Cybersecurity in M&A: What to Check Before Acquiring a Company

When you acquire a company, you are not only buying its customers, technology, employees, contracts, intellectual property, and revenue.

You are also acquiring its cybersecurity risks.

Unpatched servers, compromised employee accounts, poorly configured cloud environments, excessive administrator privileges, leaked credentials, insecure applications, outdated software, and even hidden backdoors can all become the buyer’s problem after the transaction closes.

In some cases, a threat actor may already have access to the target company’s infrastructure without the organization being aware of it.

This is why cybersecurity due diligence in mergers and acquisitions (M&A) should be treated as an essential part of evaluating a target company alongside financial, legal, tax, and operational due diligence.

A proper cyber due diligence assessment helps answer a critical question:

What cybersecurity risk are we actually acquiring with this business?

This guide explains what to check during M&A cybersecurity due diligence, which cybersecurity red flags to look for, how to assess cyber risk, and how security issues can affect company valuation and deal terms.

What Is Cybersecurity Due Diligence in M&A?

Cybersecurity due diligence is a structured assessment of a target company’s cyber risks, security controls, technology environment, data protection practices, and history of security incidents before an acquisition, merger, or major investment.

Its purpose is not simply to determine whether the company has antivirus software, a firewall, or written security policies.

The objective is to understand the target’s actual cybersecurity posture and the financial, operational, regulatory, and reputational risks the buyer may inherit after closing the deal.

A cybersecurity due diligence assessment should answer questions such as:

• Has the company experienced previous security incidents or data breaches?

• Could the company already be compromised?

• What critical vulnerabilities exist in its infrastructure?

• Are sensitive data and intellectual property adequately protected?

• Who has privileged access to critical systems?

• Are cloud environments securely configured?

• Does the company meet relevant regulatory and contractual security requirements?

• What cybersecurity investments will be required after the acquisition?

• Could existing security problems result in regulatory penalties, customer claims, operational downtime, or data loss?

This makes cybersecurity due diligence significantly broader than a vulnerability assessment or penetration test.

A penetration test primarily asks:

“Can an attacker compromise this system?”

Cybersecurity due diligence asks:

“What cyber risk and security liabilities are we acquiring with this company?”

Why Cybersecurity Matters in M&A Transactions

Cybersecurity risks are not always visible during traditional due diligence.

A company may have strong revenue growth, valuable intellectual property, major enterprise customers, and a successful product while simultaneously operating with serious security weaknesses.

For example, the target company may have:

• unsupported operating systems;

• years of accumulated patching debt;

• poorly protected cloud environments;

• shared administrator accounts;

• weak access controls;

• former employees with active accounts;

• exposed API keys or credentials;

• inadequate backups;

• limited security monitoring.

An even greater concern is undetected compromise.

Attackers can sometimes maintain access to an organization through stolen credentials, compromised endpoints, VPN accounts, cloud sessions, service accounts, or persistence mechanisms.

After an acquisition, the target company’s systems are often connected to the buyer’s infrastructure.

Networks are integrated. Identities are federated. Data is migrated. Cloud environments are connected. Employees receive access to new systems.

If the acquired environment is already compromised, this integration can potentially create a pathway into the buyer’s infrastructure.

For this reason, cybersecurity due diligence should ideally take place before closing and before connecting the two IT environments.

What Should Be Included in M&A Cybersecurity Due Diligence?

A comprehensive cybersecurity assessment should evaluate technology, processes, identities, applications, data, third parties, and the company’s previous security history.

Here are the most important areas to review.

1. IT Infrastructure and External Attack Surface

The first step is understanding what technology assets the target company actually owns and operates.

The assessment should identify and review:

• domains and subdomains;

• external IP addresses;

• internet-facing servers;

• VPN gateways;

• firewalls;

• remote access services;

• web applications;

• APIs;

• SaaS platforms;

• cloud environments;

• endpoints and servers;

• externally accessible administrative interfaces.

The goal is to create an accurate picture of the company’s attack surface.

Special attention should be given to shadow IT — technology assets that exist outside centralized IT or security management.

For example, a development team may have created a separate cloud account several years ago to deploy an application. That environment may still contain production data or credentials while remaining invisible to the security team.

Unknown assets frequently become forgotten security risks.

2. Critical Vulnerabilities and Security Debt

Another major part of cyber due diligence is determining how much security debt the company has accumulated.

This includes reviewing vulnerabilities across:

• operating systems;

• servers;

• network equipment;

• VPN infrastructure;

• web applications;

• databases;

• middleware;

• endpoints;

• cloud workloads;

• security appliances.

However, simply counting vulnerabilities is not enough.

Ten low-risk vulnerabilities on an isolated internal system may represent less risk than one exploitable vulnerability on an internet-facing VPN gateway.

Each significant finding should therefore be evaluated according to factors such as:

Exploitability: How easily could an attacker exploit it?

Exposure: Is the vulnerable system accessible from the internet?

Asset criticality: What business process or data does the system support?

Potential impact: What could happen if the vulnerability is exploited?

Remediation effort: How difficult and expensive will it be to fix?

This allows the buyer to distinguish ordinary technical issues from vulnerabilities that could materially affect the transaction.

3. Identity and Access Management

Identity is one of the most important areas to investigate during M&A cybersecurity due diligence.

The assessment should determine:

• whether multi-factor authentication (MFA) is enforced;

• how administrator accounts are managed;

• whether shared privileged accounts exist;

• how service accounts are controlled;

• how employee onboarding and offboarding work;

• whether former employees still have active accounts;

• who can access production environments;

• how API keys, passwords, tokens, and secrets are stored;

• whether the principle of least privilege is applied;

• whether privileged activities are monitored.

Dormant administrator accounts deserve particular attention.

An account belonging to an employee who left the organization two years ago may still have access to critical infrastructure.

After an acquisition, forgotten accounts can become both a security risk and an unexpected access path into the newly integrated environment.

4. Active Directory and Corporate Network Security

For organizations using Microsoft infrastructure, Active Directory security should be assessed separately.

Misconfigurations in Active Directory can sometimes allow an attacker who compromises a standard user or workstation to move laterally through the network and eventually obtain highly privileged access.

The assessment should review areas such as:

• privileged groups;

• Domain Admin access;

• service accounts;

• password policies;

• legacy authentication protocols;

• delegation;

• inactive accounts;

• lateral movement opportunities;

• privilege escalation paths.

This becomes particularly important before establishing trust relationships or connectivity between the buyer’s environment and the acquired company.

The buyer should understand the security posture of the target domain before trusting it.

5. Cloud Security

For companies using AWS, Microsoft Azure, Google Cloud, or other cloud platforms, cloud security requires dedicated analysis.

The review should cover:

• IAM permissions;

• administrator access;

• security groups;

• public storage;

• cloud network architecture;

• encryption;

• logging and monitoring;

• secrets management;

• access keys;

• unused resources;

• exposed services;

• cross-account access.

Long-lived credentials are a common concern.

For example, an access key created by a developer years ago may still provide extensive access to production systems even though the employee has already left the organization.

These hidden access paths should be identified before the buyer integrates the environment.

6. Application Security and Secure Software Development

For SaaS companies, software vendors, fintech businesses, and other technology companies, the product itself may represent a significant portion of the acquisition value.

Cybersecurity due diligence should therefore evaluate both the application and the software development lifecycle (SDLC).

The assessment may include:

• application architecture;

• web application security;

• API security;

• authentication;

• authorization;

• dependency management;

• source code repositories;

• CI/CD pipelines;

• secrets management;

• production access;

• vulnerability management;

• secure development practices;

• open-source components.

Depending on the risk profile of the transaction, a penetration test or security review of critical applications may also be appropriate.

One important question is:

Who can modify and deploy code to production?

If dozens of developers have unrestricted production access without appropriate approval, logging, or segregation of duties, the buyer is inheriting a significant operational and cybersecurity risk.

7. Data Protection and Privacy

The buyer should understand what data it is acquiring and how that data is protected.

Depending on the company, this may include:

• customer personal data;

• financial information;

• payment data;

• healthcare information;

• source code;

• intellectual property;

• employee information;

• trade secrets;

• confidential partner data.

The assessment should determine:

• where sensitive data is stored;

• who has access to it;

• whether encryption is used at rest and in transit;

• whether backups exist;

• whether backup restoration is regularly tested;

• how long data is retained;

• whether deletion policies are implemented;

• whether employees can freely download or copy sensitive information.

It is also important to compare actual security practices with what the company promises in customer contracts, privacy policies, Data Processing Agreements, and other legal documents.

A gap between contractual commitments and actual security controls may create liabilities for the buyer.

8. Previous Cybersecurity Incidents and Data Breaches

One of the most important questions during due diligence is:

Has the company experienced a cybersecurity incident or data breach?

However, simply asking management is not enough.

A company reporting “no cybersecurity incidents” may have excellent security.

Or it may simply lack the monitoring capabilities necessary to detect them.

Cyber due diligence should therefore review available evidence such as:

• incident records;

• SIEM alerts;

• EDR/XDR alerts;

• authentication logs;

• security tickets;

• previous penetration test reports;

• vulnerability assessments;

• forensic investigations;

• ransomware or malware incidents;

• previous data breach investigations.

The assessment may also include checking whether corporate credentials, accounts, or sensitive information have appeared in known data leaks or relevant Dark Web sources.

The objective is not only to understand disclosed incidents but also to identify evidence of previously unknown compromise.

9. Check for Existing Compromise and Backdoors

One of the most overlooked M&A cyber risks is the possibility that attackers already have access to the target environment.

The question is not only:

“Can this company be hacked?”

It is also:

“Has it already been hacked?”

For high-value or high-risk transactions, a compromise assessment or threat hunting exercise may be appropriate before integration.

Security specialists can investigate potential indicators such as:

• suspicious authentication activity;

• unknown administrator accounts;

• persistence mechanisms;

• unusual endpoint processes;

• suspicious PowerShell activity;

• command-and-control communication;

• abnormal cloud sessions;

• unexpected remote access;

• known Indicators of Compromise (IoCs).

This helps reduce the risk of acquiring a business together with an attacker who already has persistent access to its systems.

10. Third-Party and Supply Chain Risk

A company does not operate in isolation.

Its infrastructure may depend on dozens or hundreds of external vendors and service providers.

Cybersecurity due diligence should identify critical:

• SaaS providers;

• cloud providers;

• managed service providers;

• MSSPs;

• hosting companies;

• software vendors;

• payment processors;

• development contractors;

• external IT administrators.

The important question is not simply which vendors the company uses.

It is:

What access does each third party have?

A compromised external contractor with privileged production access can create the same level of risk as a compromised internal administrator.

The buyer should therefore identify third parties with access to critical systems and determine whether that access remains necessary and properly controlled.

11. Cybersecurity Compliance and Regulatory Risk

The assessment should also evaluate relevant regulatory, contractual, and industry security requirements.

Depending on the organization, jurisdiction, customers, and data involved, these may include:

• GDPR;

• NIS2;

• DORA;

• PCI DSS;

• ISO/IEC 27001;

• SOC 2;

• sector-specific cybersecurity requirements;

• customer security requirements.

A company may claim compliance while its actual security controls tell a different story.

For example, written policies may require MFA, periodic access reviews, vulnerability management, or incident response procedures while these controls are inconsistently implemented in practice.

Cybersecurity due diligence should therefore examine both documentation and evidence that security controls actually operate as intended.

Cybersecurity Red Flags in M&A

Not every cybersecurity weakness is a reason to abandon an acquisition.

However, certain findings should immediately trigger deeper investigation and may affect valuation, deal terms, or the integration plan.

Major M&A cybersecurity red flags include:

• no MFA on critical systems;

• unknown or incomplete IT asset inventory;

• unsupported or End-of-Life systems;

• critical vulnerabilities left unpatched for extended periods;

• shared administrator accounts;

• weak privileged access controls;

• no centralized security logging;

• inadequate endpoint detection and monitoring;

• unrestricted developer access to production;

• credentials or secrets stored in source code;

• backups that have never been tested;

• active accounts belonging to former employees;

• no documented incident response process;

• unmanaged cloud environments;

• unknown third-party privileged access;

• unresolved previous security incidents;

• evidence of leaked corporate credentials;

• major gaps between security policies and actual practices.

The key is to determine not only what is wrong, but also how difficult and expensive it will be to fix.

How Cybersecurity Risk Can Affect M&A Valuation

Cybersecurity findings can directly affect the economics of an acquisition.

Consider a target company valued at $20 million.

During cybersecurity due diligence, the buyer discovers that the company needs to:

• replace unsupported infrastructure;

• implement MFA and privileged access controls;

• redesign cloud IAM;

• remediate critical vulnerabilities;

• deploy endpoint detection and centralized monitoring;

• secure Active Directory;

• improve backup and recovery;

• remediate compliance gaps.

If these improvements require another $500,000 or $1 million after the acquisition, that is not simply an IT issue.

It represents a real future cost for the buyer.

More serious findings may create uncertain liabilities.

A previously undisclosed data breach, compromised intellectual property, regulatory exposure, or breach of customer security obligations can create costs far beyond technical remediation.

Cybersecurity findings may therefore influence:

Purchase price. Significant security debt can support a valuation adjustment.

Representations and warranties. The buyer may require additional cybersecurity representations from the seller.

Indemnification. The agreement may address responsibility for security incidents originating before closing.

Escrow or holdback. Part of the transaction value may be retained to cover identified risks.

Closing conditions. Critical security issues may need to be remediated before the deal closes.

Post-merger remediation budget. The buyer can incorporate necessary cybersecurity investments into the transaction model.

Cybersecurity due diligence therefore helps translate technical findings into financially relevant M&A risks.

How Should Cyber Risks Be Evaluated During Due Diligence?

A common mistake is giving executives or investment teams a technical report containing hundreds of vulnerabilities.

A CFO or investment committee should not need to determine what a CVSS 9.8 vulnerability means for the transaction.

Each significant cybersecurity finding should instead be translated into business risk.

A useful assessment should consider:

Likelihood: How likely is the risk to be exploited?

Business impact: What happens if exploitation occurs?

Affected assets: Which systems, data, customers, or business processes are exposed?

Remediation complexity: How difficult is the problem to fix?

Estimated remediation cost: What investment may be required?

Remediation timeline: Should the issue be fixed before closing, before integration, or after the acquisition?

For example, instead of reporting only:

“Critical vulnerability, CVSS 9.8.”

An M&A-focused report should explain:

“An internet-facing VPN gateway contains a critical exploitable vulnerability that could potentially provide initial access to the corporate network. The system is used for employee remote access. Remediation is recommended before connecting the target environment to the buyer’s network.”

That information can actually support transaction decisions.

When Should Cybersecurity Due Diligence Be Performed?

Cybersecurity due diligence should ideally begin before the acquisition closes, while the buyer can still incorporate identified risks into valuation and transaction terms.

The process can be divided into several stages.

Stage 1: Initial Cyber Risk Assessment

An early-stage assessment can review the external attack surface, security documentation, known data exposure, major controls, compliance status, and available incident history.

The goal is to identify potential deal breakers and major security liabilities quickly.

Stage 2: Technical Cybersecurity Due Diligence

Once appropriate access becomes available, a deeper technical assessment can evaluate:

• identity;

• endpoints;

• networks;

• Active Directory;

• cloud environments;

• applications;

• vulnerabilities;

• security monitoring;

• data protection.

Depending on the transaction, this phase may also include penetration testing, cloud security assessment, Active Directory assessment, or source code review.

Stage 3: Compromise Assessment

For high-value or high-risk acquisitions, threat hunting can help determine whether the target environment shows evidence of active or historical compromise.

Stage 4: Pre-Integration Security

Critical risks should be addressed before the target company becomes deeply connected to the buyer’s environment.

This is particularly important before implementing:

• network connectivity;

• domain trusts;

• identity federation;

• shared cloud access;

• data migrations;

• privileged cross-environment access.

Stage 5: Post-Merger Cybersecurity Remediation

After closing, the findings should be converted into a prioritized cybersecurity roadmap.

A practical plan can separate actions into the first 30, 60, and 90 days, followed by longer-term security improvements.

M&A Cybersecurity Due Diligence Checklist

A practical cybersecurity due diligence checklist for M&A should cover at least the following areas:

Infrastructure: Servers, endpoints, networks, VPNs, firewalls, domains, internet-facing assets, and external attack surface.

Identity and access: MFA, Active Directory, privileged accounts, service accounts, inactive users, access policies, and offboarding.

Cloud: AWS, Azure, GCP, IAM, storage, secrets, logging, networking, and privileged access.

Applications: Web applications, APIs, authentication, authorization, dependencies, and critical vulnerabilities.

Data protection: Data inventory, access controls, encryption, backups, retention, personal data, and confidential information.

Software development: Source code, repositories, CI/CD pipelines, secrets management, production access, and secure SDLC.

Detection and response: SIEM, EDR/XDR, logging, incident response procedures, and previous incidents.

Threat exposure: Leaked credentials, known breaches, Dark Web exposure, and Indicators of Compromise.

Third parties: Vendors, contractors, MSPs/MSSPs, and external privileged access.

Compliance: GDPR, NIS2, DORA, PCI DSS, ISO 27001, SOC 2, contractual requirements, and relevant industry regulations.

Business continuity: Backups, disaster recovery, business continuity planning, and the ability to recover from ransomware or another major cyber incident.

What Should a Buyer Receive After Cybersecurity Due Diligence?

A useful cybersecurity due diligence report should not simply contain 150 pages of technical findings.

The buyer needs a clear map of the target company’s cyber risk.

The final report should provide:

• an executive summary;

• overall cybersecurity posture;

• critical and high-risk findings;

• business impact of major findings;

• supporting technical evidence;

• potential liabilities;

• remediation priorities;

• estimated remediation effort;

• recommended next steps.

Findings can also be grouped according to transaction timing.

Fix Before Closing

Critical issues that should be resolved before the acquisition is completed.

Fix Before Integration

Risks that must be addressed before connecting the target company to the buyer’s systems.

Post-Merger Remediation

Security improvements that can be implemented after closing according to an agreed roadmap.

This turns cybersecurity due diligence from a technical exercise into a practical M&A risk management tool.

Is a Penetration Test Enough Before Acquiring a Company?

No.

Penetration testing can be an important part of M&A cybersecurity due diligence, but it is not a substitute for a comprehensive cyber risk assessment.

A penetration test can identify exploitable vulnerabilities in selected systems or applications.

However, it may not reveal:

• regulatory exposure;

• historical data breaches;

• compromised employee credentials;

• excessive third-party access;

• poor security governance;

• security debt;

• weak incident response capabilities;

• insecure cloud accounts outside the testing scope;

• gaps between contractual security obligations and actual controls.

For M&A transactions, penetration testing should therefore be considered one source of technical evidence within a broader cybersecurity due diligence process.

How Long Does M&A Cybersecurity Due Diligence Take?

The duration of cybersecurity due diligence depends on the size, complexity, and risk profile of the target company.

A smaller technology company with a limited infrastructure and a few cloud environments may require a relatively focused assessment.

A larger organization with multiple offices, hundreds or thousands of endpoints, complex Active Directory environments, numerous applications, multiple cloud platforms, and large volumes of sensitive data will require a more extensive review.

The timeline also depends on:

• availability of documentation;

• quality of the asset inventory;

• cooperation from the target company;

• number of systems in scope;

• need for penetration testing;

• need for source code review;

• need for threat hunting or compromise assessment.

The scope should therefore be based on the value of the transaction, criticality of the target’s assets, data sensitivity, and potential business impact of a cyber incident rather than applying the same checklist to every acquisition.

Cybersecurity After an Acquisition: Why Integration Creates Additional Risk

Closing the transaction does not eliminate cyber risk.

In many cases, the post-merger integration period is one of the highest-risk stages of the entire transaction.

Employees receive new permissions. Networks are connected. Data is migrated. Identity systems are integrated. Cloud environments are consolidated. Business applications begin exchanging information.

Every integration can create new trust relationships and potential attack paths.

The findings from cybersecurity due diligence should therefore become the foundation of a post-merger cybersecurity integration plan.

Early priorities typically include:

• enforcing MFA;

• reviewing privileged access;

• disabling unnecessary accounts;

• rotating passwords, tokens, and secrets;

• patching critical vulnerabilities;

• deploying or standardizing endpoint protection;

• centralizing security logging;

• validating backups;

• reviewing third-party access;

• monitoring communication between the two environments.

Full integration should follow only after critical risks have been understood and appropriately controlled.

Cybersecurity Due Diligence Is Part of M&A Risk Management

When a company acquires another business, it acquires more than its financial assets.

It also inherits its digital history.

Old servers. Forgotten cloud accounts. Unpatched vulnerabilities. Former employee accounts. API keys. Legacy configurations. Customer data. Previous security incidents. Third-party access that nobody remembers granting.

And potentially, access that should never have existed in the first place.

This is why the question before an acquisition should not only be:

“How much is this company worth?”

It should also be:

“How much will it cost to secure this company, and what cyber risk will we inherit before we do?”

Cybersecurity due diligence helps answer those questions while there is still time to incorporate the findings into the valuation, transaction terms, closing conditions, and integration strategy.

For buyers, it helps uncover hidden liabilities.

For investors, it provides a more accurate understanding of the asset.

For sellers, addressing cybersecurity weaknesses before due diligence can reduce uncertainty and prevent avoidable security debt from negatively affecting the deal.

Frequently Asked Questions About M&A Cybersecurity Due Diligence

What is cybersecurity due diligence in M&A?

Cybersecurity due diligence is the process of assessing a target company’s cybersecurity posture before an acquisition, merger, or investment. It evaluates infrastructure, cloud security, identities, applications, sensitive data, previous security incidents, third-party access, compliance, and other cyber risks that the buyer may inherit.

What should you check before acquiring a company?

Before acquiring a company, cybersecurity due diligence should examine its external attack surface, critical vulnerabilities, identity and privileged access, Active Directory, cloud environments, application security, sensitive data, backups, security monitoring, incident history, leaked credentials, third-party access, and regulatory compliance.

Can cybersecurity issues affect M&A valuation?

Yes. Significant security debt, critical vulnerabilities, previous data breaches, regulatory exposure, insecure infrastructure, or major remediation requirements can increase the buyer’s future costs and liabilities. These findings may affect valuation, purchase price, representations and warranties, indemnification, escrow, closing conditions, and the post-merger security budget.

Is penetration testing enough for M&A due diligence?

No. A penetration test evaluates the security of selected systems and can identify exploitable vulnerabilities, but comprehensive M&A cybersecurity due diligence also needs to assess identity, cloud security, data protection, compliance, previous incidents, third-party risk, security governance, and potential existing compromise.

When should cybersecurity due diligence be performed?

Cybersecurity due diligence should ideally be performed before closing the transaction. Critical security risks should be identified before valuation and deal terms are finalized, while high-risk vulnerabilities and potential compromise should be addressed before integrating the target company’s infrastructure with the buyer’s environment.

What is a compromise assessment in M&A?

A compromise assessment examines the target company’s systems for evidence of current or previous unauthorized access. It can include threat hunting for suspicious accounts, persistence mechanisms, abnormal authentication, malicious processes, command-and-control activity, unusual cloud sessions, and other Indicators of Compromise.

What are the biggest cybersecurity red flags during an acquisition?

Major red flags include lack of MFA, unmanaged privileged accounts, unsupported systems, critical unpatched vulnerabilities, unknown cloud assets, active accounts belonging to former employees, inadequate logging, untested backups, unrestricted production access, exposed credentials, unresolved security incidents, and evidence of previous or ongoing compromise.

Who should perform cybersecurity due diligence?

Cybersecurity due diligence should be performed by security professionals who can evaluate both technical risks and their business impact. Depending on the transaction, the assessment team may include cybersecurity consultants, penetration testers, cloud security specialists, GRC professionals, incident response specialists, and internal security teams.