Quick answer: Cyber security due diligence is the assessment of a target company’s security posture, history and risks before a merger, acquisition or investment. It reviews governance, past breaches, technical controls, compliance and third-party exposure, and its findings can change the price, contract terms and integration plan. Done well, it prevents the buyer from inheriting a hidden breach.
When you buy a company, you buy its networks, data and any attackers already inside them. Several high-profile acquisitions have later revealed breaches that began before the deal. This guide explains what cyber due diligence covers, the red flags to look for and how to use the results.
What to review
| Area | Questions to answer | Evidence |
|---|---|---|
| Governance | Who owns security and how is it funded? | Org charts, budgets, board reports |
| Incident history | Have there been breaches or ransomware? | Incident logs, regulator notifications |
| Technical controls | Are MFA, patching, EDR and backups in place? | Configurations, scan results |
| Compliance | Which regulations apply and are they met? | Audit reports, certifications |
| Data | What sensitive data is held and where? | Data inventories, privacy records |
| Third parties | Which suppliers have access? | Vendor lists, contracts |
Documents tell only part of the story. Where the deal allows, technical checks such as external attack surface scans and a compromise assessment give a far more reliable picture.
Red flags
- No named security leader or very low security spending.
- Undisclosed or poorly documented past incidents.
- Internet-facing systems with known exploited vulnerabilities.
- No multifactor authentication on remote access or email.
- Untested or missing backups.
- Heavy reliance on end-of-life systems.
How findings affect the deal
- Price: remediation costs can be deducted from the valuation.
- Contract terms: specific warranties, indemnities or escrow for cyber risk; our MSA guide covers related contract clauses.
- Conditions: requiring fixes before closing.
- Integration: keeping networks separate until the target meets your standards.
After the deal: the first 100 days
- Assume compromise until proven otherwise, and monitor closely.
- Reset privileged credentials and enforce MFA.
- Close critical gaps found in due diligence, tracked in a POA&M.
- Integrate security tools and incident response before connecting networks.
Our guides to gap analysis, cyber security audits and supply chain risk support each stage. In the US, the SEC’s cyber disclosure rules raise the stakes for public acquirers, and the NIST Cybersecurity Framework gives a structure for the assessment.
Frequently asked questions
What is cyber security due diligence?
It is the assessment of a company’s security risks and posture before a merger, acquisition or investment.
When should cyber due diligence start?
As early as possible, ideally alongside financial and legal due diligence, so findings can influence the price and terms.
Who performs cyber due diligence?
The buyer’s security team, specialist consultants or both, working with legal and deal teams.
Can a breach discovered after closing be the seller’s responsibility?
It depends on the contract. Warranties and indemnities negotiated during due diligence determine who bears the cost.
Conclusion
Cyber due diligence protects deal value. Review governance and incident history, test the technology where possible, turn findings into contract terms and plan a secure integration. Never connect an acquired network until you trust it.
