M&A Cyber Due Diligence
Every acquisition carries inherited cyber risk. Undisclosed breaches, unpatched infrastructure, poor security posture — these become your problem at close. We assess it honestly before you commit.
Written by Simon Lynge, Director DFIR — ChCSP, CREST IR | Last updated: March 2026
What You Don't Know Can Cost You the Deal
Cyber security is consistently underweighted in M&A due diligence — until an undisclosed breach surfaces post-close, a ransomware group lists the target on a leak site mid-transaction, or regulators investigate data practices that predated the acquisition.
These are not hypothetical risks. We have remediated exactly these situations post-acquisition. The cost — financial and reputational — always dwarfs what a proper pre-close assessment would have cost.
Our M&A Cyber DD Scope
Dark Web & Threat Intelligence Sweep
Before any technical assessment, we run a targeted dark web and threat intelligence sweep of the target organisation — hunting for existing breach disclosures, credential leaks, data already published on leak sites, and any threat actor targeting activity. This takes 48–72 hours and frequently exposes material risks invisible from inside the organisation.
Security Posture Assessment
- External attack surface — internet-facing assets, exposed services, unpatched vulnerabilities
- Active Directory security posture and privilege model
- Cloud configuration review (Azure, AWS, M365)
- Email security (SPF, DKIM, DMARC, impersonation risk)
- Backup architecture and ransomware recovery capability
- EDR/AV coverage and endpoint security tooling
- Patch management currency
Regulatory & Compliance Review
- GDPR compliance posture and data processing inventory
- Historic ICO enforcement or investigations
- Cyber insurance coverage and claims history
- Third-party / supply chain risk exposure
- Contractual cyber obligations (PCI, sector-specific)
Incident History Review
We review available incident logs, breach notification history, and where access is granted, endpoint and network telemetry — looking for indicators of compromise that may indicate past or current unauthorised access that has not been disclosed or detected.
Deliverables
- Red/Amber/Green risk summary — board and dealmaker-ready, structured around deal risk categories
- Technical risk register — prioritised findings with remediation cost estimates
- Reps & warranties input — supporting your legal team's cyber-specific representations
- Post-close remediation roadmap — if the deal proceeds, a prioritised plan to close the gaps
Timeline & Confidentiality
We work to deal timelines. Assessments complete within standard due diligence windows — typically 2–4 weeks for full scope, or 5–7 days for accelerated light-touch assessments where time is the constraint.
All work is conducted under strict NDA. Target organisations need not be informed of our engagement at the initial assessment phase if deal sensitivity requires it.