PatientLock
Research & white papers
PatientLock Research · 2026 Edition

Which Portfolio Companies Need Attention First?

Private equity does not need every portfolio company to run the same security stack. It needs a reliable way to identify which companies need attention now, why they need it, and where intervention is most likely to change the outcome.

Paper context

Author
PatientLock Research
Edition
2026
Audience
Private equity operating partners, portfolio operations leaders, CROs, and portfolio-company executives
Sections
5

Central argument

A sponsor does not need one security stack across the portfolio. It needs a consistent way to see which companies are deteriorating, which measurements are weak, and where executive attention, capital, or specialist help can change the outcome.

Definitions

Terms used in this paper

These definitions establish how the paper uses its core terms before the argument begins.

Portfolio comparability
Comparing unlike companies through common outcome and evidence definitions rather than requiring identical security products.
Tenant isolation
Technical and authorization separation preventing one portfolio company or sponsor view from becoming operating access to another company's environment.
RCI
Risk Compression Index, VitalSec's current 0–100 operational control-state index when sufficient evidence is available.
Risk trajectory
The direction and persistence of modeled risk movement over time rather than a single point-in-time grade.
01

1. Portfolio review should answer a prioritization question

A sponsor can collect dozens of cyber reports and still struggle to answer a basic operating question: which companies need attention first? Tool inventories do not solve that problem because the companies use different endpoint, identity, cloud, network, backup, and vulnerability systems.

The comparison has to move up one level. Look at current control state, material exposure, evidence quality, remediation progress, and risk direction. Those measures can be compared even when the underlying products are different.

The point of portfolio comparison is not to rank management teams. It is to direct attention where it can change the result.
02

2. Weak measurement and weak security are not the same condition

A company with current, complete evidence may expose more problems than a company that barely reports. The first company should not be penalized for being observable. Portfolio review needs to carry evidence coverage and freshness beside the operating result.

That distinction produces three useful categories: a company with a known material problem, a company whose state is improving or deteriorating with good evidence, and a company where the evidence is too weak to support a confident conclusion. Each requires a different response.

Different evidence conditions require different responses.
Portfolio triage

Read control state together with evidence coverage, freshness, and direction.

  • Direct attention

    Known material problem

    Discuss the exposure and the intervention needed.

  • Review direction

    Supported trend

    Review whether improvement persists or deterioration requires action.

  • Investigate uncertainty

    Weak evidence

    Restore visibility before drawing a confident conclusion.

These are review paths, not numerical rankings. Business context and each company’s authority stay attached to the decision.

03

3. Direction matters more than a single portfolio snapshot

Two companies can have the same current Risk Compression Index and be moving in opposite directions. One may be closing material exposure and restoring controls. The other may be accumulating exceptions, stale proof, and unresolved findings.

That is why portfolio triage should include the direction and persistence of change. A company that is deteriorating deserves a different conversation from a company at the same current level that is steadily improving.

04

4. Local business context stays attached to the signal

A common measurement language does not make the companies identical. A failed control on an internet-facing clinical service can matter differently from the same failure on an isolated internal system. Recovery requirements, customer obligations, regulatory exposure, and operational dependence also differ by company.

The sponsor-level view should make comparison possible, then let the operating partner drill into the company-specific reason behind the signal. That preserves materiality instead of flattening it.

05

5. Triage should lead to a concrete operating decision

A useful portfolio review ends with decisions: send specialist help to one company, accelerate an identity project at another, challenge stale evidence at a third, or leave a stable company alone. Capital and executive attention are scarce; the measurement should help allocate both.

VitalSec supports that operating model without giving the sponsor administrative control of every company. Each company keeps its own authority and evidence boundary while the sponsor sees the comparable signals it is authorized to review.

Evidence base

Sources and notes

External foundations are kept distinct from VitalSec implementation notes so readers can see what supports the argument independently and what documents the platform implementation.

External foundations and sources

  1. 01NIST IR 8286 Rev. 1 — Integrating Cybersecurity and Enterprise Risk Management
  2. 02NIST IR 8286A Rev. 1 — Identifying and Estimating Cybersecurity Risk
  3. 03NIST SP 800-137 — Information Security Continuous Monitoring

VitalSec implementation notes

These links document how the argument is implemented or described inside VitalSec. They are not offered as independent validation of the paper's thesis.

  1. 01VitalSec for Private Equity
  2. 02VitalSec field guide