By Mario Peshev, DevriX
A cyber finding does not sink a deal. A cyber finding you priced wrong sinks the deal, or worse, closes and detonates in month seven when a breach notification lands on your GP’s desk and the LPs start asking whether anyone actually looked. That is the real exposure for a deal partner or operating partner: not the existence of vulnerabilities, because every target has them, but the gap between what diligence found and what you assumed when you signed the LOI. Cybersecurity due diligence for M&A is not a compliance checkbox and it is not the CISO’s problem to sort out post-close. It is a set of decisions the deal team has to make with commercial consequences attached, and most of the reports I see hand the partner a color-coded heat map instead of a decision.
This piece is for the buyer who already has budget and a signed or near-signed LOI. You are not learning what a firewall is. You want to know which findings change your price, which change your close timeline, which become the first item on the 100-day plan, and which are genuine walk-away conditions. That is the work.
The commercial questions cyber diligence is supposed to answer
Strip away the technical vocabulary and a cyber workstream in an M&A process exists to answer four questions the investment committee actually cares about. Everything else is supporting evidence.
- Is there an active or historical breach that changes what we are buying? A prior incident that was never disclosed, or an intruder still in the environment, changes the asset. This is the walk-away or repricing question.
- What is the cost to bring this to an acceptable baseline, and who pays for it? Remediation has a number. That number belongs in the model, either as a purchase price adjustment or as a funded line in the value creation plan.
- Does the security posture cap the growth thesis? If the plan is to move upmarket into enterprise or regulated buyers, and the target cannot pass a customer security review, your revenue ramp is fiction until that is fixed.
- What is the regulatory and contractual tail? Data handling obligations, breach notification exposure, and customer contract security clauses do not disappear at close. They transfer.
Notice none of those are “how many critical CVEs are open.” The vulnerability count is input, not answer. A report that leads with the count and never converts it into one of these four decisions has done technical work and skipped the commercial work. When I run a technology due diligence engagement, the cyber section is scoped to produce a decision the partner can defend to the IC, not a document the CISO can admire.
Why this belongs in the deal, not the first 100 days
The tempting move on a mid-market deal, especially where the target has no security function to speak of, is to wave cyber through diligence and bolt it onto the integration plan. Sometimes that is the right call. Often it is a mistake that costs you leverage.
Leverage is the point. Anything you discover before signing the definitive agreement is negotiable. A material remediation cost identified in confirmatory diligence can move price, shape reps and warranties, or fund an escrow. The same cost discovered on Day 40 is simply your cost now, funded out of the value creation budget you had earmarked for growth. Bain’s annual Global Private Equity Report has documented for years how compressed hold periods and higher entry multiples put pressure on operational value creation, which means every dollar you spend cleaning up a preventable mess is a dollar not spent on the thesis.
The regulatory attention has also sharpened. The SEC has moved cybersecurity disclosure into mainstream governance expectations, and the Harvard Law School Forum on Corporate Governance regularly publishes on how boards are now expected to treat cyber risk as a standing governance item rather than an IT footnote. For a sponsor, that raises the floor on what “we did diligence” has to mean.
What a competent cyber diligence actually looks at
You are paying for judgment, not a scanner report. A defensible cyber diligence covers a handful of evidence areas, and you should be able to see the evidence behind every conclusion.
Incident and breach history
The first thing worth confirming is whether anything has already happened. That means asking directly, reviewing incident logs, checking for prior forensic engagements, and doing external reconnaissance for exposed credentials and data already circulating. A target that says “we’ve never had an incident” and has no detection capability has not avoided incidents. It has simply never been able to see one.
Identity, access, and the obvious front doors
Most real-world compromise comes through identity, not exotic exploits. Multi-factor authentication coverage, privileged access controls, offboarding hygiene, and exposed remote access are where the material risk usually sits in a mid-market company. These are cheap to assess and expensive to ignore.
Data handling and third-party exposure
Where does customer data live, who has it, and which subprocessors touch it. In a SaaS or data-heavy target this is often where the largest contingent liability hides, because the security clauses in enterprise customer contracts create obligations the seller may never have operationalized.
Architecture and technical debt as a security multiplier
Security posture and engineering health are not separable. A codebase with no secrets management, hardcoded credentials, and a decade of unpatched dependencies is both a security problem and a velocity problem. This is where cyber diligence overlaps the broader technical read, and why I treat them as one connected assessment rather than two siloed reports. The same architecture decisions that create breach risk also throttle the roadmap, a dynamic I have written about in the context of aligning engineering, product, and RevOps for value creation.
Governance and the human layer
Who owns security, whether anyone does, and whether there is any policy the organization actually follows. In many lower-mid-market targets the honest answer is that nobody owns it, which is itself a finding with a cost attached.
Reading the report like a deal partner, not an engineer
The most common failure I see is not a bad assessment. It is a good assessment presented in a format the deal team cannot act on. A severity matrix with 47 items ranked red, amber, green is a technical artifact. It does not tell you what to do.
Force every finding into three buckets before it reaches the IC:
- Deal-altering. Changes price, terms, or the decision to proceed. Rare, and should be flagged loudly. An undisclosed breach, active compromise, or a liability that dwarfs the equity check sits here.
- Fund-and-fix. Real cost, known scope, addressed in the first 100 days with a named owner and a budget line. The majority of findings live here. The job is to get the number right and put it in the plan.
- Monitor. Noted, tracked on the risk register, not urgent. Do not let these inflate the headline.
If your advisor cannot sort their own findings into those three buckets and defend the placement, you have a scanner report with a cover page. The distinction between advice and accountability matters here, and it is the same reason I argue that value creation consultants and operators are not interchangeable. A finding without an owner and a number is advice. A finding with both is a plan.
Where the biggest misses actually happen
Across mid-market technology deals, the expensive surprises tend to cluster in a few predictable places. None of them are exotic.
The security clause nobody read
A target has landed a marquee enterprise logo and everyone celebrates. Inside that contract is a security addendum committing the company to controls it does not have, audit rights it cannot survive, and breach notification terms with real teeth. The revenue is on the deck. The obligation is in an appendix nobody in the deal room opened.
The growth thesis that assumes a posture the company lacks
This is the one that quietly kills returns. Your thesis is to move the company upmarket, from SMB into mid-enterprise. Enterprise buyers run security questionnaires and demand certifications before they sign. The target has none. Your revenue ramp now has a 9-to-15-month security uplift program sitting in front of it that nobody modeled. I have seen this pattern repeatedly in go-to-market plans, which is part of why I keep writing about the value creation pitfalls that show up in PE go-to-market. The security gate is a GTM gate.
The single dependency with no owner
One engineer holds the keys to the entire cloud environment, wrote the deployment pipeline nobody else understands, and manages every production credential from a personal laptop. That is a security finding, a key-person finding, and an integration risk in one person. The fix is organizational, not technical, and it takes time.
Detection you cannot verify
A target with no logging, no monitoring, and no detection capability cannot tell you whether it has been breached, only that it has not noticed. “Clean history” from a company that is functionally blind is not reassurance. It is an unmeasured risk. McKinsey’s private capital research and the broader body of work from BCG on principal investors both point at the same operating reality: the value is created after close, and you cannot manage what you never established a baseline for.
Scoping the work to the deal, not gold-plating it
Not every deal needs the same depth, and paying for a full penetration test on a $12M add-on with 8 employees is as much a failure of judgment as skipping cyber on a data-heavy platform. The scope should map to the risk and to where you are in the process.
Pre-LOI, when you need a fast read before you commit
Before you sign, you often want a rapid, focused assessment: any obvious red flags, any signs of prior compromise, any glaring architectural or governance problems that would change whether you proceed. This is a screen, not a deep audit. It exists to protect you from writing an LOI on a fundamentally different asset than you think you are buying.
Confirmatory, when the number has to be right
Once you are in confirmatory diligence, the questions get more expensive to answer wrong. Now you want the remediation costed, the contractual exposure mapped, the growth-thesis gate confirmed or cleared, and the findings sorted into the three buckets with owners named. This is the version that feeds the model and the deal terms.
The right partner sizes the work to the check and the thesis. On a technology target, cyber should not be a standalone line item bolted on late. It should be one connected read alongside architecture, engineering health, and scalability, delivered inside a tight window. That is exactly how our technology due diligence is structured, and it is why I favor embedded operators over detached advisors for this work, a stance I have laid out in why PE needs permanent digital capacity rather than advisory retainers.
From finding to the first 100 days
The output of good cyber diligence is not the report. It is the first three or four items on the integration plan, already costed and already owned. If the diligence work and the post-close work are done by different people who never talk to each other, you lose the handoff, and the findings sit in a PDF while the clock runs.
This is where I part ways with the standard advisory model. The team that found the exposure should be able to translate it directly into the first 100 days execution plan, with a named owner for each remediation item and a budget line the CFO can track against actual. That continuity is the whole argument for putting technical value creation partners inside the portfolio company rather than delivering a report and leaving. A finding that never becomes an owned workstream is not risk managed. It is risk deferred.
There is also a governance dimension the board will care about at the first meeting. Whether cyber gets handled as a one-time cleanup or a standing capability is a real decision, and it maps to the distinction I draw between board technology governance and hands-on builds. Both are legitimate. Confusing them is not.
The financial translation the IC actually needs
Everything above only matters if it lands in the model in a form the investment committee recognizes. A cyber finding becomes commercial in one of a few ways, and being precise about which one prevents the common error of treating everything as an equal-weight risk.
- Realized cost. Remediation you will spend, with a number. This funds a line in the plan or adjusts price now.
- Risk avoided. A liability you priced into terms, escrow, or indemnity so it does not become your problem uncaptured.
- Enabled value. The upmarket revenue that only exists once the security gate is cleared. This is real, but it is enabled, not realized, and it should never be booked as if the ramp were already happening.
Keeping those categories distinct is the difference between a defensible IC memo and an optimistic one. The same discipline applies across the whole value creation exercise, and it is a running theme in how I think about the frequent failure to separate ambition from evidence, something I unpacked at length in a set of lessons for leaders on staying ahead into 2026. Data providers like PitchBook and S&P Global Market Intelligence keep documenting the same pressure on hold periods and returns, and that pressure is precisely why sloppy risk classification at entry compounds so badly by exit.
What good looks like
You do not need a hundred-page report. You need a partner who can walk into the deal room and answer five things without hedging:
- Is there any evidence this company has been, or is currently, compromised.
- What will it cost to reach an acceptable baseline, and who should pay.
- Does the growth thesis depend on a security posture the target does not have, and how long is that gap to close.
- What contractual and regulatory obligations transfer at close.
- Which two or three items become the first owned workstreams after Day 1.
If your cyber diligence answers those five, it has done its job. If it hands you a heat map and lets you sort out the implications, you paid for the easy 80% and skipped the 20% that protects the deal. Reputable deal-focused publications, from Harvard Business Review’s M&A coverage to the trade press, keep circling the same conclusion: the diligence that changes outcomes is the diligence that converts technical fact into a decision the buyer can act on.
Conclusion
Cybersecurity due diligence for M&A is a pricing and planning exercise wearing technical clothes. The findings only matter once they are translated into a price adjustment, a deal term, a funded remediation line, or a growth-thesis gate with a timeline attached. Everything else is a scanner report. The buyers who get value from this workstream are the ones who insist on decisions, owners, and numbers, and who close the loop between what diligence found and what the first hundred days will actually fix.
If you have an LOI signed or a target in confirmatory diligence and you want the cyber read delivered as decisions rather than a heat map, our team runs it inside a tight, deal-ready window and hands you findings your IC can act on. See how we scope technical diligence and value creation for private equity, and bring us the deal you need read before it closes.
