Why Cyber Due Diligence is Critical for M&A Success

By Even Andreassen |

[Editors Note: Even Andreassen is one of our talented business developers. He is also an assistant professor at a Norwegian university. In this excellent blog post he has given us his take on cyber due dilligence and the role of River Security. Enjoy the read!
~ Chris Dale]

In the modern business landscape, cybersecurity risks can have a massive impact on mergers and acquisitions (M&A). Beyond just financials, the security of a company’s digital infrastructure has become a key factor in ensuring a successful deal. Failing to include cyber due diligence can expose both buyers and sellers to unexpected security risks, costly breaches, and regulatory issues, making it a critical component of any M&A transaction.

What is Cyber Due Diligence?

Cyber due diligence involves assessing the cybersecurity posture of a target company during the M&A process. This includes evaluating IT security infrastructure, data protection policies, regulatory compliance, and resilience against cyber threats. For buyers, it’s essential to understand any potential vulnerabilities that could impact the deal, while sellers benefit from demonstrating a robust security framework.

Key Reasons Cyber Due Diligence is Essential

  • Risk Reduction: Identifying and addressing vulnerabilities before the deal is finalized helps prevent costly breaches and minimizes regulatory risks.
  • Regulatory Compliance: Ensures that both parties meet the stringent requirements of GDPR, NIS-2, DORA, ISO 27001, and other relevant standards.
  • Valuation Impact: Unresolved security gaps can lead to price adjustments or add conditions to the acquisition, impacting the overall value of the transaction.

The Role of River Security

At River Security, we provide expert cyber due diligence services for M&A transactions, whether it’s a small acquisition or a large-scale merger. Even smaller deals can pose significant risks if the target company has hidden vulnerabilities that could compromise the buyer’s broader network or data.

We specialize in identifying these risks, ensuring regulatory compliance, and delivering actionable recommendations to mitigate potential threats. This proactive approach helps both parties achieve a seamless and secure transition.

Decorative image representing the complexities of IT and Cyber Security

Our Process

As part of our Digital Footprint analysis, we:

  • Identify Cyber Threats: Through advanced techniques like penetration testing, we uncover potential security risks within the target company’s infrastructure.
  • Assess Investment Risk: We help you understand how these vulnerabilities could affect the value and success of the deal.
  • Ensure Compliance: Confirm that the target company adheres to all relevant regulations, safeguarding against future legal challenges.
  • Protect Data Privacy: Evaluate the company’s data security protocols to ensure sensitive information is adequately protected.
  • From the inside of a target organization, we also hold a range of techniques to help assess and make the transition better and more secure.

Notable Examples

Cyber due diligence has been spotlighted in high-profile M&A deals where overlooked cybersecurity issues had significant consequences. For instance, Verizon famously reduced its acquisition price of Yahoo by $350 million after discovering a massive data breach that affected all 3 billion accounts.

Similarly, Marriott’s acquisition of Starwood Hotels resulted in fines and reputational damage after a breach compromised 383 million guest records. These cases highlight the importance of proactive cybersecurity assessment.

Challenges in Cyber Due Diligence

One known challenge is involving specialist firms in conducting this type of analysis, especially in highly sensitive, publicly traded transactions. However, this can be addressed by ensuring the request for cyber due diligence comes directly from the company being acquired. By engaging an independent specialist under confidentiality agreements, both buyer and seller can maintain discretion while ensuring that cybersecurity risks are thoroughly evaluated.

Norwegian Examples

In Norway, HitecVision prioritizes cyber due diligence in its energy sector acquisitions to ensure compliance and security on the Norwegian Continental Shelf. Aker BP, after merging with Lundin Energy’s oil operations, also focused on cybersecurity to protect their IT infrastructure, particularly in critical sectors.

The Future of M&A: Cyber in Focus

As cyber threats evolve, it’s clear that including cybersecurity within the M&A scope will soon become the norm. Yet, based on our experience, over 50% of deals still do not include thorough cyber due diligence — a gap that presents significant risk to both parties.

Whether you’re buying, selling, or advising on a deal, ensuring cybersecurity is a key component of the transaction is crucial for protecting the value and success of the merger or acquisition.

Sources:

Yahoo Slashes Price of Verizon Deal $350 Million After Data Breaches – SecurityWeek

Marriott reaches $52 million settlement over years of data breaches (engadget.com)

Posted in Attack Surface Management, Penetration Testing, River Security