Due Diligence in Mergers and Acquisitions
Assessing cybersecurity risks when buying companies
When evaluating the purchase of or merger with another company, cybersecurity due diligence means investigating whether that organization has suffered previous breaches, how mature its protection controls are and whether there are hidden vulnerabilities that will become an inherited problem the day the deal closes. Ignoring this analysis can be very costly, because once the acquisition is complete, any security incident that existed beforehand, even if it wasn't known, becomes the buying company's responsibility. A widely known case in the industry is an acquisition where it was discovered, after the deal had closed, that the acquired company had suffered a massive data leak years earlier without disclosing it, which significantly reduced the final agreed value and led to lawsuits the buyer hadn't anticipated.