Investment · Buy-side due diligence
Cyber due diligence
Before you acquire or invest, you need to know where the target stands on security and what it will cost to fix. In 2 to 3 weeks, I assess its maturity, identify red flags, translate them into deal terms and prepare the first 100 days.
Who it is for
- Private equity and venture capital funds
- Trade and strategic acquirers
- M&A advisers who need a cyber workstream in their due diligence
Typical situation
A letter of intent is signed, the data room is open, and the target handles sensitive data or a software product whose security drives its value.
An incident found after closing costs far more than an issue found before signing.
What I do
A review scoped to the deal timetable.
Document review
Analysis of data room material: policies, certifications, audit and penetration test reports, incident history, customer contracts.
Interviews
Sessions with the target’s CTO, security lead or management, as far as the deal allows.
Red flags and impact
Identifying material risks and translating them into deal terms: price adjustment, warranties and indemnities, conditions precedent, post-closing undertakings.
100-day plan
Priority actions to launch after closing, with an indication of effort.
Deliverables
- A due diligence report with a maturity rating by domain
- A list of red flags, ranked by severity
- Points to reflect in negotiation and in the transaction documents
- A 100-day plan
- A read-out session with the deal team
Format and duration
- Format
- Fixed-fee, remote engagement under NDA, aligned with the deal timetable
- Indicative duration
- 2 to 3 weeks
- Fees
- Fixed fee, quoted on requestEstimate the budget for this service
Frequently asked questions
Do you need full access to the target?
No. The review adapts to what the deal allows: data room only, or data room plus interviews. The report states clearly what could and could not be verified.
Do you run technical tests?
Not myself: the work covers governance, practices and evidence. If technical testing is needed, I scope it, bring in a specialist provider and interpret the results.
How is confidentiality handled?
I sign the deal NDA and work within the data room. Before accepting, I also check that there is no conflict of interest with the target.
First call
In 30 minutes we can go through the target and the deal timetable, and what a cyber review can cover in the time available.