By Joseph Lau, Chief Information Security Officer at Portage
Here’s a riddle: How is a successful company like a boat?
In lots of different ways, it turns out. But maybe most importantly, bringing two together—two boats or two businesses—is a complex process with many opportunities for mutual benefit and a big risk of catastrophic collision. Companies undertaking mergers and acquisitions have to navigate narrow channels and choppy waters, where potential showstoppers and red flags lurk just beneath the surface (Insert Jaws theme music).
I recently co-hosted a webinar with Alex Manea, CISO at Georgian, about how startups can assure smooth sailing through the M&A process. One of our speakers, Ron Park—an operating advisor for Georgian, and an ex-CTO and CIO—made this comparison: “Imagine a speed boat that gets acquired by a gigantic supertanker that’s very powerful but doesn't turn very quickly. How is that speed boat supposed to integrate? How do we make sure we don’t crush the speedboat, allow it to stay agile and zippy, able to make changes very quickly and adapt and innovate?”
Our other speaker, Peter Minev, CTO of the digital insurance broker CLARK, was in total agreement. “These are inherently very complex deals,” Peter said, “specifically when talking about cybersecurity and technology. There are data considerations: Cloud, culture, unification, technology stacks.” The list goes on.
Between the two of them, Ron and Peter have a long record of overseeing successful M&A transactions, so it was a really interesting conversation with some great takeaways.
It’s commonly said that growth is like oxygen for startups. With the market shifting rapidly, M&As are an increasingly attractive way to achieve that growth. But startups are also vulnerable, especially where cybersecurity is concerned, and particularly when trying to navigate a complicated merger process. In fact, those working on M&As should be especially vigilant, given the recent rise of hacking groups specifically targeting them.
Here are a few things to keep in mind when considering how to approach a potential M&A, whether you’re the speedboat or the supertanker.
1. Don’t skip the technical due diligence!
M&As often come together in a hurry, and there are many factors to consider when evaluating a potential deal. It can be tempting to treat tech and cybersecurity diligence as a “nice-to-have,” secondary to the financial and legal assessments. But skipping these steps can come back to bite an acquiring company.
Ron recounted one story about overseeing the acquisition of a founder-led Software as a Service (SaaS) company. This SaaS company had excellent financials, Ron said, so the acquisitioning team performed a light—and hurried—tech diligence to keep up with the pace of the deal. But then, just before the transaction closed, the company suffered a cyber breach, triggering a huge panic among investors. “All hell broke loose,” Ron recalled. Finally, after months of lawyers, insurance agents, forensics experts and auditors combing through the IT department, and after a second round of diligence focused on cybersecurity, the acquisition moved forward. Luckily there had been no data loss. “It could have been much worse,” Ron said. But this was a painful lesson.
Research shows that data breaches can reduce the value of a company significantly. And if an early stage fintech company suffers a data loss, the impact can be catastrophic and an existential threat. Tech and cybersecurity have to be at the top of the list when evaluating M&A prospects—not just nice to have, but necessary.
2. To maximize innovation, integrate teams and technology with care
Businesses and boats both come in a wide range of shapes and sizes, each with their own technological needs and special capacities—some can carry heavy loads, while others move quickly or cover long distances. An established company with a strong legacy risks overwhelming a more agile startup, just like a big ship risks capsizing a smaller boat traveling in its wake. But careful integration can let the startup do what it does best—and help the acquiring company reap the benefits.
“The reality is, especially as our companies scale and we have to put in place more systems and processes internally, it can be harder to innovate,” Alex said. “Sometimes the best way to innovate is simply by acquiring a company that has already innovated in a space that we really want to focus on.” But that means the proverbial supertanker needs to appreciate the speedboat for what it is, and understand what it can and can’t do.
During the webinar, Peter drew a comparison to the automotive industry, where he worked for a number of years in the early 2000s. An auto company is all about quality control — “one defect might kill families,” Peter reminded us. But applying that standard to a gaming company, for instance, results in delayed releases, expensive products and less agile product development. So, it’s not one size fits all.
When approaching a merger or acquisition, respecting the differences between companies can help you clarify your investment hypothesis and keep your eye on the prize: What value will be added to each company in the long run? Whether it be new or expanded product capabilities, technical capacities or talent, a clear investment hypothesis can shape the M&A process: If you’re hoping to expand technological or production capacities, for instance, diligence around those issues becomes much more important. And, Ron said, getting on the same page with everyone involved matters more than you’d think. “Why are we doing it? What do we expect to get from it across all the different functions? Some sort of roadmap is key.”
But don’t get too bogged down in technical differences that might just be a feature of each company’s scale and specialty, rather than particularly relevant to the planned merger. Of course, integrating different tech platforms can definitely be challenging; at a certain point, technological redundancies kept Ron up at night. “I used to run around, pulling my hair out over having three or four of everything,” he said. But at a certain size and scale, he says, concerns about initial technical alignment aren’t worth passing up a potentially valuable synergy. “I think we’ve got to embrace the idea that it’s a polyglot world.” Integration and assimilation can happen over time, either organically or if necessary, being volun-told.
3. “Culture eats strategy for breakfast”
Without people, neither boats nor businesses can run; leadership and culture are the magic ingredients that turn a mass of metal and fuel—or computers and code—into a moving enterprise. And when two successful companies merge, clashing cultures can kick up big waves that may be difficult to navigate.
Culture is super important—we all know that saying, “culture eats strategy for breakfast.” But it’s often the weak link in tech companies’ growth. “90% of the time we interview for technical skills, and we don’t check for culture,” Peter acknowledged. And the same goes for M&A diligence: companies neglect cultural affinity in favor of a technical checklist. And while companies with different cultures can and do integrate successfully, not thinking ahead about how cultures will mesh is a recipe for disaster. “It’s important to know what your red line is,” Peter said. “Beyond the red line, there’s no compromising. But everything up to this red line is okay, and we can find a way to handle it after the deal.”
It’s important to respect the internal cultural dynamics, too and to handle the post-merger integration with care. One key thing is to avoid hasty changes and merging of organizations that might disrupt good working relationships that have developed over time. “If you prematurely merge all the teams and make all these changes, it might result in chaos and attrition,” Peter said. “We are very careful there.”
Conclusion
M&As are exciting opportunities for growth and expansion, with each party providing something that the other needs. However, no one is saying M&A deals are easy. While hindsight is 20/20, it’s not always possible, at the outset, to anticipate what problems might arise. “These days, every one of us can say what the captain and the crew of the Titanic had to do to avoid crashing into the iceberg,” Peter reminded us, but when that boat sank, it was an unforeseeable disaster. But thorough technology and cybersecurity diligence can help companies spot the icebergs coming a mile away, and thoughtful integrations can make sure that supertanker companies and speedboat startups don’t crash into each other as they figure out how to sail in tandem.
A good M&A deal plays to each company’s strengths. Startups retain their speed and agility, allowing them to access new markets like speedboats zipping off to undiscovered islands. Meanwhile, the mothership company lends strength, fuel, and stability out at sea — and reaps the benefits of the speedboat’s exploration.
The views and opinions expressed herein are the views and opinions of the author and do not necessarily reflect those of Nasdaq, Inc.