A review of 1,982 NYC investment firms found most run without dedicated IT staff as attacks on the sector continue.
NEW YORK – Manhattan Managed IT Services (MMITS), a managed IT services provider in Manhattan, has released an analysis of IT staffing at New York City private equity (PE) and venture capital (VC) firms. Of the 1,982 firms reviewed, 76% list no in-house IT staff. The company shared the findings alongside guidance for investment firms facing continued social engineering attacks and expanded SEC data protection requirements.
Most Firms Run Without Dedicated IT Staff
The analysis, conducted in November 2026, covered New York City VC and PE firms with between 1 and 500 employees. It found that 1,506 firms (76%) list no IT employees, 293 firms (15%) have exactly one and 183 firms (9%) have two or more. Among the 476 firms with any IT staff, 62% rely on a single person.
MMITS describes that single-person setup as a point of failure: one employee handles help desk requests, security tools, vendors and projects, with no one to cover vacations or sick days. The data came from a LinkedIn Sales Navigator search, and IT staffing counts the employees LinkedIn lists in each firm’s IT function. Firms whose IT staff are not on LinkedIn may be undercounted. The figures also cover in-house employees only, so many firms without IT staff likely rely on outside providers.
Social Engineering Attacks Reach Private Equity
The staffing picture matters because attackers are targeting investment firms through their people rather than their software. Apollo Global Management disclosed in August that attackers used social engineering to reach some of its cloud platforms between July 6 and July 10, 2026, exposing names, dates of birth, home addresses and Social Security numbers. Google Threat Intelligence Group has also reported on a group it tracks as UNC6671, which relies mainly on voice phishing and targets financial services firms and enterprise cloud environments.
The cost of these incidents is significant. A February 2026 Kroll survey of 325 PE executives put the average financial impact of a cyber incident at $2.1 million, with a 53% chance that a firm loses more than $500,000 and a 13% chance that losses exceed $5 million. Kroll also found that mid-market and smaller PE firms are less developed in cyber risk governance than larger firms.
Capital Calls and Investor Data Raise the Stakes
PE firms hold information that attackers value: limited partner records containing Social Security numbers, bank details and tax documents, along with deal data shared through data rooms with outside counsel and advisers. Capital calls and distributions add wire fraud risk, since a compromised email thread can be used to send investors altered payment instructions.
MMITS recommends call-back verification using a phone number already on file, dual approval for wires above a set threshold, SPF, DKIM and DMARC email authentication, and a secure investor portal in place of emailed payment details.
Amended Regulation S-P Adds Documentation Requirements
Compliance obligations have also grown. The SEC’s 2024 amendments to Regulation S-P require covered firms to maintain a written incident response program, notify affected individuals within 30 days of certain incidents involving sensitive customer information, oversee service providers that handle customer information and keep records of compliance. Larger entities had to comply by December 3, 2025. Smaller entities, including registered investment advisers with less than $1.5 billion in assets under management, had to comply by June 3, 2026. The SEC has indicated that the amendments will be an examination priority.
Exempt reporting advisers and private funds are not covered by the amendments but remain subject to the FTC’s Regulation P and Safeguards Rule. MMITS encourages firms to confirm their obligations with compliance counsel.
How MMITS Supports Investment Firms
MMITS provides help desk support, device management, Microsoft 365 and Google Workspace administration, SentinelOne endpoint detection and response, NinjaRMM monitoring, cloud security monitoring, independent Microsoft 365 and Google Workspace backups, and security awareness training with simulated phishing. Clients also receive quarterly vCIO guidance on budgets, security questionnaires and technology planning, along with on-site support from MMITS’s office in Manhattan. The company reports that support tickets typically receive an initial response within 10 minutes.
For firms that already employ an IT lead, MMITS positions its service as a complement rather than a replacement, handling monitoring, security tooling, vacation coverage and overflow work. The full staffing analysis and an overview of managed IT support for private equity firms in Manhattan are available at https://manhattanmanageditservices.com/managed-it-support-for-private-equity-firms-in-manhattan/.
With smaller advisers now covered by the amended Regulation S-P and social engineering campaigns still targeting the financial sector, the coming year is a natural point for New York investment firms to review who is responsible for their IT security.
About Manhattan Managed IT Services
Manhattan Managed IT Services (MMITS), a Cetusdata company, is a managed IT services provider serving businesses in Manhattan. The company provides IT support, managed cybersecurity, IT consulting and technology planning through a high-touch service model that combines day-to-day support with technology lifecycle management and quarterly vCIO guidance. MMITS works with organizations in industries with demanding security and uptime requirements, including healthcare, legal and accounting.
Contact Information
Manhattan Managed IT Services – MMITS
1140 6th Ave FL 9 Suite 1052B
New York, NY 10036
Phone: +1 (646) 328-6307
Website: manhattanmanageditservices.com
Media gallery
