Cybersecurity Due Diligence | 10+ Years in Cybersecurity
Cybersecurity Due Diligence for M&A
A breach you inherit becomes your breach. I assess the target’s security controls, look for signs of past compromise, and tell you what has to change before close and what can wait.
What I Check
I start from the outside, the way an attacker would, then review the controls inside.
Endpoint Protection
Antivirus versus EDR, coverage gaps, and whether anyone watches the alerts.
Email Security
SPF, DKIM, DMARC, phishing filtering, and mailbox forwarding rules that leak data.
Identity and Access
MFA coverage, shared and stale accounts, and who holds admin rights.
Backup Resilience
Offline or immutable copies, retention, and restore testing against ransomware.
Breach History
Past incidents, how well they were cleaned up, and signs an attacker still has access.
Data Handling
Where sensitive data sits, how it moves, and what happens to old drives and devices.
How the Review Works
01
Scoping Call
We set the timeline, access level, and what the seller will provide.
02
External Review
I check public exposure: email records, open services, and leaked credentials.
03
Internal Review
I review security tools, accounts, logs, and backups with the IT contact.
04
Remediation Plan
You get day-one and 90-day priorities, sized to your budget.
Why Cybersecurity Belongs in Every Deal
Small companies get breached through the same few doors: a phished password with no MFA, an unpatched remote access tool, or a backup that ransomware can reach. Any one of those can cost more than the deal’s working-capital adjustment, and cyber insurers now ask about all of them.
I met one of my longest-running clients in the middle of an active compromise. Their old IT provider’s website was serving malware. I cleaned it up, rebuilt their protection, and supported them for four and a half years until a private equity buyer acquired them. The security side of diligence went smoothly because the work was already done.
Red Flags That Change a Deal
- No MFA on email or remote access
- Admin passwords shared over email or text
- Remote access tools nobody can explain
- Backups on the same network as the servers
- Mailbox rules forwarding mail to outside addresses
- Past incidents with no written cleanup record
What I Recommend After Close
- Managed EDR with 24/7 detection on every endpoint
- MFA on email, remote access, and admin accounts
- DMARC enforcement and phishing filtering
- Backups with an offline or immutable copy
- A tested restore, on a schedule
- Multi-pass wipes and physical destruction of retired drives
Related Case Studies
Cybersecurity Due Diligence in a PE Acquisition
Four and a half years of security work, then a three-week move onto a private equity buyer's systems.
Seven Years, Zero Incidents Through an Acqui-Hire
Two sister engineering firms on opposite sides of the US-Canada border, clean through customer security reviews and an acquisition.
More Services
Common Questions
What's the difference between IT and cybersecurity due diligence?
IT due diligence covers the whole technology picture: hardware, software, vendors, and costs. Cybersecurity due diligence goes deeper on threats: how an attacker could get in, whether one already has, and which controls stop them. Most buyers need both, and I can run them together.
Do you run penetration tests?
I focus on configuration review, external exposure checks, and signs of compromise. If the deal calls for a formal penetration test, I scope it and coordinate a specialist.
Can you check for signs of a past breach?
Yes. I review sign-in logs, mailbox rules, endpoint alerts, and unfamiliar remote tools, the places attackers tend to leave traces.
Will this help with cyber insurance?
Insurers ask about MFA, EDR, backups, and email security. The report maps to those questions, so you know what the new company needs to qualify.
Worried About What You're Inheriting?
Tell me about the target and I’ll tell you where I’d look first.