Resources Categories
INDUSTRY FACT FILE · CONGLOMERATES, HOLDING COMPANIES & INVESTMENT GROUPS
Main Products and Services of Groups and Investment Firms
What India's business groups, holding companies, CICs, family offices, PE and VC firms, portfolio companies and shared-services centres do, the systems behind each, and where those systems create cyber and compliance exposure.
|
In this document 1. How groups and investment firms create value 2. Products and services by organisation type 3. The ownership layer: capital, deals and governance 4. The operating layer: shared services, treasury and portfolio companies 5. The systems behind the products and services 6. Trends that change the attack surface 7. Mapping operations to Codec Networks engagements |
1. How groups and investment firms create value
|
Revenue stream |
How it works |
Security relevance |
|
Dividends and value of holdings |
Holding companies and CICs earn dividends and capital gains from group companies |
Group-wide incidents hit the value of every holding at once |
|
Brand, management and service fees |
Holdcos charge group companies for brands, management and shared services |
Shared platforms concentrate risk and data |
|
Fund management fees and carry |
PE and VC managers earn fees on funds and a share of gains at exit |
Portfolio incidents and diligence findings move exit values |
|
Deal origination and execution |
Acquisitions, mergers, demergers, listings and secondary sales |
Deal data, UPSI and inherited breaches |
|
Treasury and investment income |
Group treasury pools cash, invests surpluses and funds subsidiaries |
Payment fraud, banking portal and approval risks |
|
Family office management |
Investments, property, philanthropy and personal affairs managed for families |
Principal privacy, impersonation and adviser access |
2. Products and services by organisation type
|
Organisation type |
Main products and services |
Key systems |
|
Diversified business groups |
Operating businesses across sectors with shared brand, capital and functions |
Group directory and email, ERP, data platforms, OT in industrial companies |
|
Holding companies |
Ownership, governance, capital allocation, brand and group policies |
Board portals, risk registers, consolidation and reporting systems |
|
Core investment companies |
Holding and funding of group company investments |
Investment and treasury systems, banking portals, regulatory reporting |
|
Family offices |
Wealth management, payments, property, family governance |
Portfolio systems, banking portals, email, personal devices, home networks |
|
PE and VC firms |
Fund raising, deal sourcing, diligence, portfolio value creation, exits |
Deal pipeline CRM, data rooms, fund administration, investor portals |
|
Portfolio and group companies |
Products and services in their own sectors |
Their own IT, cloud, applications, OT and suppliers |
|
Acquisition platforms and shared-services centres |
Integration of acquired firms; finance, HR, payroll, procurement and IT for many entities |
Shared ERP and HR, ticketing, outsourcer access, integration tooling |
3. The ownership layer: capital, deals and governance
At the top of a group sit the owners and the people who allocate capital. Promoters, holding company Boards, core investment companies, family offices and fund managers decide which businesses to buy, build, fund or sell, and they do so through a stream of confidential information: Board papers, investment committee memos, valuation models, term sheets and draft announcements. Much of this is unpublished price-sensitive information for listed group companies, and the SEBI insider trading regulations require a structured digital database recording who shared it and who received it, with time stamps and audit trails. Deal work involves bankers, lawyers, accountants and consultants, each with their own email and devices, and virtual data rooms that hold the target's contracts, customer lists and employee data. These are the moments when a spoofed adviser email, a leaked memo or a compromised partner's mailbox does the most harm.
Governance documents travel just as widely. Board and committee members, many of them independent directors who sit on several Boards, read papers on Board portals, tablets and personal email; risk management committees receive reports from each listed company; and LPs receive fund reports through investor portals. Family offices hold some of the most sensitive data of all: the family's assets, travel, health, children and addresses, alongside banking access and powers to approve payments. Principals are public figures, so their voices and faces are easy to clone, and their staff are trained to act quickly on their instructions. The 2024 Arup case, in which a Hong Kong employee transferred about US$25 million after a video call with deepfaked colleagues, shows how this trust is turned into a payment.
4. The operating layer: shared services, treasury and portfolio companies
Below the owners sit the shared platforms that make a group efficient. Group IT often runs one directory and email system, one collaboration suite, a common ERP and shared data platforms; shared-services centres process accounting, payroll, HR, procurement and treasury for many companies; and IT outsourcers and managed service providers hold privileged access to all of it. When a company is acquired it is connected to these platforms, sometimes within days, through directory trusts, VPNs and email migrations. When a business is sold or demerged, transitional service agreements keep it connected for months. Each of these links is a path for an attacker. NotPetya spread through Maersk's and Mondelez's networks in 2017 because they were connected, and the lesson since then has been to separate administration tiers, control trusts and be able to isolate one company quickly.
Portfolio companies are where most systems, data and customers live. A PE or VC fund may hold ten to thirty companies at different stages, with very different security maturity: a newly acquired manufacturer may run unsupported OT, a consumer platform may hold millions of customer records, and a start-up may have no security team at all. The fund carries the consequences when one of them is hit, through lost value, delayed exits, LP questions and, in a buyout, a buyer's diligence findings. Groups face the same issue with their own subsidiaries, and the 2025 attack on Jaguar Land Rover, which the UK Cyber Monitoring Centre estimated cost the UK economy about £1.9 billion, showed how far the effects of one operating company's outage can travel. Measuring every company against a common baseline, monitoring them and preparing them to recover is now part of how owners protect value.
|
Highest-risk moments Signing and closing an acquisition, connecting an acquired company to group directories and email, merger, demerger and listing processes, the weeks before results and announcements, quarter-end and year-end payment runs, urgent and confidential transfer requests, changes to bank details of group companies or investees, onboarding a new IT outsourcer or shared-services client, carve-outs and transitional service periods, fund raising and exit processes, insurance renewals and staff, director and adviser changes are where group and investment incidents typically begin or escalate. |
5. The systems behind the products and services
Figure 2: Where cyber risk sits across the group and investment lifecycle.
|
Product / service |
Systems that deliver it |
Key cyber and compliance touchpoints |
|
Deal sourcing and diligence |
Pipeline CRM, data rooms, adviser email, investment committee papers |
UPSI controls, data room security, adviser identity checks |
|
Acquisition and integration |
Directory trusts, VPNs, email and ERP migration, integration tooling |
Compromise assessment, security gates, staged connectivity |
|
Shared services |
Group ERP, HR and payroll, ticketing, outsourcer access |
Least privilege, PAM, segregation by entity, DPDP |
|
Treasury and payments |
Banking portals, payment approval workflows, intra-group funding |
Dual approval, call-backs, beneficiary controls, BEC monitoring |
|
Governance and reporting |
Board portals, risk registers, investor portals, insurance records |
Access control, metrics, incident disclosure, LODR and CSCRF |
|
Exit and separation |
Vendor diligence packs, carve-out systems, TSAs |
Access removal, data separation, evidence of controls |
6. Trends that change the attack surface
|
Trend |
What is changing |
Security implication |
|
Consolidated group platforms |
One directory, cloud tenant and ERP for many companies |
One compromised identity or admin can reach every entity |
|
Frequent acquisitions and roll-ups |
Buy-and-build strategies and acquisition platforms |
Inherited breaches and rushed integrations |
|
Private capital ownership |
Funds owning larger shares of Indian companies |
Portfolio cyber risk becomes a value and LP issue |
|
Regulatory focus on cyber governance |
LODR, CSCRF, CERT-In Directions and DPDP |
Boards need group-wide evidence, not assurances |
|
Deepfakes and AI-assisted fraud |
Cloned voices and faces of executives and promoters |
Payment approvals need controls that do not rely on recognition |
|
Systemic supply chain events |
Incidents such as JLR 2025 that reach suppliers and dealers |
Groups must plan for their own and their suppliers' outages |
7. Mapping operations to Codec Networks engagements
|
If the organisation operates… |
Recommended starting engagement |
|
A diversified group with shared IT |
Group cyber standard and maturity scoring, directory and trust review, shared SOC |
|
An active acquisition programme |
Cyber due diligence, compromise assessment before closing, integration security gates |
|
A PE or VC fund with portfolio companies |
Portfolio baselines and benchmarking, CSCRF review of the manager, portfolio SOC |
|
A family office |
Payment control and call-back testing, deepfake awareness, personal device and privacy review |
|
A shared-services centre |
Privileged and vendor access review, segregation by entity, DPDP programme |
|
A group treasury or CIC |
Treasury approval testing, BEC simulations, group risk reporting to the Board |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: Descriptions are general and based on public information available as of October 2026. Systems and exposures differ by group, fund, entity, sector, transaction and agreements in force. Pre-acquisition testing is described only as authorised work with the target's consent and in agreed conditions.