What Is M&A Cyber Due Diligence?
M&A cyber due diligence assesses a target's cybersecurity posture before acquisition.
What M&A Cyber Due Diligence Covers
Cyber due diligence is an assessment of the target organization's cybersecurity posture, historical incident activity, regulatory compliance status, and technical security controls. A comprehensive cyber due diligence program evaluates: the attack surface (what external-facing systems exist and what vulnerabilities they carry), identity and access controls (how authentication is managed, whether privileged access is controlled, what the MFA coverage is), endpoint security (EDR deployment, patch currency, device management), cloud environment security (IAM configuration, storage access controls, logging), email security, network architecture and segmentation, incident history and current threat indicators, and the people and processes that make security controls operational.
The Information Access Problem
Cyber due diligence is complicated by information access constraints. Unlike financial due diligence where the target provides documents for review, cyber due diligence ideally involves direct technical access to evaluate controls — read-only access to cloud management consoles, Microsoft 365 security configurations, network diagrams, and system inventory. Pre-letter-of-intent access is limited; post-LOI access varies by seller willingness and deal structure. Independent technical assessment that does not require seller cooperation — external attack surface enumeration, DMARC and DNS analysis, OSINT gathering — provides initial signal regardless of access constraints.
What Cyber Due Diligence Finds
In Cloudskope's experience across hundreds of M&A cyber due diligence engagements, the most common material findings fall into consistent patterns. Credential exposure — executive or privileged account credentials in breach databases accessible to threat actors — appears in a significant majority of engagements. Unpatched critical vulnerabilities in internet-facing systems appear consistently in organizations whose IT teams do not have formal vulnerability management programs. Cloud misconfiguration — publicly accessible storage, administrative accounts without MFA, overly permissive IAM policies — appears in virtually every cloud environment assessment. Historical compromise indicators — evidence of past attacker presence that the organization was not aware of — appear in a meaningful percentage of engagements with organizations that lack mature detection capabilities.
How Cyber Findings Affect Deal Terms
The business impact of cyber due diligence findings depends on the nature of the finding, the target organization's sector, and the deal's specific circumstances. Material findings typically affect deals in several ways. Purchase price adjustment — significant cyber liabilities, remediation costs, or historical breach exposure may reduce the purchase price to account for the risk being acquired. Representations and warranties — the target may be required to provide specific cybersecurity representations and warranties with associated indemnification obligations. Pre-close remediation — specific security improvements may be required as a condition of close. Post-close obligations — escrow arrangements or specific remediation timelines may be established for issues identified that cannot be resolved before close. And in some cases, material findings are go/no-go factors when the exposure is significant enough that the risk cannot be appropriately priced.
Related Reading
The Technology Due Diligence Cluster
This article is part of Cloudskope's technology due diligence series for private equity sponsors and corporate acquirers.
What is M&A cyber due diligence?
M&A cyber due diligence is the assessment of a target company's cybersecurity posture, exposure, and prior incident history during a merger or acquisition process. It identifies cyber risks that could materially affect deal value — known and unknown breaches in progress, regulatory exposure from non-compliance, security debt requiring significant post-close investment, and operational risks that could disrupt the combined business. Cloudskope conducts cyber DD as a standard component of PE technical due diligence alongside operational and financial DD.
Why is cyber due diligence important in M&A?
Cybersecurity issues identified after close become acquirer problems. The Marriott-Starwood acquisition exposed Marriott to a $124M GDPR fine for a breach that began at Starwood years before acquisition and was discovered post-close. Yahoo's two undisclosed breaches reduced its acquisition price by $350M when discovered during Verizon's diligence. Pre-close cyber DD identifies these exposures while they remain negotiable items rather than absorbed liabilities.
What does cyber due diligence cover?
Standard scope includes: prior incident history and breach disclosure review, identity security maturity (MFA coverage, privileged access management, identity governance), endpoint and network security posture, cloud security configuration, vendor risk and third-party access, regulatory compliance status (relevant frameworks for the target's industry), incident response capability, and a threat model assessment of the specific attack types the target faces. Specialized engagements add OT/ICS assessment, AI risk assessment, or specific regulatory deep-dives.
How long does cyber due diligence take?
Standard mid-market cyber DD takes 2-4 weeks depending on target complexity, document availability, and access to target personnel. Pre-LOI light DD (1 week) provides directional findings sufficient for go/no-go decisions. Confirmatory DD before signing (3-4 weeks) provides the detailed findings that inform reps and warranties, escrow sizing, and post-close remediation roadmaps. Limited carve-out diligence (operational separation of cyber assets) can extend timeline depending on scope.
What are the most common cyber DD findings?
The most common material findings: incomplete MFA coverage (privileged accounts protected, but service accounts and legacy systems exempted); EDR deployed but unmonitored or in alert-only mode; over-permissioned cloud IAM with broad service account access; SOC 2 reports with significant exceptions that buyers overlooked; orphaned accounts and contractor access never deprovisioned; vendor access without inventory or governance; and undocumented prior security incidents discovered through artifact review rather than disclosure. Approximately one in five mid-market cyber DD engagements surfaces a material undisclosed prior incident.
What is the difference between cyber DD and a security audit?
Cyber DD focuses on M&A-relevant risk — what could affect deal value, what creates post-close liability, what requires investment to remediate. A security audit assesses compliance with specific control frameworks (SOC 2, ISO 27001, NIST). Cyber DD asks "what would we inherit?"; an audit asks "do they meet this standard?" The two overlap but the deliverables, audiences, and timelines differ significantly. PE sponsors and corporate development teams use cyber DD; compliance organizations use audits.
How does cyber DD affect deal value?
Findings translate into deal-economic outcomes in several ways: explicit price adjustments for material exposure (the Yahoo-Verizon precedent); enhanced reps and warranties with specific carve-outs for cyber issues; escrow amounts sized to cover known remediation costs; post-close transition service agreements that allocate cyber responsibility; and walk-away findings when discovered exposure exceeds appetite. The most common outcome is not a walked deal but adjusted deal mechanics that allocate cyber risk to the appropriate party.
Real-World Example: Yahoo and Verizon — The $350M Breach Discount
In 2016, Verizon agreed to acquire Yahoo for $4.83 billion. During due diligence, Yahoo disclosed a breach that exposed 500 million accounts in 2014. Subsequent investigation revealed a second breach — 3 billion accounts in 2013 — that had not been disclosed. Verizon renegotiated the deal, ultimately acquiring Yahoo at a $350 million discount from the original price. The breach disclosure and renegotiation delayed the deal by months and resulted in legal proceedings that continued for years after close. The Yahoo case established the principle that undisclosed cyber incidents are material to deal valuation and that acquirers have recourse when material cyber information is not disclosed in due diligence.
Average cost of a data breach discovered post-acquisition that originated pre-close — not including purchase price impact, indemnification disputes, or regulatory liability. Cyber due diligence costs a fraction of this. The ROI is unambiguous.