ESSENTIAL GUIDANCE · BUYER GUIDE · 3 min read
Part of Expose insights →Cybersecurity due diligence for mergers and acquisitions
Combine authorised external evidence, management information and targeted assessment before and after a transaction.
Combine authorised external evidence, management information and targeted assessment before and after a transaction.
Need an acronym translated?Open the cyber glossary →Define the transaction decision and access boundary
A buyer may need to understand inherited exposure, integration constraints or the cost of improving security. Agree the questions, transaction timetable and information access before commissioning work. Due diligence is not a licence to test the target's systems. Document who can authorise each activity and whether the process permits only public-source research, management evidence or an active technical assessment.
Build a reliable picture of the estate
Request service inventories, domains, identity arrangements, important applications, suppliers and technical ownership. Compare those records with authorised external discovery where useful. A discrepancy can justify further questions without proving an exploitable weakness. Record the source and confidence of observations, particularly where a domain, supplier or historic service may no longer belong to the target business.
Ask how security operates in practice
Review ownership of remediation, access management, software maintenance, recovery, incident handling and supplier assurance. Ask for evidence that explains the process rather than relying on policy documents alone. Identify dependencies on a small number of people or suppliers. The integration plan needs to understand which responsibilities can transfer smoothly and which may require investment or continued external support.
Use targeted testing to resolve material uncertainty
Where deeper technical evidence is justified, define a specific scope and obtain explicit written authorisation from the appropriate owners. Agree restrictions that reflect the transaction and operational context. Avoid treating a seller's permission as authority over every supplier system. A focused assessment should answer an important question and state limitations; it cannot eliminate every uncertainty in a business acquisition.
Translate findings into transaction actions
Separate immediate credible risks from incomplete information and longer-term improvement work. Record what evidence supports each conclusion, the responsible owner and the practical dependency. Financial estimates should identify assumptions and distinguish remediation effort from hypothetical loss. Keep sensitive findings inside the appropriate transaction disclosure and access arrangements rather than circulating an unrestricted technical report.
Carry the evidence into integration
Plan how identity, monitoring, asset ownership and important fixes will be handled after completion. Recheck assumptions when systems are joined or access changes. Preserve the scope and date of the original assessment so historic findings do not masquerade as evidence about the merged environment. Due diligence creates a more informed decision and transition plan; it is not a continuing guarantee about the acquired business.
This guide covers the essentials. Continue into our technical analysis for a firmer position, practical implications and recommended action.
Read “Vulnerability remediation needs an operating model—not another spreadsheet” →
