Cybersecurity Due Diligence

Cybersecurity diligence is often confused with technology diligence, and the confusion is expensive. Technology diligence asks whether the product is well built and will scale. Cyber diligence asks a different question entirely: has this business already been compromised, can it withstand the next attack, and what legal and financial liability attaches to the data it holds. A codebase can be elegant and the security posture around it still catastrophic. We keep the two streams distinct so that neither hides the other.

The liability that matters most is the one that surfaces after close. A latent breach that predates completion, a set of personal records held without a lawful basis, a notification obligation that was never met: these become the acquirer's problem the moment ownership changes, and they arrive with regulatory exposure, remediation cost and reputational damage the model never carried. We scope the work to find them before they become yours, and we quantify what it costs to bring the target up to your own security standard.

Every seller says there has never been a serious breach. Diligence is the discipline of checking. We coordinate testing of the external attack surface to see what an attacker sees, review incident logs and detection history for traces of intrusions that were quietly contained or simply never spotted, and hunt for latent compromise that has yet to be disclosed. In practice the most damaging finding is rarely the vulnerability on the scan report; it is the incident the target either concealed or genuinely failed to detect.

Ransomware is the exposure that turns a security weakness into an existential one, so we test the controls that actually decide the outcome. That means privileged access and identity management, the coverage and enforcement of multi-factor authentication, and whether the backups have ever actually been restored in a test rather than just scheduled. A business unable to recover cleanly from ransomware is carrying a liability that no amount of perimeter spend offsets, and the acquirer needs it priced before completion, not learned during an incident.

Personal data is where cyber risk becomes statutory liability. Under the Digital Personal Data Protection Act 2023 a target has to hold personal data on a lawful footing, respect data-principal rights, and satisfy breach-notification duties, and failures carry financial penalties that transfer with the business. We test what personal data the target holds, on what basis, where it flows, and which third parties and sub-processors can reach it. Where the deal crosses borders, GDPR or an equivalent regime layers on top, and the exposure compounds.

The findings are only useful once they are priced. We size the cost of remediation to your standard: the controls that need building, the data that needs lawfully re-basing or deleting, the notifications that may be due, and the insurance gaps that need closing. That figure, together with the latent liabilities that might surface after close, is pulled together by one accountable lead running the diligence programme end to end, so the cyber view is set against the broader red-flag report and translated into price, indemnities and specific protections in the sale and purchase agreement.