When the Crisis Is Real:
PE Risk Management Beyond the Firewall

There is a particular kind of tunnel vision that happens in the cybersecurity industry during geopolitical crises. Within hours of the US-Israeli strikes on Iran last weekend, the conversation in security circles had already pivoted to API endpoint probing, state-sponsored phishing lures, and whether the latest Telegram post from a pro-Iranian hacktivist group constituted a credible threat. Indicators of compromise were being shared. Detection rules were being updated. Dashboards were lighting up.

None of that is wrong. But it can become dangerously narrow if you are a General Partner or a portfolio company COO sitting in London trying to make sense of what this crisis actually means for the businesses you are responsible for — and the people inside them.

The first responsibility of any organisation is straightforward: know where your people are, confirm they are safe, and have a clear, tested plan for what happens if conditions deteriorate further.

So before we get to the cyber threat — and we will get to it, because it is real and it is escalating — let us step back and think about what the right order of priorities actually looks like.

The First Question Is Not About Your Firewall

If your portfolio has operations, employees, or partners in the Gulf, the first call you should be making is not to your CISO. It is to whoever is responsible for your people on the ground.

The situation in the region is moving faster than most crisis communication frameworks were designed to handle. Embassies are scaling back or closing. Airspace is being disrupted. Commercial shipping through the Strait of Hormuz — a chokepoint carrying roughly 20% of the world's oil supply — is in a deeply uncertain state. An oil tanker was fired upon near the Strait. Crews are stranded. Insurers have withdrawn war-risk cover on Gulf shipping lanes.

This is the real-world environment your employees are navigating right now. That sounds obvious. In practice, it is rarely as prepared as it should be. Duty of care frameworks built for stable environments often have significant gaps when the situation shifts this quickly.

Business Continuity Is Not a Document. It Is a Conversation Happening Right Now.

The organisations that tend to navigate crises well have one thing in common: their business continuity plans are living things, tested regularly, owned by real people, and capable of being activated quickly. The ones that struggle have a well-formatted PDF somewhere on a shared drive that was last updated in 2022.

For PE-backed companies with Middle East operations or supply chain exposure, the question right now is not whether you have a BCP. It is whether the people running these businesses — management teams who were hired to grow revenue and manage margin — know what to activate, who owns which decisions, and what thresholds determine escalation.

The first 48 hours of a crisis like this are the most information-rich you will have for some time. The decisions made in this window shape outcomes for months afterward.

The Macro Picture Is Not Abstract. It Lands in Your Portfolio.

Let us be direct about the economic exposure, because it is substantial and it is not limited to companies with boots on the ground in the Gulf.

>10%

Oil price spike following strikes

~20%

Of world's oil flows through Strait of Hormuz

>4%

Projected UK inflation if oil stays above $120

Oil prices spiked over 10% immediately following the strikes, and the disruption to Gulf shipping lanes creates a compounding risk that goes well beyond the energy sector. For portfolio companies with physical supply chains, energy-intensive operations, or logistics dependencies, elevated oil prices and shipping disruption translate directly into margin pressure.

There is also a less obvious exposure that tends to get overlooked in the first days of a crisis: technology supply chain dependencies. The Thomas Murray threat assessment published this week makes the point explicitly, noting the risk of PE firms or portfolio funds holding investments in targeted sectors within conflict-affected countries, including the possibility of delayed or embedded threats designed to activate at a later stage.

And one further data point that should sharpen minds: AWS suffered a service disruption in its Middle Eastern data centres this week as a direct result of physical damage from the strikes. Infrastructure you assumed was purely digital has physical exposure too.

Now, The Cyber Threat — In Its Proper Context

Nation states do not fight wars on a single domain. Iran is deploying missiles, leveraging proxy groups, applying maritime pressure, running influence operations, and using cyber operations. Cyber is one instrument in a much larger toolkit. Sometimes it is a supporting capability rather than the headline.

I say that not to minimise the threat — which is serious and well-documented — but because the right response to cyber risk in a crisis like this looks different depending on whether you treat it as the primary concern or as one significant risk among several.

What is actually happening right now:

• Iranian-linked groups mobilised at unprecedented speed. Within hours of the strikes, over 100 pro-Iranian hacktivist groups had coordinated under a unified Telegram ecosystem.
• The 'Great Epic' campaign has already claimed disruption to gas station payment systems in Jordan, targeted US and Israeli military provider networks with data destruction operations, and has SCADA and ICS access being offered for sale on Telegram.
• The CSIS analysis of over 250,000 Telegram messages across 178+ groups indicates state orchestration rather than organic activist activity. Attack timings, target selection, and vulnerability sharing across these groups show deliberate deniability.
• For Gulf-region organisations, the sectors at highest risk right now are financial services — SWIFT-connected processors, regional banks, payment infrastructure — and energy OT/ICS networks.

The 'hacktivist' label is operationally misleading. What looks like a loosely coordinated internet mob is, in significant part, state-directed infrastructure operating with deliberate deniability.

One of the harder realities in the threat picture is that access gained months ago through patient reconnaissance may already be positioned inside infrastructure that has not yet shown any indication of compromise. The Ukrainian conflict gave Western security teams several years to normalise the concept of cyber as hybrid warfare. The Middle East escalation is moving faster, with a more geographically dispersed target set.

What GPs Should Be Doing Across the Portfolio

There are three distinct things that PE firms should be doing right now, and they are not equally urgent.

Executive Risk Briefings: Translating Threat into Business Context

One of the most effective mechanisms for managing complex, multi-dimensional crises is an Executive Risk Briefing — a concise, business-focused situational update that brings together geopolitical developments, regional threats, cyber activity, market impacts, regulatory changes, and forward-looking watch items in a single view.

These briefings are not threat intelligence reports. They are decision support tools designed for executives and boards who need to understand what is happening, what it means for the business, and what requires action. During periods of elevated risk like the current Middle East escalation, PE firms can either provide these briefings to portfolio company leadership or request them from portfolio companies to ensure situational awareness is maintained at the right altitude.

An effective executive briefing in a crisis scenario typically includes:

• Key regional developments with direct operational or strategic impact (military escalation, diplomatic shifts, infrastructure disruption)
• Cyber and technology risk events categorized by impact domain (operational, regulatory, market risk, credit risk)
• Regulatory and compliance changes affecting operations in the affected region
• Forward-looking outlook and watch items for the next 24-48 hours
• Risk categorization by domain — not just cyber, but geopolitical, operational, market, and credit risk in context

The value of an executive briefing is not in the volume of detail — it is in the clarity of impact assessment and the identification of what requires decision-making versus what requires monitoring.

For portfolio companies with Gulf operations, financial exposure to Middle Eastern markets, or technology dependencies in the region, a well-structured executive briefing provides the connective tissue between what threat intelligence teams are tracking and what board-level decision makers need to act on. This is particularly valuable when physical safety concerns, supply chain disruption, cyber threat, and regulatory risk are converging simultaneously.

Most boards have crisis-ready playbooks built for cyberattacks or natural disasters. Fewer have tested them against a scenario where the physical, economic, and cyber threat are converging simultaneously.

The Broader Lesson for How PE Thinks About Risk

Two articles ago, we made the case that cyber risk is financial risk. That remains true. But the events of the past week are a reminder that financial risk in a volatile geopolitical environment is not a single-dimension problem.

When we wrote the Portfolio Cyber Playbook, the implicit assumption was that cyber was the primary crisis to manage. What is playing out in the Middle East right now is a more complex picture: kinetic action, economic disruption, supply chain shock, and cyber operations running in parallel.

The Risks We Were Warned About Are Materializing

The World Economic Forum's 2026 Global Risks Report, published earlier this year, ranked the most severe risks facing organizations over the short term (2 years) and long term (10 years). The short-term list is striking in its relevance to what we are witnessing right now:

The top six short-term risks identified by the WEF are:

1. 1

   Geoeconomic confrontation

   —

   Trade wars, sanctions, energy disruptions

2. 2

   Misinformation and disinformation

   —

   Coordinated influence operations and narrative manipulation

3. 3

   Societal polarization

   —

   Fragmentation of public trust and consensus

4. 4

   Extreme weather events

   —

   Climate-driven disruption to operations and supply chains

5. 5

   Interstate armed conflict

   —

   Military escalation and regional instability

6. 6

   Cyber insecurity

   —

   Sophisticated attacks on critical infrastructure and commercial systems

What we are seeing in the Middle East right now is not an outlier scenario. It is a real-world collision of risks 1, 2, 5, and 6 — geoeconomic confrontation, coordinated disinformation, interstate armed conflict, and cyber insecurity — happening simultaneously.

This matters for private equity because these risks do not respect the neat boundaries that investment committees and portfolio management frameworks were built around. A crisis that starts as interstate armed conflict (risk #5) immediately triggers geoeconomic disruption (risk #1) through oil price volatility and shipping lane closure. It activates coordinated cyber operations (risk #6) that target financial infrastructure and energy systems. And it unfolds within an information environment saturated with misinformation (risk #2) that makes situational assessment harder and slows decision-making.

The long-term risk picture painted by the WEF is equally sobering: extreme weather events, biodiversity loss, critical changes to Earth systems, misinformation, and adverse outcomes of AI technologies. These are not abstract future problems. They are structural forces that will reshape valuations, operating environments, and exit timelines for portfolio companies across every sector.

The risk that gets underweighted in this kind of environment is often the one that is hardest to quantify — which is why it tends to surface in post-incident reviews as the thing nobody was watching closely enough.

PE firms do not have unlimited bandwidth for crisis management. The role of a good advisor in this environment is to help focus that bandwidth in the right sequence: people first, then operational continuity, then economic and supply chain exposure, then the cyber threat landscape — understood clearly, managed proportionately, and monitored for the long tail of activity that will outlast the current news cycle.

That is not a comfortable message. But it is the right one.