YOUR VENDOR FILE · KESTREL MOBILE SECURITY SA
TODAY- Approved:
- March 2021
- Owner on file:
- Founders · Luxembourg
- Owner today:
- Silverreach Technology Holdings · Hong Kong
- Changed:
- Acquired November 2022
- File status:
- Not updated since approval
BRIEFING · NOVEMBER 2026
Who controls your technology vendors?
Record M&A is changing who owns the systems you run on. Most firms find out too late.
THE PROBLEM
You signed with one company. Today it may belong to someone else.
Vendors get bought, taken private or folded into foreign groups. Your contract stays the same. Your exposure does not. Most firms find out at renewal, after an incident, or when the regulator asks.
WHY NOW
$2.85 trillion of deals in the first half of 2026, a record. Technology was the biggest sector.
Governments are watching too: the US reviewed 347 foreign investment filings in 2025, and the UK received 1,324 national security notifications on acquisitions in 2025–26.
Technology, the largest sector
All other sectors
Tech deal value up 90% year on year
US targets: 54% of the global total. Europe more than doubled.
WHAT IS AT STAKE
A new owner inherits your contract, not your priorities.
It can raise prices, retire products, move your data abroad and bring sanctions questions to your door.
Attackers go through suppliers.
US cybercrime losses hit $20.9 billion in 2025, up 26% (FBI). A new owner means merged systems and new hands on your access.
HOW IT HAPPENS
One acquisition. No change to the contract. A new jurisdiction now sits behind your endpoint security, and your file still says Luxembourg.
Illustrative example with fictional data.
WHY TODAY'S APPROACH FALLS SHORT
Regulators in the US, EU, UK and Australia expect you to know who owns your vendors. Most firms check once, at onboarding, on the vendor's word. Then nobody looks again.
A BETTER WAY
Verify who really controls each vendor. Focus on the ones you cannot afford to lose. Decide in advance what a change of owner triggers.
How Vendor Exposure helps
See who really controls it
Ultimate owner, jurisdiction and data locations for every vendor, traced and sourced.
Weighted to your business
Exposure judged by how critical each vendor is to you and whether it holds your sensitive data.
Eight exposure areas, one view
Sanctions, ownership, jurisdiction, resilience, cyber hygiene, supply chain, financial stability, regulatory alignment.
Evidence you can use
Dated, sourced findings for your board, auditors and regulator.
HOW IT WORKS
- 01
Context
Answer two questions per vendor, select your sector and choose your priorities.
- 02
Review & order
Add your organisation name, review your plan and place your order.
Start with the vendors you can least afford to lose.
Send your vendor list. Answer two questions per vendor. See where you are exposed.
Download the PDF