FTI Consulting Study Reveals Cybersecurity Attacks Are an Increasing Threat to M&A
MWN-AI** Summary
FTI Consulting, Inc. has released a critical study titled "CISO Redefined III: Navigating Cybersecurity Risks in Transactions," revealing a troubling trend in the correlation between cybersecurity incidents and mergers and acquisitions (M&A). The survey, which included responses from 100 Chief Information Security Officers (CISOs), 78 heads of M&A, and 100 general counsel across sizable U.S.-based companies, found that nearly one in four executives experienced a cyber incident during or shortly after a transaction. The repercussions of these incidents are significant, with 42% of respondents reporting a reduction in deal value, and 58% noting that financial targets were impaired.
Meredith Griffanti, head of FTI's Cybersecurity and Data Privacy Communications practice, highlighted that threat actors target companies during vulnerable periods of integration, amplifying the risks associated with rapid transactions. Alarmingly, the study revealed a disconnect between the CISOs and corporate leadership, with 34% of CISOs lacking clear authority over whether to halt a deal due to cyber risks. Furthermore, only 17% reported that collaboration between cybersecurity teams and corporate development significantly increased during deal negotiations.
The study emphasizes the urgent need for enhanced communication regarding cyber risk management within the corporate structure. It underscores the importance of considering cybersecurity in the same light as other risks, such as leak risk, during transactions. As FTI Consulting's Pat Tucker noted, recognizing transactions as prime targets for cyber threats is vital to safeguarding deal value and reducing the probability of disruption. Overall, the findings illustrate the necessity for organizations to prioritize cybersecurity during both the pre-and post-acquisition phases to mitigate potential threats effectively.
MWN-AI** Analysis
The findings from FTI Consulting's "CISO Redefined III" report underscore an urgent need for increased attention to cybersecurity risks in the M&A landscape. With nearly one in four executives experiencing cyber incidents during transactions, and 42% witnessing a significant reduction in deal value, it is imperative for companies to adopt a proactive cybersecurity strategy.
As cyber threats continue to evolve, vulnerability peaks during transactional changes, making firms attractive targets for adversaries. The report highlights a critical disconnect in organizational communication regarding cybersecurity; while a vast majority of heads of M&A and general counsel acknowledge the importance of the Chief Information Security Officer (CISO), many CISOs still feel sidelined in strategic discussions. This can lead to insufficient cybersecurity due diligence, jeopardizing both the deal and the organization's reputation.
Investors should be wary of companies that insufficiently integrate cybersecurity into their transaction workflows. A lack of collaboration between cybersecurity and corporate development teams may signal broader risks that could affect performance post-acquisition. Organizations must prioritize aligning cybersecurity efforts with transaction strategies, ensuring that cyber risk is treated with the same urgency as financial risk.
Additionally, firms should enhance their post-close vigilance; only 23% of executives currently manage cybersecurity risks proactively in this phase, leaving a considerable gap in defense against potential breaches. This lapse can lead to unforeseen costs and operational disruptions.
In light of these findings, companies engaged in or contemplating M&A must reassess their preparedness for cyber threats. Proactive measures—ranging from diligent risk assessments, enhanced CISO involvement, to robust cross-functional collaboration—are essential for safeguarding deal value and maintaining stakeholder trust. Investors should closely evaluate how organizations address these challenges, as robust cybersecurity practices will likely enhance overall stability and long-term value creation.
**MWN-AI Summary and Analysis is based on asking OpenAI to summarize and analyze this news release.
WASHINGTON, March 17, 2026 (GLOBE NEWSWIRE) -- FTI Consulting, Inc.’s (NYSE: FCN) Cybersecurity and Data Privacy Communications practice today released the third installment of its “CISO Redefined” series, CISO Redefined III: Navigating Cybersecurity Risks in Transactions, which looks at the increasing correlation between cybersecurity incidents and corporate transactions.
According to the findings, nearly 1 in 4 executives has experienced a cyber incident during or shortly after a transaction, with nearly half of respondents (42%) experiencing significant deal value reduction. More than half (58%) said financial targets were impaired, while 20% said their deals were either delayed or paused due to a cyber incident.
“Threat actors are smart; they read the news and know companies tend to be vulnerable when they’re trying to close or right after when they’re integrating systems — and that’s when they try to break in,” said Meredith Griffanti, Global Head of the Cybersecurity and Data Privacy Communications practice at FTI Consulting. “The incident ends up costing the acquirer big time, and most often, the target and acquirer haven’t even begun to think about how to integrate their security plans, let alone how they’ll work together to respond to a cyber crisis if it occurs right after a deal closes. That lack of coordination can have serious blowback on reputation.”
According to CISO Redefined II, which was released in 2024, the vast majority of CISOs feel their role is misunderstood by company leadership, and they struggle to communicate in a non-technical way that other executives can understand. This sentiment explains the results of the latest survey, which show that the CISO’s voice and opinions — and therefore cyber risk — are not being prioritized.
Going further, 67% of heads of M&A and 76% of general counsel said the CISO is very critical during a transaction. However, 34% of CISOs said they are not heavily involved in contributing to decisions when executing transactions, and 1 in 3 CISOs do not believe they have the authority or are unsure of whether they can stop a transaction if cybersecurity risks are too high.
Other key findings:
- One in 4 CISOs say their leaders push to close deals quickly over conducting thorough cybersecurity due diligence.
- Only 17% of CISOs said that collaboration between cybersecurity and corporate development teams significantly increased during the transaction period. By contrast, 34% of general counsel felt collaboration significantly increased — showing a notable disconnect.
- Only 23% of executives say they manage cybersecurity risks proactively post-close. This decline in vigilance creates a meaningful exposure point for the organization, which coincides with when attacks tend to occur.
“Deal teams need to account for cyber risk much the same way we think about leak risk. These unexpected disruptions can create confusion, shift value and slow negotiations,” said Pat Tucker, Americas Head of M&A and Activism at FTI Consulting. “It is essential that dealmakers recognize that transactions are increasingly becoming highly visible targets for threat actors. If deal value is going to be successfully realized, this risk needs to be mitigated more effectively.”
Survey Methodology
FTI Consulting surveyed 100 CISOs, 78 heads of M&A, and 100 general counsel across U.S.-based public and private organizations with at least 500 employees, representing a majority of companies with a market cap of $5 billion or more, to understand how key leaders collaborate with each other and weigh cybersecurity priorities during and after M&A deals. The survey was conducted online between August 12-26, 2025. For questions on the methodology, please contact James.Condon@fticonsulting.com.
About FTI Consulting
FTI Consulting, Inc. is a leading global expert firm for organizations facing crisis and transformation, with more than 8,100 employees located in 32 countries and territories as of December 31, 2025. In certain jurisdictions, FTI Consulting’s services are provided through distinct legal entities that are separately capitalized and independently managed. The Company generated $3.80 billion in revenues during fiscal year 2025. More information can be found at www.fticonsulting.com.
FTI Consulting, Inc.
555 12th Street NW
Washington, DC 20004
+1.202.312.9100
Investor Contact:
Mollie Hawkes
+1.617.747.1791
mollie.hawkes@fticonsulting.com
Media Contact:
Nick Emmons
+1.617.510.1676
nick.emmons@fticonsulting.com
FAQ**
How does FTI Consulting Inc. FCN plan to address the disconnect between CISOs and corporate leadership regarding cybersecurity prioritization during transactions?
Given the findings from “CISO Redefined III,” what steps is FTI Consulting Inc. FCN taking to enhance collaboration between cybersecurity and corporate development teams during M&A transactions?
What recommendations does FTI Consulting Inc. FCN provide to executives to effectively manage and mitigate cybersecurity risks during corporate transactions?
How does FTI Consulting Inc. FCN intend to strengthen the role of CISOs in the decision-making process during M&A deals to reduce cyber incident risks?
**MWN-AI FAQ is based on asking OpenAI questions about FTI Consulting Inc. (NYSE: FCN).
NASDAQ: FCN
FCN Trading
1.02% G/L:
$181.68 Last:
133,485 Volume:
$179.19 Open:
