Buying a cybersecurity services firm in Canada

Much of the value of a security firm may sit in client relationships, trained analysts, detection content the firm has written and a record of how past incidents were handled, rather than in equipment. Three questions follow. Can the team deliver without the seller? Are the promises made to clients ones I can keep? And is there anything about me, as the new owner, that changes how the firm may operate? The sections below are organized around those three questions.

Signs of a healthier firm, and of a weaker one

A healthier firm may have monitoring or retainer agreements that have renewed more than once, work led by several named people rather than one, clients spread across industries so that one sector’s bad year does not strand it, delivery that follows written playbooks a new analyst could pick up, and staff who are employed rather than engaged through personal-service arrangements. A weaker one may have a founder who personally answers every escalation, a client list dominated by two or three large accounts, and revenue that is mostly resold software with a thin service layer on top. Neither is wrong to buy, but the second is a different bet. The glossary entry on key-person risk explains the risk of depending on one person.

What a seller may not volunteer

A seller may present the firm at its best, so a buyer should ask about facts that may be uncomfortable to raise unprompted. These are questions worth asking.

• Whether any client suffered an incident while the firm was monitoring or advising it, how that client reacted, and whether the relationship ended.
• Which clients left in recent years and why, as distinct from clients who simply finished a project.
• How much of reported revenue is resold software and hardware at a thin margin, and how much is the firm’s own labour.
• Which analysts have outside offers, have given notice or are on contracts that expire soon.
• Whether the firm has ever had to notify a regulator or clients of a breach of its own, and where that is recorded.

What you need to bring to the deal

Some constraints sit with the buyer rather than the firm. A non-Canadian buyer should know that the Investment Canada Act lets the government review foreign investments of any size on national security grounds, and that the federal department describes the concern as foreign actors attempting to gain ownership or control of sensitive Canadian goods, technology, infrastructure or personal data. A security firm whose staff have privileged access to client networks is the kind of business where that question deserves early advice. A buyer who plans to fold the firm into an existing business will also need to work out how client data will be kept separate. In Ontario, the Province licenses private investigators and the agencies that sell their services, and whether any of a particular firm’s investigative or forensic work engages that regime is a legal question about the specific services offered, one to put to counsel rather than assume either way.

Keeping the analysts

Because the team is the asset, the plan for keeping it matters before the offer, not after. First, check how each analyst is engaged. The CRA says that, generally, an employee works under the direction and control of the individual or business who hired them under a contract of service, while a self-employed worker enters into a contract for services, and that all of the facts, including the actual terms and conditions of employment, determine a worker’s status, not just the intention. Employment law also sets what a buyer can lock in. In Ontario, the Employment Standards Act, 2000 generally prohibits an employer from entering a non-compete agreement with an employee, with exceptions that include an agreement made as part of a sale of a business where the seller becomes the purchaser’s employee immediately after the sale, and employees who are executives as the Act defines them. An analyst who is neither is covered by the prohibition. Beyond that, ask what each analyst would need to stay, such as pay or role, and note that a purchase agreement can tie part of the price to people staying. Other provinces have their own rules, so check the one where each analyst works, and note that Ontario and British Columbia have continuity rules for staff on a sale, and that Quebec’s CNESST publishes guidance on the sale of a company, all of which can affect what a buyer inherits.

What kind of buyer you are

A buyer that already runs a cybersecurity firm or a managed service practice, an investment platform buying specialist firms and an individual with technical skills but no existing firm will face different questions. An individual buyer with no existing firm will need to hold clients and staff at the same time. Knowing which kind of buyer you are shapes which of the questions above you need to settle first.