Introduction
Deal teams examine financials line by line. Legal counsel reviews every contract, lease, and outstanding claim. Operational diligence covers customers, suppliers, and key personnel. All of it is rigorous, and all of it is standard.
Security usually gets a questionnaire and a copy of whatever certificate the target holds.
That gap has consequences, because an acquisition transfers more than assets and revenue. It transfers the target’s entire security history, including the parts the target doesn’t know about, and they become your problems the moment the deal closes.
What Actually Transfers
When a deal closes, the buyer inherits:
- Any breach already underway. If an intruder is in the target’s environment on closing day, they’re in the buyer’s environment on the following Monday.
- Regulatory exposure from past incidents, including ones that were never properly assessed or disclosed, and notification obligations that may still be unsatisfied.
- Contractual security commitments the target made to its own customers, which now bind the acquirer.
- Access nobody can account for. Former employees, former contractors, dormant vendor integrations, and shared credentials accumulated over years.
- Technical debt with a security dimension. Unsupported systems, deferred patching, and applications that can’t be updated without breaking something the business depends on.
None of these appear on a balance sheet, and several of them cost real money to resolve.
Two Deals That Made the Point
The two most cited examples are worth knowing because they illustrate different failures.
Verizon’s acquisition of Yahoo was repriced after previously undisclosed breaches came to light during the transaction, reducing the purchase price by roughly $350 million. The issues surfaced before closing, which is the good outcome. The buyer had information and used it.
Marriott’s acquisition of Starwood went the other way. Attackers had been present in Starwood’s systems since 2014. The deal closed in 2016, and the intrusion wasn’t discovered until 2018, by which point it was Marriott’s breach, Marriott’s regulatory problem, and Marriott’s cost. Roughly 500 million guest records were involved, and the enforcement and litigation ran for years afterward.
Why a Questionnaire Doesn't Cover It
Security questionnaires in a deal context have three structural problems.
- They’re self-reported, which means the answers reflect what the target believes about itself.
- They describe policy rather than practice, so a documented access review process tells you nothing about whether reviews actually happen.
- And most importantly, a seller can answer every question honestly and still be wrong, because the great majority of companies don’t have an accurate picture of their own environment. Undisclosed doesn’t necessarily mean concealed, it can also just mean “unknown”.
Certifications have a related limit. A current SOC 2 or ISO 27001 tells you the organization passed an audit against a defined scope on a particular date. It doesn’t tell you what fell outside that scope, or what’s changed since the audit took place.
What a Real Review Looks For
Proper cyber diligence is investigative rather than administrative, and much of it can begin before a data room opens.
External attack surface review maps what the target exposes to the internet, which requires no cooperation from the seller and frequently contradicts the questionnaire. Credential exposure checks reveal whether the target’s accounts appear in known breach data, which is both a current risk and a signal about historical hygiene. Identity and access review examines who actually holds permissions versus who should. Incident history gets reconstructed from evidence rather than taken on description. And the whole thing gets priced: what remediation costs, how long it takes, and what it implies for integration timelines.
That last part is the one deal teams value most, because it converts a security finding into something the transaction can act on. A finding without a cost estimate gets noted and ignored. A finding with a credible number attached changes the price, the escrow, or the representations in the agreement.
This is specialist work. It requires someone who has examined a lot of environments and can distinguish a genuine problem from an ordinary one, under deal timelines that don’t allow for a leisurely assessment.
If You're on the Selling Side
The same exercise is worth running in reverse, and earlier.
Sellers who identify and remediate their own issues before going to market avoid the two worst outcomes: a late-stage price reduction and a buyer who walks. Surprises discovered by the other side’s advisors are always more expensive than ones you found yourself, because at that point you’re negotiating from a weaker position with less time.
Final Perspective
Cybersecurity has become a component of enterprise value, both in what it protects and in what it costs to fix. Treating it as a compliance checkbox in a transaction leaves one of the larger sources of post-close surprise unexamined.
At Secutor, we conduct security due diligence for buyers and sellers, and our Insider Direct program includes packages built for private equity firms and holding companies managing security across a portfolio. If you have a transaction in progress or coming up, we should talk before it closes.
The security problems you inherit at closing become yours, whether you knew about them or not.
Connect with an Expert for a Free Consultation
Secutor is your team of world-class problem solvers with vast expertise and experience delivering complete solutions keeping your organization protected, audit-ready, and running smoothly. Use the form below to contact us for a free consultation.
