Every acquisition carries inherited cyber risk. Undisclosed breaches, unpatched infrastructure, poor security posture — these become your problem at close. We assess it honestly before you commit.
Cyber security is consistently underweighted in M&A due diligence — until an undisclosed breach surfaces post-close, a ransomware group discloses the target on a leak site mid-transaction, or regulators open an investigation into data practices that predated the acquisition.
These aren't hypothetical risks. We have been engaged post-acquisition to remediate exactly these situations. The cost — financial and reputational — far exceeds what a proper pre-close assessment would have identified.
Before any technical assessment, we run a targeted dark web and threat intelligence sweep of the target organisation — looking for existing breach disclosures, credential leaks, data already published on leak sites, and any threat actor targeting activity. This takes 48–72 hours and frequently surfaces material risks that are not visible from inside the organisation.
We review available incident logs, breach notification history, and where access is granted, endpoint and network telemetry — looking for indicators of compromise that may indicate past or current unauthorised access that has not been disclosed or detected.
We are accustomed to deal timelines. Assessments can be structured to complete within standard due diligence windows — typically 2–4 weeks for full scope, or 5–7 days for accelerated light-touch assessments where time is the constraint.
All work is conducted under strict NDA. Target organisations need not be informed of our engagement at the initial assessment phase if deal sensitivity requires it.