// M&A Cyber Due Diligence

M&A Cyber Due Diligence

Every acquisition carries inherited cyber risk. Undisclosed breaches, unpatched infrastructure, poor security posture — these become your problem at close. We assess it honestly before you commit.

What You Don't Know Can Cost You the Deal

Cyber security is consistently underweighted in M&A due diligence — until an undisclosed breach surfaces post-close, a ransomware group discloses the target on a leak site mid-transaction, or regulators open an investigation into data practices that predated the acquisition.

These aren't hypothetical risks. We have been engaged post-acquisition to remediate exactly these situations. The cost — financial and reputational — far exceeds what a proper pre-close assessment would have identified.

Our M&A Cyber DD Scope

Dark Web & Threat Intelligence Sweep

Before any technical assessment, we run a targeted dark web and threat intelligence sweep of the target organisation — looking for existing breach disclosures, credential leaks, data already published on leak sites, and any threat actor targeting activity. This takes 48–72 hours and frequently surfaces material risks that are not visible from inside the organisation.

Security Posture Assessment

  • External attack surface — internet-facing assets, exposed services, unpatched vulnerabilities
  • Active Directory security posture and privilege model
  • Cloud configuration review (Azure, AWS, M365)
  • Email security (SPF, DKIM, DMARC, impersonation risk)
  • Backup architecture and ransomware recovery capability
  • EDR/AV coverage and endpoint security tooling
  • Patch management currency

Regulatory & Compliance Review

  • GDPR compliance posture and data processing inventory
  • Historic ICO enforcement or investigations
  • Cyber insurance coverage and claims history
  • Third-party / supply chain risk exposure
  • Contractual cyber obligations (PCI, sector-specific)

Incident History Review

We review available incident logs, breach notification history, and where access is granted, endpoint and network telemetry — looking for indicators of compromise that may indicate past or current unauthorised access that has not been disclosed or detected.

Deliverables

  • Red/Amber/Green risk summary — board and dealmaker-ready, structured around deal risk categories
  • Technical risk register — prioritised findings with remediation cost estimates
  • Reps & warranties input — supporting your legal team's cyber-specific representations
  • Post-close remediation roadmap — if the deal proceeds, a prioritised plan to close the gaps

Timeline & Confidentiality

We are accustomed to deal timelines. Assessments can be structured to complete within standard due diligence windows — typically 2–4 weeks for full scope, or 5–7 days for accelerated light-touch assessments where time is the constraint.

All work is conducted under strict NDA. Target organisations need not be informed of our engagement at the initial assessment phase if deal sensitivity requires it.

Assessing an Acquisition Target?

We'll tell you what cyber risk you're inheriting — before you inherit it.

⚡ Discuss Your Deal