When a company buys another company, it buys everything: the customers, the systems, the contracts, and the security debt. That last item rarely appears on the balance sheet, yet it transfers ownership all the same. Unpatched systems, weak access controls, unsupported software, and unresolved past incidents become the buyer's problems on the day the deal closes, along with the regulatory and reputational consequences if something goes wrong afterward. In my governance work I argue for treating cyber due diligence as a standard part of acquisition discipline, not an optional technical review that happens if time allows.
Start with the questions a board would ask
Good due diligence is not a scan report. It is a structured set of questions, answered with evidence. What data does the target hold, and what obligations attach to it? Have there been incidents, breaches, or regulatory findings, and how were they handled? How is access to critical systems controlled and reviewed? Which systems are unsupported or near the end of vendor support? What security obligations has the target signed up to in customer contracts, and can the combined company actually meet them? The point is to understand risk in business terms: what could this cost us, what could this interrupt, and what will it take to fix?
Evidence beats reassurance
Sellers naturally present their environment in the best light, and most are sincere. Sincerity is not evidence. A disciplined review asks for artifacts: recent risk assessments, penetration test summaries and their remediation status, access review records, incident logs, policy documents that are actually in use, and the list of critical vendors with their own security expectations. Where evidence is thin, that thinness is itself a finding. It tells the buyer the target's security was run on trust, which means the buyer should price and plan accordingly rather than assume the best.
Findings should move the deal, not just the report
Due diligence that ends in a report nobody acts on is wasted effort. Findings belong in the transaction itself. Material weaknesses can shape price, indemnities, escrow arrangements, or specific undertakings the seller completes before close. They should certainly shape the integration plan: which systems get connected to the buyer's network immediately, which stay isolated until they are remediated, and which get replaced outright. The most expensive sentence in an acquisition is "we will deal with security after integration." After integration, the target's weaknesses are no longer the target's; they are yours, connected to everything you own.
Plan the first period of ownership
The review should hand over a prioritized remediation roadmap for the combined organization: the few items that must be fixed immediately, the items scheduled into normal improvement work, and the items formally accepted as risk by named leaders. Ownership of that roadmap needs a name and a budget line, or it will dissolve into the general noise of integration. This is program management as much as security: clear scope, clear sequence, clear accountability.
The takeaway
You cannot negotiate, price, or plan for risk you have not looked for. Cyber due diligence done before close is comparatively cheap and gives the buyer choices. The same discoveries made after close arrive as incidents, findings, and unplanned spend. Inherit the company, by all means, but do not inherit its security debt blind.