In January 2025, New York-based Insight Partners found an intruder in its systems. In July 2026, Apollo Global Management, also headquartered in New York, had personal data stolen from its cloud environment. Neither attack relied on an exotic exploit. In both cases, the attackers used social engineering: they convinced someone to let them in.
That should concern every private equity firm in Manhattan, because most firms run lean on IT. Our analysis of New York City venture capital and private equity firms found that more than three in four have no in-house IT staff at all, and most of the firms that do have IT staff rely on a single person.
What Is Managed IT Support for Private Equity Firms?
Managed IT support means an outside team takes responsibility for running and securing a firm’s technology for a predictable monthly fee. For most businesses, that covers the help desk, device management, Microsoft 365 or Google Workspace administration, backups, and cybersecurity.
Private equity firms need the same foundation, plus a few industry-specific requirements:
- Deal data protection: confidential information on targets, portfolio companies, and pending transactions has to stay locked down, including in data rooms shared with outside counsel and advisers.
- Investor data security: limited partner (LP) records often include Social Security numbers, bank details, and tax documents.
- Wire and payment controls: capital calls and distributions move large sums on predictable schedules, which makes them attractive to fraudsters.
- Secure access from anywhere: deal teams travel, work late, and need reliable access without opening security gaps.
- Regulatory documentation: registered advisers must be able to show how they protect client information and respond to incidents.
Some of these needs overlap with other professional services firms, such as law firms in Manhattan that protect privileged client files and Manhattan accounting firms that handle sensitive financial records. Private equity adds the scale of money in motion and the value of deal information.
Why It Matters Now for PE Firms in Manhattan
Private equity firms concentrate exactly what attackers want: capital, sensitive deal information, and personal data on high-net-worth investors. Manhattan is one of the largest private equity hubs in the country, which makes it a target-rich environment.
The cost of an incident is significant. A February 2026 Kroll report, based on a survey of 325 private equity leaders, found that cyber incidents now carry an average financial impact of $2.1 million. Kroll’s research puts the probability that a single incident costs more than $500,000 at 53%, with a 13% chance that losses exceed $5 million. The report also found that mid-market and smaller private equity firms lag behind on cyber risk governance.
For a smaller firm, a seven-figure loss can also strain LP relationships, delay deals, and invite regulatory scrutiny.
How New York PE Firms Are Actually Staffed for IT
To understand how prepared local firms are, we analyzed LinkedIn Sales Navigator data for venture capital and private equity firms in New York City with 1 to 500 employees. Here is what we found:
| IT staffing | Firms | Share of firms |
|---|---|---|
| No in-house IT staff | 1,506 | 76% |
| Exactly one IT person | 293 | 15% |
| Two or more IT staff | 183 | 9% |
| Total firms | 1,982 | 100% |
Of the 476 firms that do have IT staff, 293 (62%) rely on exactly one IT person.
A one-person IT department is a single point of failure. That person handles tickets, onboarding, vendors, patching, threat monitoring, and compliance, all at once. When they are on vacation, out sick, or offline for the night, nobody is watching. There is no second set of eyes to approve changes and often no formal process for verifying an unusual request.
At firms with no IT staff at all, security usually falls to an operations lead, the CFO, or a patchwork of vendors, none of whom owns the whole picture.
Methodology: LinkedIn Sales Navigator account search, filtered to venture capital and private equity firms in New York City with a headcount of 1 to 500, November 2026. IT staffing reflects the number of employees LinkedIn lists in each firm’s IT function, so firms whose IT staff are not on LinkedIn may be undercounted.
Real Incidents: What Happened at Insight Partners and Apollo
Insight Partners
Insight Partners, a New York-based venture capital and private equity firm, detected unauthorized access to its systems on January 16, 2025. The firm attributed the breach to a sophisticated social engineering attack, and it was later reported to involve ransomware. A filing with the Maine attorney general showed the breach affected 12,657 individuals.
Apollo Global Management
In July 2026, attackers spent several days inside Apollo’s cloud environment and took names, birth dates, home addresses, and Social Security numbers. Apollo said the attackers got in through social engineering.
The breach came weeks after Google researchers warned of an extortion campaign aimed at private equity and financial firms. The attackers called employees while posing as IT help desk staff, then used spoofed login pages to capture passwords and multi-factor authentication (MFA) codes. Google reported that some ransom demands reached $750,000.
The Lesson for Smaller Firms
Both firms have significant security resources. If a fake help desk call can work there, it can work at a 20-person firm where an unfamiliar voice claiming to be from “support” doesn’t raise alarms. Firms without a formal identity verification process for help desk requests are especially exposed.
The Capital Call Wire Fraud Problem
Business email compromise (BEC) is the other major threat. An attacker gains access to one email account, watches, and then steps into a legitimate thread with new wire instructions.
FTI Consulting documented one such case. An email account at a private equity firm’s LP was compromised. The attacker hijacked a thread about a cash transfer, used lookalike domains for both the LP and the firm, and sent fraudulent wire instructions made with an online PDF tool. The wire went out, and only part of the money was recovered.
The amounts at stake are large. A 2021 analysis by Agari found that capital call scams sought about $809,000 on average, more than seven times the $72,000 sought in typical BEC attacks at the time.
The fixes are mostly process, backed by technology:
- Verify any new or changed wire instructions by phone, using a number already on file, never one from the email.
- Require two people to approve wires above a set threshold.
- Configure SPF, DKIM, and DMARC so attackers can’t easily spoof your domain.
- Share wire instructions through a secure investor portal rather than email.
The Compliance Angle: Amended SEC Regulation S-P
For SEC-registered investment advisers, cybersecurity is now a documented regulatory obligation. The SEC’s 2024 amendments to Regulation S-P require covered firms to maintain a written incident response program, notify affected individuals of certain data breaches within 30 days, oversee service providers that handle customer information, and keep records showing compliance.
Larger advisers had to comply by December 3, 2025. Smaller advisers, those with less than $1.5 billion in assets under management, had to comply by June 3, 2026. The SEC has also named Regulation S-P compliance as an examination priority for fiscal year 2026.
Exempt reporting advisers and private funds are not covered by the amendments, but they remain subject to the FTC’s Regulation P and Safeguards Rule. Firms should confirm their specific obligations with compliance counsel.
What Good Managed IT Looks Like for a Manhattan PE Firm
Whether a firm has no IT staff or one overextended IT lead, the right managed IT partner should provide:
- Strong MFA and help desk verification, so a caller claiming to be IT, or a partner claiming to be locked out, can’t talk their way in.
- Continuous threat detection on every device and cloud account.
- A hardened Microsoft 365 or Google Workspace environment with independent backups.
- Wire fraud controls built into email security and finance workflows.
- A written incident response plan and documentation that supports Regulation S-P and investor due diligence questionnaires.
- Security awareness training with simulated phishing attacks.
- Local presence for on-site support in Manhattan when it’s needed.
For firms that already have an IT person, the goal isn’t to replace them. A managed IT provider can work alongside an in-house IT lead, taking on monitoring, security tooling, vacation coverage, and overflow, so one person is no longer the firm’s only line of defense.
Manhattan Managed IT Services (MMITS) provides managed IT services in Manhattan that combine responsive local IT support with layered managed cybersecurity, including SentinelOne EDR, Ninja RMM monitoring, cloud security monitoring, Microsoft 365 and Google Workspace backup, and security awareness training. Clients also receive quarterly vCIO guidance and strategic IT consulting covering budgets, security questionnaires, and technology planning. MMITS reports that tickets typically receive an initial response within 10 minutes.
Get Managed IT Support Built for Private Equity in Manhattan
Private equity firms are in the business of managing risk. Cyber risk belongs on the same list as market, credit, and deal risk, yet roughly nine in ten New York firms have no more than one in-house IT person to manage it.
If your firm relies on a single IT person, a patchwork of vendors, or no dedicated IT at all, contact Manhattan Managed IT Services to schedule a consultation and find the right managed IT support plan for your firm.
