Independent technical practice
Cyber Due Diligence
Know the cyber risk before the deal closes, in terms a deal committee can use.
Agree what the diligence review can examine
Agree which target systems and public or lawfully available sources can be examined. Check when each record was created, where it came from and whether it actually concerns the target company. Public results can be outdated or unrelated; the report states gaps in access, including material unavailable from private forums.
The deliverable separates verified conditions, plausible but unconfirmed exposure, unavailable records and the basis of remediation estimates. Counsel evaluates legal obligations and the parties make commercial decisions.
Who we serve
- Private Equity
- M&A Attorneys
- Investment Groups
- Corporate Development
- Lenders
Scope
Deliverables
-
Security Maturity Review
What the target actually operates, versus what the data room claims.
-
Past Breach Review
Prior incidents, disclosure history and unresolved exposure.
-
Dark Web Exposure Review
Leaked credentials, exposed data and chatter tied to the target.
-
Regulatory Risk Review
The technical report identifies observed conditions and potential exposure for counsel to evaluate under the transaction structure. Legal transfer of liabilities, notification duties and indemnity are not determined by technical diligence alone.
-
Third-Party Risk Review
Vendor and supply-chain dependencies that transfer with the entity.
-
Executive Summary
A two-page finding a deal committee can read before the vote.
Fixed-fee engagement structure: the cost is known before the work starts, whatever the deal does next.
Methodology
How the engagement runs
-
Scope
Deal timeline first. We work to the close date, not the other way round.
-
Collect
Data-room review, external reconnaissance and management interviews.
-
Assess
Findings mapped to deal impact: price, indemnity, remediation cost, or walk.
-
Report
Executive summary plus a technical appendix for the integration team.
-
Brief the deal team
A working session with counsel and the sponsor before signing.
What counsel receives
A file another examiner could pick up.
Each diligence conclusion is tied to the material reviewed, the people interviewed and any validation completed within the deal window.
The deal team receives technical facts and stated assumptions. Legal treatment and transaction terms remain with counsel.
- Scope letter and stated assumptionsWhat was asked, what was examined, what was out of scope, and the assumptions the analysis rests on.
- Evidence handling recordAcquisition details, hash values, storage and transfer, and a chain-of-custody log for each item.
- Methodology statementTools, versions and procedures described so a second qualified examiner can repeat the work.
- Findings, separated from interpretationObserved facts first; expert opinion identified as opinion, with the basis for each conclusion.
- Limitations and unresolved questionsWhat the evidence cannot show, what was unavailable, and what further work would be required.
- Exhibits and supporting materialExtracted artifacts, timelines and schedules in a form that can be attached to a filing or a board pack.
- Deal-usable summaryFindings mapped to representations, warranties, remediation cost and post-close conditions for the deal team.
Illustrative scope
Illustrative acquisition diligence
Illustrative diligence question: a target has signs of a prior intrusion and possible credential exposure. A scoped examination would validate available sources, document technical condition and estimate agreed remediation tasks.
Credentials & standards
- Fixed-fee scoping, known before work begins
- Delivery inside the diligence window
- Engagements structurable through outside counsel
- Findings expressed in deal terms, not CVSS scores
Frequently asked
Common questions
How fast can you turn a review around?
Standard reviews run inside the diligence window. Expedited scopes are available when the timeline is compressed; we agree the delivery date against the close date at scoping.
Do you work through counsel?
Frequently. Engagements can be structured through outside counsel where privilege matters, and the reporting is built with that structure in mind from the start.
What if the deal dies?
Fixed-fee scoping means the cost is known upfront regardless of outcome. Findings on a dead deal remain useful. Several clients have reused the assessment when the target came back to market.
Talk with an examiner
Discuss your matter and next step
Tell us the systems, evidence and deadline. We can review relevant experience, potential conflicts and the scope before engagement.
Since 1992 · 24/7 dispatch · Court-tested experts
Talk with an examiner
Discuss the matter and the next step.
Tell us what happened and what you need to find out. Speak with a GDF expert about how we can help.
24/7 hotline: 1-800-868-8189