Cybersecurity in M&A: beyond the checklist
Why evidence-based due diligence changes deal outcomes.
Most cyber due diligence stops where it should start: a questionnaire, a policy review, a green tick. That is enough to satisfy a process. It is not enough to protect a valuation.
The questionnaire problem
Self-attestation tells you what the target believes about itself. It rarely tells you what an attacker would find, what the last incident really cost, or which liabilities travel with the deal. Evidence does.
Evidence-based diligence looks at exposure the way an adversary would, quantifies what it finds, and separates the issues that move price from the ones that are simply noise.
Evidence also changes the conversation at the table. A documented risk — a privileged account never revoked, a critical supplier with no controls, a breach that was never truly closed — becomes a concrete lever: a price adjustment, a specific warranty, a condition to signing. A merely suspected risk stays an opinion, and opinions do not move a price.
From findings to a controlled Day 1
The point of diligence is not a report — it is a decision, and then a clean first hundred days. That means a Day 1 plan agreed before close: access, monitoring and the controls that cannot wait.
The Day 1 plan need not be exhaustive; it needs to be honest about priorities. Which credentials must be rotated before the acquirer is handed the keys? What minimum monitoring should be switched on to catch anything already in motion? Which integrations should be slowed until identity and visibility are under control? These are decisions best made before signing, with a clear head, rather than in the first week under pressure.
Done well, the acquirer inherits a plan, not a surprise. Done badly, the first breach arrives before the integration does.
The takeaway
Treat cyber diligence as part of the deal, not a compliance step beside it. The evidence changes the price, the terms, and the quality of the first year.
