Trust a buyer can check,
written into the record.
A private company is discounted for what cannot be seen. Security and regulation are the part of that discount a firm can close fastest, because the evidence is a matter of record. The practice makes a company, a fund or a family office trustworthy to a buyer, a regulator and an investor, and keeps the proof where the next one can read it.
Cyber, Regulatory and Value Architecture · led by Ted Tanase, partner · for the operating partner of a sponsor · venture platforms and family offices below
The multiple pays for trust.
A breach found in the data room, a regulator’s letter, an investor questionnaire that cannot be answered, a provider nobody oversees: each is a discount on the price of the company, and each is cheaper to remove than a point of margin. The owner has a regulator of its own as well. A Luxembourg fund manager lives under the CSSF and, since January 2025, under DORA, and answers its investors’ due diligence every year. The practice does both halves, and writes what it finds and what it fixed into the company’s own record, so the next buyer, lender or investor reads a dated history and recomputes it.
The listed market prices it the same way. Across 75 first attacks that cost listed companies value, shareholders lost $104 billion against $1.2 billion of direct costs found, and the loss was smaller where the board had watched risk beforehand (Kamiya, Kang, Kim, Milidonis and Stulz, Journal of Financial Economics, 2021).
Three products, and six modules inside them.
before the deal
The Cyber and Technology Diligence
What a buyer’s adviser would find, priced before the price is set.
The target’s security, data, cloud and AI posture rated; three loss scenarios in money; a costed fix list that loads into the day-one plan; the closing-window protocol in force from signing to the day the funds land.
during ownership
The vCISO Seat
A chief information security officer by the month, and one page a quarter your board reads.
Investor questionnaires answered from the record, every new tool and provider reviewed before adoption, the Partners’ questions, the yearly exercise, and the posture page: every company on one line, three indicators with a band.
before the exit
The Cyber Exit Read
The buyer’s questions answered before they are asked.
The gaps closed or priced a year before the date, the insurer’s and the customer’s questionnaires answerable from the record, and the cyber chapter of the certificate, aggregates only, signed by the company.
Six modules inside them. The Regulatory Position: what binds the company and the owner, from DORA to the Cyber Resilience Act, as a reasoned position in two weeks. The Governance Programme: the identity month first, then the baseline, the provider register, the seven policies and the training ladder, in phases you can stop. The Assessment: the state of what you run, with one test restore and one controlled impersonation test. The Incident Capability: a plan with named roles and the notification clocks written in, rehearsed once, with a line to call. The Integration and Carve-out Track: an acquisition under your baseline in a hundred days, or a sale separated cleanly. The Owner’s Baseline: the fund’s own position, its register of providers and its questionnaire pack.
The eight controls. One page a sponsor signs for every company it owns: eight controls, each a yes or a no with a date, the same across the estate, bought once. The practice writes the standard and runs the comparison of providers; it procures nothing.
Answer the eight for your own company in two minutes, in your browser, with nothing leaving the page: the free check →
Every product runs on a fixed fee for a defined scope and period, or on a lower fixed fee plus a capped share of value your team signs as realised. The seat is monthly, and no work is billed by the hour. Terms are agreed in writing before work starts.
A founder who sells to a bank must pass its security review.
The identity month first, then the baseline a buyer recognises, so that the record answers the vendor review instead of the founder. One seat shared across the companies a fund names.
Since 11 September 2026 any company that ships a product with digital elements in the EU must report an actively exploited vulnerability within twenty-four hours. Most founders do not know. The regulatory position says what binds the product, and the AI Act’s dates with it.
An office, a family and a set of holdings, each reachable by a stranger with a telephone.
Its own systems, providers and staff and, where it has one, its regulated vehicle: the position, the register of providers, the questionnaire pack, the incident plan with the bank’s fraud desk written in.
Public names, private wealth, the household’s devices and homes, travel: a separate line of work with its own discretion, and a quiet line to call.
Companies owned directly, often founder-run, with less governance than a sponsor would impose: the same products as for a sponsor, sized for a holding of thirty to three hundred people.
A family office buys a person: a chief information security officer it can call, who has sat in a family office before.
Before the first call, the five questions an office answers before anyone asks: Guide 13 →
A partner does the work, and answers for it.
Ted Tanase leads the practice and does the governance, regulatory and investor-facing work himself. He built and ran the global information security function of a regulated insurance group under private equity ownership for nine years, and set the security strategy of a multi-family office for two. The specialised technical activities, the assessment, the controlled test, the technical diligence and the incident line, run through a bench engaged by Makers of New under its own contract, with named people and their certifications, and the firm answering for their work as for its own. Every finding, every remediation and every test lands in the company’s Room, graded, owned and dated, which is where the buyer, the lender and the investor will read it.
Know what binds you, and what a buyer will ask, before either does.
Start a conversation → See every product →A fixed fee for every read · the seat by the month · agreed in writing before work starts