Karsten Wenzlaff, Advisor
August 26th, 2025
Forward Security Inc. | Farshad Abasi | Nov 17, 2021

Picture this. You are the CEO of a large financial services company and are looking to acquire a smaller fintech company to expand your business. Everything within the company’s infrastructure looks normal.
Turns out, technology and security of the company wasn’t thoroughly tested, and after acquiring the company, you inherit a major security breach along with it, costing you millions of dollars. Believe it or not, this is exactly what happened to Paypal, when it acquired TIO Networks and they are not alone.
Paypal’s example proves the importance of incorporating thorough technology due diligence into the acquisition process of a company.
To gauge what the due diligence process entails, let’s consider the example of a VC or a CEO of a fintech company who is interested in preparing their company for acquisition. After taking the first step to hire an investment banker to show the company to investors, there are three main stages of the Due Diligence Process. The first round of bids includes a high-level company evaluation, addressing the condition of the business, financials, and management team. A handful of bids progress to the second round of bids, which takes a deeper dive into the business. The interested party then submits a Letter of Intent (LOI) to indicate interest in acquiring the company.
At the LOI stage, things could go awry if issues are found while evaluating the health of a company during the due diligence process (including legal diligence, accounting diligence, customer diligence, and technology/cybersecurity due diligence). After the LOI stage, if the investor is still interested in the company, the deal moves to the closing stage.
In any investment, buyers are clearly looking for no problems with the company, as this could cost them millions in the future.
A buyer’s priority is to minimize risks and solve for sustainability and scalability through assessing three aspects of the company: people, process, and technology. Risks surrounding people could involve code development and knowledge distribution, while risks around the process typically entail sustainability and scalability. Risks surrounding technology often involve security issues and documentation surrounding open-source code. If you think your company will need to embark on the due diligence process in the next 6-12 months, it’s crucial to be thorough with documentation regarding all aspects of due diligence.
To prove that a company doesn’t have issues, it’s important to provide the correct documentation and engage security from the beginning of the development process and have it ready for the due diligence process. Engaging security from the start leads to strong foundations in governance and policy as well as in the applications themselves. Consistent and diligent documentation from the start of the process also strengthens the validity of the company’s security posture.
Regarding the technology and security aspect of due diligence, it’s important to note that doing a risk assessment shows buyers that a company is truly worth the investment. It’s also crucial to know where your security issues lie by having a 3rd party look at the code to find loopholes. It assesses business impact and how likely a security breach is to occur, making it more valuable than security gaps or vulnerabilities. If any security issues are found, it’s key to have a plan of action for the investor or show progress on the issues that were found. Where open-source software is used, keeping thorough documentation on what is used will help tell the company’s story while preventing it from being put on the defensive.
Going forward, sellers should expect more scrutiny for technology and security aspects of the company. Therefore, any preparation on this front would be valuable. Buyers are also becoming more aware of what breaches exist and will ask sellers how they’ve prepared themselves. Buyers need to be able to ensure these breaches aren’t impacting them, as they don’t want to inherit liabilities.
In short, add security early in the development process and document your controls to cover your bases. Apply security best practices while building your company and applications. Though it may seem more efficient in the short run, refrain from cutting corners, and get professionals to support you during the due diligence process. Spending money on a 3rd party assessment to find potential security loopholes is valuable, as this could save millions in transaction value. Remember, investing in security initially to ensure a strong security posture will only save millions of dollars in the long-term.
If you’re looking to learn more about what to do to secure your company including your products and infrastructure, check out the Security 4 Startups (S4S) framework: https://www.security4startups.com/. S4S was designed by a group of investors and small, mid, and large-corporation CISOs to help startups combat their biggest security risks in a balanced manner. If you’re looking for an in-depth security consultation, Forward Security and RiskAware are always here to help, so get in touch: contactus@fwdsec.com.

At Forward Security we are all about doing application, cloud, and information security better. Our team tackles security using a systematic approach, leveraging standards based and repeatable processes. We are incredibly passionate about delivering the best security solutions, and are driven to help our clients achieve the highest level of security to enable business growth. https://forwardsecurity.com/

RiskAware was incorporated in 2018 to help address the gap with organizations utilizing part-time or fractional CISO and to offer executive leadership services. We serve organizations of all sizes and specialize in small and mid-size businesses (SMBs) in all verticals, including Not-For-Profits and Startups. https://riskaware.io/
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
The Economist | Hong Kong | Nov 14, 2021
Their shareholdings in tech firms and other private companies are soaringIT MIGHT BE confused for one of the world’s savviest tech investors. The portfolio of China Internet Investment Fund (CIIF) is the envy of venture capitalists everywhere. It owns part of ByteDance, the Beijing-based parent of social media group TikTok, and Weibo, the Twitter-like platform. It has a stake in SenseTime, one of China’s most advanced artificial intelligence (AI) groups, and Kuaishou, a popular Chinese short-video service. The firm’s investment list reads like a who’s who of the industry.
More stunning are the terms of these investment deals. CIIF’s 1% stake in a ByteDance subsidary gives it the power to appoint one of three board members in a unit that holds key licences for operating its domestic short-video business. A similar bargain has been struck with Weibo, which is listed in New York, with CIIF picking up 1% at a cost of just 10.7m yuan ($1.5m). These companies hardly need more capital. Nor is CIIF , armed with plans for a 100bn yuan fund—enough to rival a major Silicon Valley venture-capital firm—overly concerned with the outsize returns its investments will almost certainly deliver.
That is because the outfit, founded a mere five years ago, is no typical investor. CIIF is itself mostly owned by the Cyberspace Administration of China (CAC), a powerful internet watchdog. The arrangement is akin to America’s Federal Communications Commission taking discounted stakes in tech groups such as Facebook and Twitter, appointing board members and then steering them in the direction it sees fit.
Bringing the commanding heights of the modern economy to heel might be expected from what is, after all, a communist regime. Nor is state investment in private companies anything new: “guidance funds”, massive state vehicles that direct money towards semiconductors and other favoured areas, have become a fixture of China’s investment landscape. But the extent of such activity over the past two decades has risen sharply.
The jump in private companies invested in by the state since 2000 has accounted for nearly all of China’s increase in new registered capital. Public investments in private-sector companies surged from $9.4bn in 2016 to $125bn in 2020, though looks set to fall this year, according to data from Dealogic, a research firm (see chart 2).
This means the growth of business in the country is inextricably linked to the state. The tech industry has been a notable focus. Regulation has long hemmed in the sector, as has the occasional bringing down of a tycoon by one or two notches. This is now considered insufficient to ensure entrepreneurs are kept in line.
Government “golden shares”, tiny investments that give a high degree of control over companies, have been rumoured for years
Thus extending the government’s reach directly into more private companies via financial interests is emerging as a mechanism to control them. Government “golden shares”, tiny investments that give a high degree of control over companies, have been rumoured for years; only recently have they been disclosed in the likes of Weibo and ByteDance. It is likely this feature of state investment will expand, says Nana Li of the Asian Corporate Governance Association, an investor interest group.
Unwittingly tagging along for the ride have been global investors who had once spent freely to gain a foothold in the booming Chinese market. Americans and others are unlikely to be comfortable with the new arrangements. More might get snared: CAC, the ultimate power behind the state investments in tech, was recently given the authority to vet the overseas share listings of large Chinese tech groups.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Stikeman Elliot | Mario Nigro | Oct 27, 2021
Please join us – at your convenience – for a new series of podcasts on private equity and midmarket M&A, with a focus on Canada. In these concise 15-minute segments, a wide range of industry participants discuss the deal market trends that they’ve been seeing. The host and originator of the series is Mario Nigro, M&A partner at Stikeman Elliott in Toronto.
| Episode 21: What is Driving Today’s High Valuations and Can It Continue? Dr. Howard Johnson, Canadian Market Leader at Duff & Phelps |
Mario’s guest is Howard Johnson, Canadian Market Leader at Duff & Phelps and managing director in its M&A Advisory practice. A veteran of the Canadian midmarket and a valuation expert, Howard believes that today’s high valuations and (often) double-digit multiples are likely to persist since many public companies and PE firms are cash-rich and eager to invest. Tax reform and the uncertainty of pandemic-era earnings analysis may emerge as complicating factors, however. | Spotify | Apple Podcasts (iTunes) | SoundCloud |
| Episode 20: What Does A Tech-focused U.S. Private Equity Firm See In Canada? Doyl Burkett, Managing Partner, Integrity Growth Partners |
Doyl Burkett, Managing Partner of Los Angeles-based Integrity Growth Partners, joins Mario Nigro to discuss PE investments in the software and tech-enabled business services space. Integrity typically invests $10-40m in founder-owned-and-operated businesses, often taking non-controlling positions. Doyl’s strategic focus on “underserved geographies” has generated many opportunities across Canada. | Spotify | Apple Podcasts (iTunes) | SoundCloud |
| Episode 19: Scaling Canada’s Smaller Successful Companies: A New Solution to an Old Challenge George Rossolatos, CEO of Canadian Business Growth Fund |
Joining Mario Nigro is George Rossolatos, CEO of Toronto-based Canadian Business Growth Fund (CBGF), a private equity investor that takes minority stakes in Canadian companies, typically those in the $10-25m revenue range, working with them to promote long-term growth. CBGF was created in 2018, with George as Founding CEO, in response to concerns that Canada needs to get better at growing its successful startups into strong midmarket players. | Spotify | Apple Podcasts (iTunes) | SoundCloud |
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Sifted | Steph Bailey | Nov 3, 2021
Opening Up Financial ServicesInvestors are still betting big on open banking: in the past three months, TrueLayer announced a $130m funding round led by Tiger Global, Visa bought rival Tink for $2bn, Yapily announced its $51m Series B raise and Mastercard doubled down by acquiring Aiia — a Danish startup that will allow Mastercard to do credit scoring.
So why are investors flashing the cash when open banking is still in its nascency? Back in April, Yapily founder Stefano Vaccino told Sifted that VCs are less concerned with monetisation and more with the market’s raw opportunity.
“Investors aren’t looking at revenue multipliers, but the size of the market… This is a space that for the next 10 to 15 years will continue to grow, and there’s an opportunity to build a company that is $100bn,” Vaccino said.
One of the opportunities in open banking is the payments market, where fintechs are using the vast network of bank connectivity to fuel a new era of account to account (A2A) transactions. That’s allowing consumers to pay directly into merchants’ bank accounts rather than using a card.
Early open banking players like Tink, Plaid, Bankin’ and TrueLayer — who all began by offering data connectivity — have now started branching into the payments space. They’ve recently been joined by new players including Vyne, BOPP, Trilo and Banked.
“There’s an amazing thing in fintech generally called coopetition, where there’s an acceptance that you can’t be good at everything,” he says. “Most fintechs and people in the industry now consider the competition as part of what is needed to deliver the solutions you need.”
A key piece of European payments legislation called PSD2 came into effect in 2018 and boosted the open banking sector by forcing UK banks to open up their data (albeit to varying quality levels). McDougall now says similar legislation is needed in other countries.
“What we’re going to need over the years ahead is the availability of equivalent regulatory frameworks in these other jurisdictions,” he says. “So that European open banking works seamlessly with North American open banking etc.”
The UK is now nearing four million open banking customers, which is behind predictions, but with the right regulation and products, 40m people could have accessed open banking services by 2025. However, surveys suggest some customers still have concerns over protecting their data.
But Greenwood says there are 58 countries currently rolling out their own version of open banking. While the UK was among the first to adopt it, he says other countries can learn from it.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |