Cyber Due Diligence, Breach History Review, and Remediation Costing
Know What You Are Buying Before the Breach Is Yours
A data room tells you what the target says about its security. A Global Digital Forensics diligence review shows what the target actually runs, whether it has already been breached, and what the fixes will cost after closing. Our examiners test the seller's representations against systems, records and interviews inside your deal window, so the findings reach the price, the indemnity and the first hundred days.
Scope the review
A Diligence Window Built Around Your Signing Date
Deal teams rarely get more than a few weeks and a partial data room. We scope around that reality: the questions the investment committee has to answer, the access the seller will actually grant and the date the findings must land to still move the terms. A questionnaire answered by the target's own IT lead is a starting point. We test it against what the systems, the logs and the people who run them actually show.
Breach History and Disclosure Record
Prior incidents, how they were contained, who was told and whether anything is still unresolved. An incident nobody fully examined becomes your liability on closing day.
Exposed Credentials and Systems
Leaked passwords, internet facing services and stale remote access tied to the target, each checked for date and provenance so a lookalike company's problem never lands in your report.
Remediation Cost and Integration Plan
Each material finding carries the fix, the effort and the integration dependency, sorted into what belongs in the price, the indemnity or the first hundred days.
Scope, seller access and the delivery date are agreed in writing before the review begins.
Diligence for Sponsors, Deal Teams and Lenders
Private equity sponsors use the review to price technical exposure before committing capital and to set the remediation agenda for the first hundred days. Merger counsel use it to draft representations, warranties and specific indemnities around conditions we observed rather than conditions the seller asserted. Corporate development teams read the integration dependencies beside the commercial model, and lenders read the findings that bear on the credit.
Each of those readers needs a different report. Tell us which seat you hold and we will write for the decision in front of you, or call (800) 868-8189 if the signing date is already close.
Methodology
The Diligence Sprint, Step by Step
-
Timetable: Scope Fixed to Signing
We set the questions, the target systems, the seller access and the delivery date against your signing and closing dates before any work begins.
-
Records: Data Room and Interviews
We read the data room, run lawful external reconnaissance of the target's exposed systems and interview the administrators. A policy describes intent; the person running the firewall describes practice.
-
Exposure: Findings Priced for the Deal
Every material finding is tied to its remediation, the likely effort and cost and the integration work it creates.
-
Report: Summary and Technical Appendix
The committee reads the material findings and their consequence; the integration team gets the evidence, the affected systems and the fix behind each one.
-
Briefing: Examiner to Deal Team
The examiner who did the work walks the deal team and the sponsor through the findings, the assumptions and the gaps in the record before the vote.
Rapid, Full or Post Close Diligence
Rapid exposure review without seller access
When the process is early or the seller is guarded, we work from the outside in: exposed services, leaked credentials, breach disclosures and public technical footprint. It answers whether there is a reason to dig deeper before the exclusivity period starts.
Full diligence with data room and interviews
With access to the data room, the security team and selected systems, we test the representations line by line and deliver the report the investment committee and the deal team work from.
Post close validation in the first hundred days
After closing, we confirm the conditions found in diligence, verify the fixes the seller promised and set the remediation baseline the new owner will be measured against.
Not sure which depth the timetable allows? Call (800) 868-8189 and a senior examiner will tell you what can be answered before the signing date.
What the deal team receives
Your Diligence Report and the Record Behind It
Every conclusion is tied to the material we reviewed, the people we interviewed and the validation we completed, so the deal team can see how far each finding was tested and negotiate from it with confidence.
Need a scope letter before the seller grants access? Share the transaction timetable on the first call and we will draft the questions, the access request and the delivery date.
- Scope letterThe questions asked, the material requested and the delivery date, agreed before the work begins.
- Evidence handling recordWhere material is collected, acquisition, hash values, storage and custody are documented so the evidence holds up later.
- Findings and their basisEach observation stated with the evidence that supports it, kept apart from expert interpretation.
- Open questionsRecords the seller could not produce and the specific follow up work that would close each gap.
- Deal usable summaryFindings mapped to the representations, warranties, remediation estimates and post closing conditions on the table.
Why GDF
Forensic Examiners on the Deal Team
Global Digital Forensics, founded in 1992, examines breached systems, reconstructs incidents and explains the results to boards, insurers, regulators and courts. That experience matters in diligence, because an old incident the seller never fully understood can change the price.
Diligence findings are written by examiners who have testified in federal and state courts, for a practice that serves AmLaw 100 firms and Fortune 1000 companies; founder, CEO and CTO Joseph Caruso, a CISSP, examined credit card transaction and deposit systems in Bank One shareholder litigation. Meet the examiners.
How we work inside a deal
Scope, access and delivery date are confirmed in writing before the review begins.
The engagement can run through outside counsel, with the reporting arrangements set at the start.
Findings are explained in terms of the transaction, with CVSS scores and other technical measures reported alongside that explanation.
Frequently asked
Turnaround, Privilege and Seller Access
How fast can you turn a cyber due diligence review around?
The review is scoped to the diligence window. When the timetable is compressed we agree an expedited scope and a delivery date against the signing date, and we tell you on the first call which questions that time will answer.
Can the review run under privilege?
Yes. Many deal teams engage us through outside counsel when privilege is a consideration, and the reporting arrangements are agreed before the work begins so the report is written for that structure from the first page.
What if the seller will not grant system access?
We start with a rapid exposure review from the outside in, which needs no cooperation, and use what it finds to support a narrower, specific access request. Findings from outside often change how forthcoming a seller becomes.
What happens to the work if the deal does not close?
The findings still document the target's technical condition on the dates examined. If the target returns to market or the deal revives, the report becomes the baseline for a review of what has changed since.
Talk with an examiner
Diligence Scoped to the Deal Calendar
Tell us the target, the systems involved and the signing date. A senior examiner will check for conflicts and come back with a scope that fits the deal window.
Global Digital Forensics has operated since 1992 with court tested experts, 24/7 response and sixteen US offices.
Start the review
Know the Exposure Before You Sign
Tell us what the data room claims and what the committee needs confirmed. On the first call a senior examiner maps your questions to the signing date, tells you what access to request from the seller and walks you through the depth, timeline and pricing of the review. The consultation is free.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .