Independent technical practice
Cyber Due Diligence
Know the cyber risk before the deal closes, in terms a deal committee can use.
Who we serve
- Private Equity
- M&A Attorneys
- Investment Groups
- Corporate Development
- Lenders
Scope
Deliverables
-
Security Maturity Review
What the target actually operates, versus what the data room claims.
-
Past Breach Review
Prior incidents, disclosure history and unresolved exposure.
-
Dark Web Exposure Review
Leaked credentials, exposed data and chatter tied to the target.
-
Regulatory Risk Review
Obligations, notifications and liabilities the buyer will inherit.
-
Third-Party Risk Review
Vendor and supply-chain dependencies that transfer with the entity.
-
Executive Summary
A two-page finding a deal committee can read before the vote.
Fixed-fee engagement structure: the cost is known before the work starts, whatever the deal does next.
Methodology
How the engagement runs
-
Scope
Deal timeline first. We work to the close date, not the other way round.
-
Collect
Data-room review, external reconnaissance and management interviews.
-
Assess
Findings mapped to deal impact: price, indemnity, remediation cost, or walk.
-
Report
Executive summary plus a technical appendix for the integration team.
-
Brief the deal team
A working session with counsel and the sponsor before signing.
What counsel receives
A file another examiner could pick up.
Each diligence conclusion is tied to the material reviewed, the people interviewed and any validation completed within the deal window.
The deal team receives technical facts and stated assumptions. Legal treatment and transaction terms remain with counsel.
- Scope letter and stated assumptionsWhat was asked, what was examined, what was out of scope, and the assumptions the analysis rests on.
- Evidence handling recordAcquisition details, hash values, storage and transfer, and a chain-of-custody log for each item.
- Methodology statementTools, versions and procedures described so a second qualified examiner can repeat the work.
- Findings, separated from interpretationObserved facts first; expert opinion identified as opinion, with the basis for each conclusion.
- Limitations and unresolved questionsWhat the evidence cannot show, what was unavailable, and what further work would be required.
- Exhibits and supporting materialExtracted artifacts, timelines and schedules in a form that can be attached to a filing or a board pack.
- Deal-usable summaryFindings mapped to representations, warranties, remediation cost and post-close conditions for the deal team.
Proof
Pre-acquisition review, mid-market software target
Diligence surfaced an unreported intrusion at the target and a set of exposed credentials still in active use. The findings were quantified as remediation cost and inherited notification exposure, and were used in the final negotiation of price and indemnity.
Credentials & standards
- Fixed-fee scoping, known before work begins
- Delivery inside the diligence window
- Engagements structurable through outside counsel
- Findings expressed in deal terms, not CVSS scores
Related
Related services
Frequently asked
Common questions
How fast can you turn a review around?
Standard reviews run inside the diligence window. Expedited scopes are available when the timeline is compressed; we agree the delivery date against the close date at scoping.
Do you work through counsel?
Frequently. Engagements can be structured through outside counsel where privilege matters, and the reporting is built with that structure in mind from the start.
What if the deal dies?
Fixed-fee scoping means the cost is known upfront regardless of outcome. Findings on a dead deal remain useful. Several clients have reused the assessment when the target came back to market.
Talk with an examiner
Discuss the matter and the next step.
Call to discuss timing, scope and the safest way to share information. Do not send evidence or credentials by email.
24/7 hotline: 1-800-868-8189