NCX Group Security (@ncxgroup) header
NCX Group Security (@ncxgroup) profile picture

Cyber Risk as a Business Decision Independent Validation for Leaders, Boards, and Deal Teams.

Los Angeles, CA
Joined January 2009
Photo by NCX Group Security (@ncxgroup)Photo by NCX Group Security (@ncxgroup)Photo by NCX Group Security (@ncxgroup)Photo by NCX Group Security (@ncxgroup)Photo by NCX Group Security (@ncxgroup)Photo by NCX Group Security (@ncxgroup)Photo by NCX Group Security (@ncxgroup)Photo by NCX Group Security (@ncxgroup)Photo by NCX Group Security (@ncxgroup)Photo by NCX Group Security (@ncxgroup)
One emergency patch. Three different problems. The owner running the company loses a month. The owner selling hands the buyer a reason to cut the price. The buyer inherits whatever never got fixed. Mike Fitzpatrick on why the basics decide who pays. Full piece on LinkedIn: linkedin.com/pulse/back-basi…
Last Sunday, Microsoft made everyone patch the same thing twice. Groundhog Day, with patches. That same day. Three different bills: the owner running a company, the owner selling one, the buyer across the table. The fix is the basics. Read on LinkedIn: f.mtr.cool/bru7luguuz
1
45
Founders and deal teams: When cyber hits a deal, 42% lose significant value. 22% of 2025 deals excluded a cyber rep entirely. In 2024 it was 5%. Nobody warranted the risk. You still own it. Price the risk before close. Or inherit it after. Full breakdown on LinkedIn: f.mtr.cool/jos3u32o24
26
Deal teams: the seller’s cyber risk becomes your risk at close. The Nethive deal shows how seriously buyers are starting to treat that.
Bregal Milestone just took a majority stake in Nethive, backing its acquisition of JoyComm. PE keeps consolidating SME cyber services because capital follows firms that can prove diligence and remediation capacity at scale. Can you prove your next target's?  See the deal: f.mtr.cool/bhch97dyp9
63
If you own, run, buy, or sell a business, the next 18 months are important. Our founder and CEO Mike Fitzpatrick wrote about how they will decide who stays insurable, financeable, and sellable. Read "The Man Who Owns the Storm Cellar Just Told Us to Take Cover"
Attackers move in hours; most of us patch in weeks. I wrote about why proving the basics beats more tools. If you own, run, buy, or sell a business, you'll want to learn more about this, and why the next 18 months will decide who stays insurable, financeable, and sellable.  Read "The Man Who Owns the Storm Cellar Just Told Us to Take Cover": f.mtr.cool/o77bep8rdc
1
44
You've spent years building something worth protecting. Our founder and CEO, Mike Fitzpatrick, knows exactly what that means, and what it costs when you don't. He was fired three times. He built NCX Group anyway. 25 years, one story, zero fluff. Hear it on the latest Bite Size Security podcast episode.
If you've built a business and are thinking about what comes next, this one's for you. I got fired three times. Started NCX Group with $3,000. What I learned shapes how we protect sell-side owners today. Your story is your valuation. Protect it.  Tune in to the episode on the Bite Size Security podcast: Fired Three Times: The Story Behind 25 Years of NCX Group f.mtr.cool/lnz203rttq
1
58
Our founder and CEO, Mike Fitzpatrick, and Bill Forster, founder of CEO Zones, break down what’s really at stake when ransomware strikes. A 250-person firm was down for 40 days. Watch the short.
Ransomware took a 250-person firm down for 40 days. The breach isn't the real number. Third-party risk, downtime, and cyber posture decide your deal. Bill Forster the Founder of CEO Zones and I break down what's actually at stake. Watch the short: f.mtr.cool/26rccacq4i
1
2
68
What did diligence miss in the IonQ/Elisity deal? NCX Group founder and CEO Mike Fitzpatrick breaks down the risk angle most coverage overlooked.
IonQ's $1.3B all-stock bet on Elisity comes with no published diligence findings. No valuation methodology. Just a number. Most people read this as a technology story. I read it as a diligence story. Elisity sells Zero Trust security. Who independently validated its own posture before close? The seller's risk becomes your risk at close. Price it, or inherit it. f.mtr.cool/767snvixhp
1
1
1
79
Thinking about selling? Buyers find what you haven’t measured and it can mean a haircut, a delay or a larger escrow. Start proving your cyber posture 2–3 years before going to market, not after the LOI lands. Our Founder and CEO, Mike Fitzpatrick explains where to start.
Last year, I sat through a day-long seminar on selling a business under a pseudonym. I didn't want anyone to know I was there. In fairness, going undercover isn't unusual for me. Social engineering- testing whether a friendly stranger can talk their way past the front desk- is a regular part of what we do. I didn't go full Fletch, but I'll admit I was tempted. :-) The seminar was put on by a large M&A firm that handles more than 300 middle-market transactions a year. Eight hours on selling your business. Not one word about cyber risk. Allianz ranks cyber incidents as the number one business risk in the world, for companies of every size. In eight hours, it never came up. That day is when we started formalizing our transaction work at NCX Group. I'm not selling. Nothing is changing at NCX. But I'm a business owner, and like almost everyone who starts a business, I've thought about it. You may have, too. You may not have told anyone yet. If you've owned your business long enough, you've led it through 9/11, the Great Recession, and the pandemic. You've seen just about everything. Now there's one more thing to get right: the largest transaction of your life. Before you tell anyone, ask yourself one question: who on your team is independently evaluating cyber as a business risk, not just an IT issue? I wrote about where to start. Thinking About Selling Your Business? Where to Start Before You Tell Anyone linkedin.com/pulse/thinking-… via @LinkedIn
1
53
Who signed your last cyber insurance questionnaire? The team that runs security can't prove it holds. We sit outside the function we measure. Independent proof for your board and insurer, year over year. f.mtr.cool/22qiaic3bi
2
1
31
Celebrating 25 years of NCX Group: Founder & CEO Mike Fitzpatrick shares how it started, how it evolved, and what shaped the journey.
I got fired the day my son was born. Two more terminations later, I started NCX Group with about $3,000 and a wife who believed in me. As we head into year 25, here’s the story I’ve hesitated to tell. Without her, this story never happens. 25 Years of NCX Group: It Started With Getting Fired linkedin.com/pulse/25-years-… via @LinkedIn
1
47
What would proof of cyber posture actually look like? Not a SOC 2. Not the target's own IT answering its own questionnaire. The operator can't validate the operator, and the target can't validate the target. QoE reports exist because the seller's CPA can't audit the seller's books. Cyber needs the same outside eye. Price the risk, or inherit it. f.mtr.cool/dmzq8f0t4n
21
87% of finance pros have ignored a claim they thought was fraudulent. The team waving through a padded expense is the team approving the fake wire. Avg. invoice fraud loss: $168K/yr. 93% fear AI impersonation. Small exceptions, repeated, become material losses. f.mtr.cool/bpu8ed6a2g
32
1 in 5 CISOs have called in sick or booked time off to avoid Patch Tuesday. Microsoft fixed 974 CVEs in September 2026 alone. That's more than all of 2025 combined, nearly. Burnout isn't coming. It's already here. f.mtr.cool/tzfd6jodae
53
Cyber risk is now part of how a business proves it's ready. ncxgroup.com
26
The best CIOs translate risk into one paragraph a CFO can read in a minute. Most IT failures aren't technical. They're translation failures. See the 12 skills every company is hiring for: f.mtr.cool/k255k2l3y9
28
Thinking about an exit in the next 3-5 years? Cyber risk might be the thing that reprices your deal. This Bite Size Security podcast episode: why internal IT reports don't hold up in diligence, and what buyers actually look for. Mike Fitzpatrick breaks it down. Tune in: f.mtr.cool/rbb11pal51
25
81% of finance leaders faced attempted AI fraud this year. 84% say it's harder to catch than traditional fraud. The damage isn't the attempt, it's the gap before anyone notices the money moved. Know who can stop a routine-looking payment before it clears. Find it before a deepfake does. f.mtr.cool/dpdte0uw71
22
NCX Group Security retweeted
Cybersecurity awareness has long focused on teaching employees how to spot social engineering and business email compromise. But what happens when AI agents gain the authority to move money, access systems, and make decisions on behalf of organizations? We spoke with experts about how AI can be "socially engineered," how defenders can detect manipulated actions, and what companies should be doing now to secure agentic AI. Read more: bit.ly/4rT63rG
7
3
2
23
7,112
Only 17% of organizations assign AI accountability to the CISO. Half of security leaders call AI protection their biggest gap. Adoption is outpacing ownership, and losses land with no name attached. f.mtr.cool/kg3pgg3h77
15