponsor blanket remediation authority inside a portfolio company. VitalSec keeps sponsor-level comparison and evidence access separate from the identities, approvals, and authority required to change a company's systems.
The record that survives the deal
Diligence → Day 0 → operating improvement → insurance → exit, with the supporting evidence kept attached.
01Observe02Decide03Act04Validate05Prove06Measure
Private equity view
See where ownership needs to intervene, then prove whether the intervention worked.
Diligence evidence
Keep management claims and observed evidence separate, then carry the useful history into ownership instead of starting over after close.
Day 0 and milestone comparison
Compare Day 30, Day 100, and current evidence with a known starting point so improvement is measurable.
Portfolio concentration
Find recurring CVEs and missing or unknown controls affecting multiple companies and endpoints.
Current portfolio view
Compare vulnerabilities, control-test results, incidents, evidence freshness, endpoint coverage, insurance renewal timing, and risk direction across the portfolio.
Ownership cycle
Know what you are buying. Set the baseline. Prove what improved after close.
Use the same evidence to support the investment decision, establish Day 0, focus the 100-day plan, and show whether the companies that needed security work actually improved.
PHASE 01
Before close
Separate what management says from what the available evidence supports, preserve important unknowns, and give the deal team a clear security view before the investment decision.
PHASE 02
Day 0, Day 30, Day 100
Lock the starting point at Day 0, then compare later reviews with what was actually true when ownership began.
PHASE 03
Run the portfolio
See where critical exposure, stale evidence, failed control tests, open incidents, renewal pressure, recurring CVEs, or missing controls are concentrated across companies.
Research & white papers
Related research
Selected PatientLock papers on the issues covered here.
White paper
Which Portfolio Companies Need Attention First?
A private equity approach to prioritizing cyber work across unlike portfolio companies using current state, evidence quality, risk direction, and material business context.
Central argument
A sponsor does not need one security stack across the portfolio. It needs a consistent way to see which companies are deteriorating, which measurements are weak, and where executive attention, capital, or specialist help can change the outcome.
Written for: Private equity operating partners, portfolio operations leaders, CROs, and portfolio-company executives.
White paper
Cyber Diligence from Investment Committee to Day 100
A practical evidence model for moving cyber diligence from pre-close claims and unknowns into Day 0 baselining, prioritized intervention, and measurable post-close progress.
Central argument
Cyber diligence is most useful when pre-close uncertainty is explicit, Day 0 establishes an observed baseline, and the first 100 days measure whether priority interventions actually changed operating state.
Written for: Private equity deal teams, operating partners, portfolio-company executives, and risk leaders.
White paper
Measuring Cyber Improvement After Acquisition
How sponsors can show what actually improved after close, which interventions changed the environment, and whether those gains lasted rather than ending with project completion.
Central argument
Post-close cybersecurity improvement should be judged against the inherited Day 0 baseline and tied to specific interventions, verified changes in security state, and whether those gains last through the ownership period.
Written for: Private equity operating partners, portfolio-company CEOs and CISOs, boards, and value-creation teams.
White paper
Scaling Cybersecurity Across the Portfolio
Where shared services, procurement, expert capacity, minimum evidence standards, and repeatable remediation can improve cyber operations while each company keeps control of its own environment.
Central argument
Private equity can improve cyber operations across a portfolio through shared expertise, procurement, evidence standards, and repeatable remediation without forcing every company onto one security stack or taking over local administration.
Written for: Private equity operating partners, portfolio technology leaders, procurement teams, and portfolio-company executives.
Talk to Jim
Talk through it with Jim.
Talk to Jim about VitalSec for private equity: diligence evidence, transaction risk, Day 0, Day 30 and Day 100 reviews, recurring exposure across companies, 100-day execution, insurance readiness, and measurable post-close improvement across different security stacks.
Jim is based on PatientLock founder and CEO Jim Ford.