How cyber due diligence works
Cyber due diligence runs alongside financial and legal diligence, inside the same exclusivity window. The goal is simple: know what you are buying before you sign the purchase agreement, and turn what you learn into deal terms. Here is how an engagement moves from LOI to close to the first 100 days.
1. Scope inside the exclusivity window. Once the LOI is signed and the 30-to-45-day exclusivity window opens, we agree with the deal team on what matters for this thesis: carve-out, platform add-on, distressed asset or standalone platform. Scope, access requests and reporting dates are set against your signing and closing dates.
3. Data room and management interviews. We review the IT and security documents in the data room, then hold structured interviews with the target's IT lead and, where relevant, its MSP. We note every claim that will need proof: MFA everywhere, tested backups, current patching, compliance status.
4. Read-only technical validation. With access granted, we test those claims directly using read-only telemetry and automated cloud scanners. Nothing is changed in the target's environment and daily operations are not disrupted. The standard deep-dive takes 2 to 3 weeks from access to final report.
5. Compromise assessment. In parallel, we look for signs an attacker is already inside: backdoors, persistence and compromised admin accounts. If we find an active threat, we notify the deal team immediately, ahead of any written report.
6. Findings tied to deal terms. Each material finding is written so counsel and the deal team can use it. Depending on severity, a finding can support: a purchase price adjustment for unbudgeted remediation or replacement cost; an escrow or holdback released when specific remediation is complete; targeted representations and warranties on security, incidents and data handling, with the understanding that R&W insurance generally excludes issues the buyer already knows about; a specific indemnity for a known issue, such as losses tied to a pre-close compromise; a closing condition or pre-close covenant, such as MFA enforced on all admin accounts or an active intrusion contained before funds move.
7. The 100-day plan. Findings become a prioritized roadmap of what to fix on Day 1, by Day 30 and by Day 100, with budget and resourcing needs, so the operating partner and the portfolio company's IT team can start the day the deal closes.
What it looks like in practice
Illustration: a typical pattern we see. This is a composite, not a single client. Names, figures, industries, dates and anything that could identify an organization are left out on purpose.
The seller hands over a clean IT report written by its own MSP. It says MFA is enforced for all users, backups are in place and systems are current. The management interview tells the same story.
Read-only validation tells a different one. Several admin accounts sit outside the MFA policy, including one belonging to a person who left the business and one shared by an outside vendor. A server that runs a core business application is on an operating system the vendor no longer supports, and replacing it means re-platforming the application. Backups exist, but nobody has tested a full restore. The compromise assessment finds no active attacker, but the unmanaged admin accounts are exactly the kind of access an attacker would use.
None of this kills the deal. It changes the terms. The buyer negotiates a holdback sized to the cost of replacing the unsupported system, released when the work is done. Counsel adds a specific indemnity for any losses from a compromise that started before close. Enforcing MFA on every admin account and removing the stale ones becomes a condition of closing. The rest goes into the 100-day plan: the platform replacement, a tested restore and a move to managed endpoints, each with an owner and a date.
The buyer closes knowing what it bought, with the seller paying for the gap the clean report did not show.
