Before you sign, you’ll know how exposed the target really is: the security gaps, the compliance it can’t prove, and what it will cost to fix. Clear findings your deal team can price in, in as little as 3–5 days.
Before the LOI through signing
3–5 days to 3 weeks, by scope
Risk heat map, cost to fix and a security roadmap
Deal teams, operating partners and corporate acquirers
Diligence
Day 1
TSA exit
Integration
M&A cyber due diligence is the review of a target company’s security before a deal closes: how well its systems and data are protected, which compliance obligations it meets, and what it would take to close the gaps. It tells the buyer how much risk comes with the company, what that should mean for the price, and what to fix first.
Most targets have gaps. The point is to find them while they can still change the deal, through the price, the reps and warranties or the 100-day plan, rather than in the first incident after close.
Is the security program strong enough for every add-on to plug into?
What comes onto the platform’s network the day we connect them?
Which security controls stay with the parent, and what replaces them at TSA exit?
Can the target prove HIPAA, PCI, SOC 2 or CMMC compliance when customers ask?
Is the product secure, and is its code tested before it ships?
Will the next buyer’s diligence find gaps that cut the price?
Four areas, reviewed together, so a gap in one shows up in the cost and the plan for the others.
Information security program and policies
Cyber risk governance and oversight
In-house team, MSP or MSSP
Security awareness training
Vendor and third-party risk
Is anyone really running security?
Are policies written down and followed?
MFA, single sign-on and access control
Email security
Cloud and network security
Patching and end-of-life systems
Vulnerability and penetration testing
How easy would it be to get in?
What is exposed to the internet?
HIPAA, GDPR and GLBA
SOC 2, ISO 27001, PCI-DSS and FFIEC
CMMC Level 1 and 2 (NIST 800-171)
Personal data inventory and handling
Accuracy of the cyber-insurance application
Can the target prove compliance?
Does the insurance application match reality?
24/7 monitoring and detection
Incident response plan and history
Backups and disaster recovery testing
Application security and code review
Business continuity
Would anyone notice an attack?
How fast could the business recover?
AI is part of the review: how sensitive data reaches AI tools, how AI models are secured, and the risk from third-party AI providers.
Few of these stop a deal. Each comes with a cost to fix and a recommendation on where to deal with it: in the price, before close or in the 100-day plan.
A cost the deal model should carry
Ask the seller to fix it, or cover it in the terms
A first priority after close
Controls added after incidents rather than by design, and no one accountable for security. Building it properly is a cost the model should carry.
Controls claimed on the application, such as MFA or tested backups, that aren’t actually in place. Best corrected before close.
No MFA or conditional access, and email that’s easy to phish. The most common way in, and usually quick to fix.
Critical workloads on servers past end of support, and workstations nobody patches. Replacement and remediation belong in the numbers.
Customers, regulators or contracts expect SOC 2, PCI, HIPAA or CMMC, and the evidence isn’t there. Closing the gap takes time and budget.
No 24/7 monitoring or detection, and an MSP that reacts rather than prevents. A gap to close early in the hold.
Disaster recovery plans that are out of date or never tested, so one ransomware event could stop the business.
No security operations expertise in-house, one person holding the keys, and staff who have never had awareness training.
Employees using AI tools with company or customer data, and no AI policy, owner or approved tools. An AI maturity assessment and an AI policy belong early in the hold.
Every finding lands on a risk heat map with a cost to fix, so the deal team sees what matters first.
The same repeatable sequence as our IT due diligence, refined across 300+ diligences, with the security assessment at its core.
Request list, data room and a first read on the security posture.
Interviews with the IT and security leads, and a risk heat map across the program, identity, compliance and recovery.
Findings, the cost to fix and a security roadmap, read out to the deal team, with support on the rep and warranty call.
A gap found before close is a line in the plan. Found after close, it’s an incident. Here are three security stories, and what a sponsor said afterwards.
Diligence found that a $150M firm serving top-20 U.S. banks had no real security program. After close, we built one to FFIEC banking standards, and the company passed its banking audit with zero findings.
Read the case study →
When a breach hit a PE-backed manufacturer with no security program, we guided leadership through the investigation, rebuilt its defenses and now run its security around the clock.
Read the case study →
An assessment of a PE-backed plumbing and restoration company with 950 users found no MFA, end-of-life servers running the accounting system and workstations nobody patched. We closed every gap and now run its IT and security around the clock.
Read the case study →The team understands the PE playbook, focusing early on the critical areas that impact our investment decision, and builds strong rapport with management.
Partner, PE firm with $1B AUMSomething we haven’t covered? A partner can answer it on a short call.
M&A cyber due diligence is the review of a target’s security before a deal closes: its security program and policies, identity and infrastructure, compliance and privacy, and how well it would detect and recover from an attack. The output is a risk heat map, the cost to fix each gap and a security roadmap.
For a buyer, the point is the terms. Findings can support a purchase price adjustment, shape the reps and warranties and set the first priorities after close. See how it fits with the rest of our M&A IT services.
Security is one of the five lenses in every IT due diligence. A dedicated cyber due diligence goes further: compliance evidence, the accuracy of the cyber-insurance application, detection and response, recovery testing and, where the target agrees, vulnerability testing.
It’s worth the extra depth when security is central to the deal, for example a target that handles health, financial or defense data, sells software, or has had an incident.
A red-flag review takes three to five days and can run before the LOI, using the CIM, the management presentation and an interview with the IT or security lead. A full review takes two to three weeks.
Starting early leaves time to negotiate on what diligence finds, rather than discovering it after close.
Every report includes findings and recommendations, a security risk heat map and the cost to fix each gap, with a prioritized security roadmap. For cyber due diligence for private equity, each finding is tied to the deal: what belongs in the price, what to fix before close and what goes in the 100-day plan.
Findings are presented to the deal team in a read-out, and we join the rep and warranty call.
When the target agrees and the timeline allows, vulnerability scanning and penetration testing can be part of the review. Before signing, many targets limit access, so most findings come from documents, interviews and the controls we can verify.
Where testing can’t happen before close, it becomes one of the first steps in the 100-day plan.
The roadmap becomes the plan. We can lead the security work after close as the company’s fractional CISO, run 24/7 monitoring and response, and take it through SOC 2, PCI, HIPAA or CMMC readiness. See our private equity cybersecurity services.
For an add-on, the findings also feed the M&A IT integration, so security gaps are closed before the networks are connected.
What the target’s IT will really cost to run, fix, separate or integrate, before you sign.
Whether the ERP can carry the investment thesis, before signing or after close.
Separation design, TSA scope and governance, Day 1 cutover and an early exit from the TSA.
Day 1 readiness, then moving the add-on onto the platform’s systems.
One office running every workstream for carve-outs, ERP integrations and other transactions.
AI readiness, maturity, governance and training, tied to EBITDA.
Start with a red-flag review: three to five days, a clear view of the security gaps, and what they’re likely to cost to fix.
