Our 2016 Private Equity CTO Survey is packed with insights across four primary areas: business priorities, cybersecurity, outsourcing trends and the evolution of the private equity CTO. These findings include:
70% of PE firms report their organizations have experienced 3 or more cybersecurity issues in the past 12 months
Nearly 90% of respondents identified cloud computing as a planned investment area, with respondents preferring private cloud solutions over the public cloud.
93% of survey respondents believe their firm’s CTO or top IT executive is becoming more important to their business
Checkout out our infographic (below) for a picture of our findings and download the full report here: www.eci.com/pesurvey.
The tide is changing for private equity firms. They continue to grow in popularity – some say private equity is the new hedge fund – but with increased interest comes amplified speculation and heightened expectations.
In technology, private equity firms have found a fierce enabler for continued growth, and one that has shone the light on organizational benefits to be had far beyond the IT closet.
Eze Castle Integration commissioned its Private Equity CTO Survey to more closely examine the evolution of the private equity industry as driven by – and driven to – technology. In reaching the top IT executives and chief technology officers (CTOs) at these firms, the survey highlights their priorities, successes and even failures, and in doing so, sheds light on this industry that has risen to the forefront of the greater financial community.
Our Private Equity CTO Survey encompasses four primary sections: business priorities, cybersecurity, outsourcing trends and the evolution of the private equity CTO.
If one thing is to be derived from the advent of information technology, it is that IT enablement extends well beyond the recesses of the Communications Room. Accordingly, technology decision-making is also impacted by an organization’s business objectives, and the two work in alignment to derive achievements across the firm. In this section of the survey, we’ll highlight areas where business goals have impacted IT budgets and where private equity firms plan to focus their attention in the coming year.
Due to changes in the cyber security landscape, traditional firewalls on the port level are no longer effective at managing traffic. Malicious traffic has the capacity to enter any open port, which provides great risk to firm security. Next-generation firewalls work further than port-based firewalls by adding application inspection and intrusion prevention. Next generation firewalls have the ability to scan traffic as it enters and leaves the network, therefore stopping potential threats.
Eze Castle Integration is increasingly implementing Palo Alto next-gen firewalls for our hedge fund and alternative investment firm clients. Palo Alto is not only a next generation firewall but it is also the market leader based upon ratings, support, pricing and overall performance. A Palo Alto firewall has the ability to detect what traffic is doing and immediately stop threats from spreading by distributing protection.
Unknown traffic is analyzed by Palo Alto Wildfire, where new threats are identified and protections are simultaneously developed. Upon the discovery of an unknown threat, the threat is not only blocked but updates are sent to all global subscribers within five minutes to be able to stop them from spreading. Due to this feature each threat and its variants are blocked without having to go through the analysis process again. Through Wildfire information is also fed through a filter which allows for automatic blocking of any correlated threats.
Older port-based models do not detect what traffic is doing, therefore allowing threats to port hop until they find an open port in which they can enter. Viruses are not port specific and can therefore utilize any port. Without analyzing what traffic is doing threats can easily bypass a port-based model.
The current threat landscape is such that security threats are more likely to arise from within your network as opposed to external sources. Internal users opening malicious emails or becoming victims of phishing schemes are now preferred methods for attackers. The next generation capabilities of the Palo Alto firewalls allow for deep application level inspection to detect and thwart these threats from opening backdoors to your network.
Additional Advantages of Next Generation Firewalls
All-in-one functionality: Next-generation firewalls bundle traditional firewall functionality with intrusion prevention, antivirus and protocol filtering.
On occasion, hedge fund C-level execs don’t see eye to eye. It’s inevitable. One such topic of occasional discord is outsourced IT. Chief technology officers (CTOs), for example, are immersed in every level of technology, from applications to security to disaster recovery, and they have a vested interest in concerns from user experience to business continuity and beyond.
Meanwhile, chief financial officers (CFOs) must focus on the bottom line, factoring in the cost-benefit of new technologies and projects. Elsewhere in the C-suite, the chief operating officer (COO) is looking at opportunity costs and asking key questions including if the CTO is managing day-to-day IT “plumbing,” which strategic projects are getting pushed aside?
Following is an excerpt from a whitepaper we recently published looking at various C-level perspectives on IT outsourcing – including where certain executives may differ on its value, where those same executives can agree, and ultimately why outsourcing IT and using the cloud sets alternative investment firms up for success. DOWNLOAD THE FULL PAPER HERE.
The cloud point-counterpoint
Based on investor comfort, the SEC’s increased scrutiny of cybersecurity practices and the impact of legislation like the Dodd-Frank Act, moving to private cloud services seems like a no-brainer. The cloud creates a far more cost-efficient and effective way for alternative investment firms to improve security and manage day-to-day IT demands. So why the conflict between CFOs/COOs and CTOs?
Total Control Comes with Risks
One reason for the conflict is that CTOs want to retain control, and understandably so. Outsourced security measures may seem opaque compared to the control they impart – it is tempting to believe that no third party could be as invested in system resiliency (i.e. disaster recovery) and security as the firm itself.
The reality is that most CTOs are so tasked for time and money that they cannot maintain complete control over their environments. The burden of ensuring continuous, reliable and secure operations is difficult even for large enterprises that have vast time and budgets and potentially unsurmountable for smaller teams. Often only the largest firms can adequately invest in and manage the layers of security necessary to defend against growing cybersecurity threats.
In seeking to retain control, CTOs are limiting their options. Embracing the idea of cloud-based services expands the CTO’s team, provides greater redundancies and enables more cost efficiencies. Most importantly, it lets the CTO focus on priority IT projects that enhance and improve the company’s bottom line.
CTO’s Role is Evolving
Procuring, maintaining, testing and upgrading adequate technology on-premise is out of reach for most alternative investment firms. It is also becoming an antiquated strategy. Today’s progressive CTOs are increasingly drawing on cloud technology to create agile firms that can quickly deliver the applications users require.
CFOs/COOs must recognize the valuable business knowledge and insights the CTO can insert into functions including risk management, product development, operations and innovation. CTOs must understand where they can deliver functional results and utilize the cloud as an IT-enabler for the firm.
As the CTO’s role evolves, so does the entire IT team. Too often in-house IT teams are allocating valuable time to reacting to IT issues and troubleshooting rather than proactively solving user issues or addressing regulatory mandates.
Outsourcing Has a Track Record
CFOs and COOs have the advantage of positive experiences with outsourcing. Many have used third-party providers for functions like payroll, accounting or even hiring, so it’s not surprising that they tend to be more comfortable with bringing in cloud service providers to deliver more efficiencies and dedicate focus to revenue-producing activities.
To wrap up and round out our 6-week Risk Outlook Webinar Series, we spoke with John Cotronis, Executive Director at JP Morgan, about hedge fund risk management and governance. Specifically, he addressed the following questions:
What have you observed in recent years in terms of changes affecting hedge funds – particularly at the startup phase?
Have you noticed a marked shift in the importance managers are placing on risk?
Do the firms you typically engage with have staff on hand to manage risk – compliance officers, etc.?
In terms of corporate governance, where do you see investment firms excelling when it comes to implementing risk management controls and also fostering a culture of risk management across the firm?
Let’s talk a little bit about counterparty risk. What kind of criteria are you looking for that indicates to you a provider has the right risk management framework and best practice structure to support your clients?
A lot has gotten tougher for firms, particularly on the investment side with capital raising, also with regulatory reporting, etc. What areas of operations do you think have gotten easier for hedge funds over the years?
What is your assessment of outsourcing risk – is it higher or lower than managing various functions in-house?
During Part 2 of our Risk Outlook Webinar Series we spoke with Eze Castle Integration Director Dan Long about how investment firms should address evolving cybersecurity risks, third party service provider oversight and employee training and education. Many of the points Dan addressed highlight questions hedge funds and private equity firms should be asking themselves.
Read on or scroll to the bottom to watch the full, 30-minute replay.
What is our commitment to cybersecurity and what is our outlook on the future?
Regulators and investors continue to ask more questions about cybersecurity because they want to know that firms are effectively mitigating risk. To meet these growing expectations, firms must demonstrate that you take cybersecurity risk seriously and have implemented sound systems, policies and procedures to combat those risks. As the threat landscape and technology continue to evolve, investment management firms need to evolve accordingly and develop better ways to counteract threats. Firms don’t necessarily need to implement every available security technology, but they should be keenly aware of their options and have a plan to effectively mitigate as much risk as possible.
How are we addressing third party risk and oversight?
Investment management firms often rely on third party vendors to obtain functionality or capabilities that they need, want or can’t afford to produce on their own. But moving functions out of the firm's control can present challenges. With any outsourced function, the firm inherently takes on additional risks at the hands of the third party. But it's critical for investment managers to limit those risks through sufficient due diligence. To combat vendor risk, financial firms need to maintain strict oversight of all third party relationships and investigate security practices and protocols, particularly for those vendors who have access to the firm's confidential information. An outsourced vendor should be providing the same level of security (or better!) as your firm would if the function was under in-house control.
Private equity firms have been slow to embrace outsourcing, but managing data and technology is more complex than ever. With increasing regulatory requirements and a growing urge to focus on core competencies, PE firms are shifting their views of the back office. In case you missed our recent webinar on 'The Transformation of Private Equity Operations', speakers from Citco Fund Services and Eze Castle Integration examined the changing tide for private equity operations and how CFOs, CTOs and fund managers alike can control operating costs, maximize efficiency and better perfect operational workflows.
Drivers for change.
The number one reason for managers to make the switch to an outsourced solution is the desire for managers to get back to their roots. The idea of back office transformation is really founded in that managers have found themselves spending much more time doing everything but raising money and investing money.
Beneath this layer, back office transformation is also driven by regulation, investor transparency, the lifecycle of a private equity firm, and global reach. Slow adoption, fast results. The private equity sector has been slow on the uptake when it comes to outsourcing, and we contribute this lag due to lack of education on the process and benefits of outsourcing. In the past three to five years, adoption in the PE space has increased because it is cost effective, secure and feature rich. Private equity firms that have made the switch wonder why others are not doing the same. The idea of leveraging an experienced managed service provider is one that private equity firms have really embraced because there is no burden for firms to hire and attract talent, which can be challenging and expensive.
Risk. Across the financial services industry, it’s a buzzword right now, and rightfully so. Perpetuated by mounting regulatory change, growing cybersecurity threats and a challenging market climate, the focus on risk is one that grows with each passing day.
As such, we are hosting a 6-week webinar series, Risk Outlook, wherein we’re interviewing industry experts on a host of risk-related topics. To kick off the series, last week we interviewed Mark Strachan, chief operating officer and compliance officer for BBL Commodities, a New York hedge fund. Read on for a recap of my conversation with Mark or scroll to the bottom to watch the webinar replay.
Question (Q): The last 5-10 years have been challenging for the investment management industry, looking back to the 2008 financial crisis as well as with increasing regulatory initiatives and changes across the investor due diligence process. How have your views on risk and the risk landscape evolved during this time? Or have they evolved?
Mark Strachan (MS): I think they’ve certainly evolved. The core features of non-investment risk – such as operational, counterparty, regulatory, security and business risk – have been constant, but they have evolved in terms of their complexity, our experiences with them, the tools available to help mitigate exposure and the focus by investors through their due diligence process.
It’s no surprise that starting a hedge fund is no easy feat. In an increasingly competitive landscape challenged with evolving investor and regulatory demands, progressive technology and mounting cyber threats, emerging managers can become overwhelmed at the winding path that lay before them. Still, hundreds of emerging managers attempt launching every year due to the prospective monetary and fundamental rewards.
What sets apart successful startups from those that fail? In today’s post we will cover a few essential areas startupreneurs should consider during their launch journey.
Invest in People
Your greatest assets walk out of the door every day: Your team. Every hedge fund startup is backed by people, and the more dynamic and versatile this team is, the greater chance the firm has of achieving and sustaining a successful future. Why? Since capital is limited during the development phase, selecting people with skill sets in multiple arears is essential. Additionally, employees are ambassadors for your firm, and thus, critical to attracting investors.