Strategic acquirers
Your corporate development team needs to know what you are inheriting and what it will take to connect the target to your network safely, before the purchase agreement is final.
Risk & security programs
M&A cybersecurity due diligence
You are about to buy a company, and with it every unpatched server, every undisclosed breach and every compliance obligation it carries. Cybersecurity due diligence gives your deal team a clear view of the target’s security posture and exposure, translated into what it means for price, deal terms and the work after closing — and if you are the company being sold, a chance to find and fix those issues before a buyer does.
Formal outcome from
No certificate — the result is a findings report your deal team can act on
Who asks for it
Private equity sponsors and investment committees · Corporate development teams at strategic acquirers
Our role
Readiness — we help you build it and prove it
Your organization — readiness viewEvery requirement, an owner and its evidence
Readiness- SCOPEScope and system boundaryReady
- RISKRisk assessment and registerReady
- ACCESSAccess reviews, with evidenceGap · owner set
- CHANGEChange managementClosing
- VENDORVendor managementGap · owner set
- TESTPenetration test evidenceReport in hand
Handed to the assessor you choose — the opinion is theirs
Gaps found before the audit
Who it’s for
Why M&A due diligence lands on your desk.
When you acquire a company you acquire its security history. A breach that began before closing becomes your breach, its regulatory penalties and notification costs become your costs, and its weak network becomes a path into yours once the two are connected. Public cases such as Marriott’s acquisition of Starwood, where an intrusion that began years before the deal was discovered after it, and Verizon’s reduced price for Yahoo’s operating business after breaches came to light, are why investment committees and their insurers now treat cyber as a standard diligence workstream.
Cyber diligence is different from an audit. You usually work from a data room, management interviews and what can be observed from outside, under deal confidentiality and pressure, and the target may not allow active testing before signing. The aim is not a complete inventory but a judgment: what the material risks are, how confident you can be, and what the deal should do about them — adjust price, add specific representations or indemnities, require remediation before closing, or plan for it afterward.
Representations and warranties insurance underwriters review the scope and quality of the buyer’s diligence, and policies commonly exclude known issues and areas that were not diligenced. Lenders and limited partners ask the same questions. For targets, the same lens works in reverse: sell-side readiness lets you understand and address what a buyer will find, so security doesn’t become a reason to cut the price late in the process.
Who asks for it
Private equity sponsors and investment committeesCorporate development teams at strategic acquirersRepresentations and warranties insurance underwritersLenders and limited partnersFounders and boards preparing to sell
Private equity firms
You need a consistent, deal-ready view of cyber risk across targets, findings your investment committee can weigh, and a post-close plan for portfolio companies that may have no security team of their own.
Companies preparing to sell
You want to know what a buyer’s diligence will uncover and fix the worst of it first, with a documented security posture and clean answers ready for the data room.
Deal counsel and underwriters
You need specific, evidence-based findings to draft representations, specific indemnities and closing conditions, and to understand where insurance coverage may be limited.
Who certifies
No certificate exists. The proof is yours to build.
Formal outcome from
No certificate — the result is a findings report your deal team can act on
What they produce
A cyber due diligence report and risk rating for the deal team, counsel and underwriters, or a sell-side readiness report for a target
Where readiness fits
No body certifies a company’s cyber posture for a transaction. What matters is an independent view, with no stake in whether the deal closes, that your counsel can turn into terms and your integration team can turn into a post-close plan.
NIST Cybersecurity Framework (CSF) 2.0 CIS Critical Security Controls v8.1 NIST SP 800-30 Rev 1 — Guide for Conducting Risk Assessments SEC Form 8-K Item 1.05 and Regulation S-K Item 106 (inherited disclosure obligations) PCI DSS v4.0.1, the HIPAA Security Rule, GDPR and US state privacy laws (inherited obligations) ISO/IEC 27001:2022 Annex A (control reference)
What it covers
What M&A due diligence readiness covers.
- Security governance, leadership, policies and program maturity
- External attack surface: exposed services, domains, certificates, cloud assets and forgotten systems
- Vulnerability posture of internet-facing systems
- Breach and incident history, including incidents that were never disclosed
- Dark-web exposure: leaked credentials, data offered for sale and mentions of the target
- Identity and access: MFA coverage, privileged accounts, shared and service accounts
- Inherited compliance obligations: PCI DSS, HIPAA, state privacy laws, GDPR, SEC disclosure, CMMC and contractual security commitments
- Sensitive data inventory: what personal, payment, health and confidential data the target holds and where
- Technical debt: end-of-life systems, unsupported software and unpatched infrastructure
- Third-party and supply-chain exposure, including critical SaaS and outsourced IT
- Product security for technology targets, including open-source use and secure development practices
- Backup, recovery and incident response capability
- Integration and Day-One risks: network connectivity, identity federation, transition services and carve-out separation
- Cyber insurance coverage, claims history and policy terms
What you receive
What you have in hand when readiness is done.
Due diligence request list
A cybersecurity request list and management-interview guide fitted to the target’s size, sector and business model, so the data room answers the questions that matter.
External exposure review
An outside-in view of the target’s internet-facing footprint and credential exposure, drawn from passive sources and, where the target authorizes it, active scanning.
Cyber due diligence report
Findings rated by severity and likelihood, with the confidence level and the evidence behind each, written for an investment committee rather than for engineers.
Deal implications summary
How each material finding could bear on the deal — price, specific representations and warranties, indemnities, escrow or holdback, closing conditions or pre-close remediation — for discussion with your counsel.
Inherited obligations register
The compliance and contractual security obligations that transfer with the target, and where it falls short of them today.
Integration risk assessment
What must be true before the target connects to your network or identity systems, including Day-One controls and transition-services considerations.
Post-close remediation plan
A prioritized set of security improvements for after closing, with owners and relative effort, that your integration or portfolio-operations team can run.
Sell-side readiness report
For companies being sold: what a buyer’s diligence is likely to find, what to fix first, and a security narrative and evidence pack for the data room.
Common gaps
What a M&A due diligence readiness review tends to surface.
Better found now, by people on your side, than by your assessor.
Incidents handled informally and never documented or disclosed
Internet-facing systems no one at the target knew were still running
MFA missing on remote access, email or administrative accounts
Employee credentials circulating in breach data and on criminal marketplaces
Customer contracts with security commitments the target does not meet
End-of-life operating systems and applications running critical processes
Security knowledge held by a single person or an outsourced provider with no documentation
Personal or payment data stored in places the target’s compliance program never accounted for
Where testing fits
The tests M&A due diligence calls for, from the same team.
External network pentest
With the target’s written authorization, an external penetration test shows whether its internet-facing exposure is actually exploitable — evidence that turns a concern into a finding the deal can price.
What the test coversVulnerability assessment
A vulnerability assessment across the target’s external or internal estate gives a broad read on patching and technical debt, before or after closing.
What the test coversWeb application pentest
For software and SaaS targets, testing the product itself shows whether the asset you are paying for carries security flaws your new customers will eventually find.
What the test coversCloud configuration review
A cloud configuration review at or after closing shows how the target’s cloud accounts are really set up — identity, logging, exposure and backups — before you connect them to yours.
What the test covers Questions
What buyers ask about M&A due diligence.
When should cyber diligence start?
As early as the deal allows. Findings are most useful while price and terms are still open; a material issue discovered after signing can only be handled through the representations and indemnities you already negotiated. Outside-in work can begin before the target engages, and deeper review follows once the data room opens and management is available.
Can the target’s systems be tested without its knowledge?
Passive review of public information — exposed services, domains, certificates and leaked credentials — needs no access to the target’s systems. Active testing, including scanning and penetration testing, always requires the target’s written authorization, which is normally arranged through the deal process once both sides agree to it.
What happens if diligence finds a serious issue?
It becomes a deal decision. Depending on severity, your counsel may seek a price adjustment, a specific indemnity, an escrow or holdback, a closing condition that requires remediation, or specific representations. Some findings simply go into the post-close plan. Occasionally a finding, such as evidence of an active compromise, changes whether the deal should proceed at all.
Does representations and warranties insurance cover cyber issues?
It can cover breaches of the representations about the target’s security, but underwriters typically exclude issues the buyer already knew about and may narrow or exclude cyber coverage when diligence was thin. A documented, well-scoped diligence process supports broader coverage; the coverage decision itself belongs to the underwriter and the policy terms.
We are selling our company. Why prepare?
Because the buyer will look, and late surprises cost you leverage. Sell-side readiness finds what diligence will find — exposed systems, missing MFA, undocumented incidents, unmet customer commitments — while you can still fix it or explain it on your own terms. A prepared security narrative and evidence pack also cuts down the back-and-forth once buyers are in the data room.
Who is the report written for?
The investment committee, deal counsel and underwriters first, with a technical appendix for the integration and security teams who inherit the findings. Many acquirers commission cyber diligence through outside counsel; whether that structure affects privilege is a question for your attorneys.
Is M&A due diligence on your desk?
One conversation with someone who does this work. You leave knowing where you likely stand and what readiness would involve for you.