M&A Cybersecurity Due Diligence
When you buy a company, you can inherit whoever is already inside it. We assess the target before any network, identity, data, tooling or device join — and tell your deal team which lever each finding may bear on.
Book a ConsultationAssess before you connect
In 2017 Verizon cut the price of Yahoo’s operating business by $350 million after Yahoo’s data breaches came to light — and the SEC later found that Yahoo’s due-diligence questionnaire had listed only four minor breaches. What a target discloses is not the same as what an assessment finds.
The bigger risk often arrives after closing. The US Cyber Safety Review Board’s 2024 report on Microsoft describes a device from an acquired company, believed to have been compromised before the acquisition, being given corporate credentials afterwards — and recommends compromise assessments of acquired companies. In 2021 the FBI warned that ransomware actors were very likely using mergers and acquisitions to target victims.
So we recommend you hold every join — network, identity, data, tooling and devices — until the target has been checked for an attacker already inside and agreed minimum conditions are evidenced. Timing is set by law as well as by risk: before closing, merger-control rules limit how far a buyer can reach into a target, so the work is phased across the deal.
Phased across the deal
Before signing
A passive outside-in review of public and licensed sources, then data-room review and interviews on breach history, incident response, identity, cloud, third parties, SaaS and cryptography. Each answer is marked verified, target-asserted or not answered.
Before closing
Confirmatory work the target authorises, within limits counsel has cleared. You see a cleared summary through clean-team channels. The target keeps every operational decision.
The integration gate
After closing, a compromise assessment of identity, privileged access, edge, endpoints, cloud, SaaS, data stores and backups, with a coverage statement — then each join’s minimum conditions, with trust direction, monitoring and a tested way to disconnect, evidenced for your decision.
After closing & portfolios
A 100-day remediation plan sized in effort bands, and for private equity sponsors the same measures in every portfolio company, every year, with a status for each measure and no single score.
Built for deal teams
Only the target can authorise testing
Before closing, a buyer cannot authorise testing of systems it does not yet control. We test the target’s systems only with the target’s written authorisation, and say plainly what each phase can and cannot cover.
Deal levers, not verdicts
We name the lever each finding may bear on: whether to proceed on the current basis, price or indemnity, a step for the target before closing, or a fix after closing. Gaps are marked not assessed; items to resolve before a join opens are flagged. We never put a number on valuation.
Two documents
A short summary for the deal team and counsel, and a restricted technical annex for the people who will fix things. If the deal does not proceed, we destroy the target’s evidence and the annex, and confirm that to the target.
Clear boundaries
We decline defence, aerospace, government-contractor and public-sector targets, and we act for one side per deal: never buyer and seller, never two bidders.
What the rules and the record say
Few rules require cybersecurity due diligence outright — but merger control sets what can happen when, and regulators have shown what inherited risk costs. Current as of October 2026.
| Area | Instrument | What it means for you |
|---|---|---|
| US merger control | HSR Act, Sherman Act §1 | Until the waiting period ends, a buyer must not take operational control of the target, and competitively sensitive information needs care. In a 1999 case the US alleged that moving a target’s executives into the buyer’s facilities and giving them the buyer’s business cards and email addresses was a transfer of beneficial ownership. In January 2025 three companies agreed to pay a $5.6 million civil penalty for gun-jumping; a federal court entered the judgment in February 2026. |
| EU merger control | EU Merger Regulation Art 7 standstill | No implementation before clearance, with fines of up to 10% of turnover. The Commission fined Altice €124.5 million in 2018, partly for exchanging sensitive information before clearance; the General Court largely upheld the findings in 2021, and in 2023 the Court of Justice let the infringement findings stand while reducing the total fine to about €115 million. |
| United Kingdom | CMA interim orders National Security and Investment Act 2021 | The UK merger regime does not suspend completion, but a CMA interim order can bar integration of IT systems after completion. Notifiable acquisitions under the National Security and Investment Act are void if completed without approval. |
| Data protection | ICO — Marriott penalty notice (2020) | The ICO fined Marriott £18.4 million for security failures after it acquired Starwood. It made no finding about pre-acquisition diligence, but called acquisition a trigger for due diligence that is not a one-off, and said planning to retire a system does not take it outside data protection law. |
| Data protection | UK and EU GDPR | Personal data can be shared in due diligence where there is a lawful basis — such as legitimate interests, after a balancing test — and it is minimised and protected. The ICO’s statutory data sharing code, under review following the Data (Use and Access) Act 2025, has a section on mergers and acquisitions. |
| US securities | SEC cybersecurity disclosure rules (2023) | Public companies must describe material risks from previous cybersecurity incidents, and an incident’s materiality does not depend on who owns the affected systems — ask counsel how that applies to an acquired company. |
| Financial services | NYDFS 23 NYCRR Part 500 guidance DORA | NYDFS says its covered entities must conduct thorough cybersecurity due diligence when acquiring companies. DORA, which has applied since 17 January 2025, requires EU financial entities other than microenterprises and those on its simplified regime to carry out a risk assessment on each major change to their network and information systems — which integrating an acquisition can be. |
| Advisories | Cyber Safety Review Board (2024) FBI private industry notification (2021) | The Board’s 2024 report recommended compromise assessments of acquired companies and warned that attackers may target them between announcement and closing; the FBI assessed that ransomware actors were very likely using merger and acquisition events to target victims. |
What you get
- Deal-team summary — what we could and could not see, and the lever each finding may bear on, in plain language for the deal team and counsel
- Technical annex — evidence, coverage detail and remediation guidance, restricted to the security engineers who will act on it
- Compromise assessment — whether there are signs of an attacker already inside the target, and what was and was not examined
- Gate evidence pack — each join’s conditions marked met, not met or an accepted exception, and our recommendation for your decision: open, open with conditions or hold
- 100-day plan — sequenced remediation after closing, in effort bands, never in currency; for private equity sponsors, the same measures in every portfolio company, every year
Know what you are buying before you connect it.
A due diligence engagement starts with a sector and conflicts check, the deal timeline, who must authorise what, and which joins you plan to make first.
Get in Touch