Cyber due diligence: assume compromise before you close

The clearest UK precedent is the Marriott and Starwood case. The Information Commissioner's Office (ICO) penalty notice records that Marriott acquired Starwood in September 2016, while the attacker had installed a web shell on a device within the Starwood network on 29 July 2014. The intrusion therefore predated the acquisition by more than two years. Marriott estimated that 339 million guest records were affected.

Marriott told the ICO that it was only able to carry out limited due diligence on Starwood. The regulator did not treat that as an answer. In its reasoning the ICO held that a controller's duty to conduct due diligence over its data operations is not time-limited or a one-off requirement. In other words, the acquirer owns the problem from the moment it controls the systems, and the clock for compliance starts no later than closing.

The financial outcome was uneven. Mishcon de Reya records that the ICO's final penalty notice was £18.4m, after the regulator had indicated in July 2019 that it intended to fine £99.2m. The final figure reflected discounts applied by the regulator, but the headline for a deal team is the starting point, not the discount. A first position of £99.2m is the realistic worst case an acquirer should size at the outset.

Three lessons carry beyond hospitality. First, legacy platforms inherited in an acquisition are often the least monitored part of the combined estate, because they sit outside the buyer's tooling and are scheduled for retirement. Second, the personal data held in those platforms stays in scope of UK data protection law from the day the buyer takes control, whatever the integration timetable says. Third, the timeline matters: an attacker present for years before a deal, as in this case, may be present for years after unless someone looks. Build the review of legacy platforms into the first week of the plan.

The regulatory lens also differs by country. A UK buyer acquiring a target with European customers should assume that more than one supervisor may take an interest, and that notification duties follow the data subjects, not the registered office. Map where the target's personal data sits, which regulators have jurisdiction and how those notification clocks would run in parallel. If this has not been done, the target cannot answer the first questions a regulator would ask after an incident, and the buyer will be answering them within days of closing.

What this means for a CISO: the board should hear, before signing, that regulatory exposure transfers with the target. Document the diligence you were able to do, the access you were refused and the compensating controls you applied. If access is limited, say so in the investment committee paper. A record of reasoned, proportionate action is the best defence available once something surfaces after closing.

Questionnaires typically ask whether the target has suffered a breach in recent years. The Department for Science, Innovation and Technology (DSIT) Cyber Security Breaches Survey 2025 gives the base rate: 43% of UK businesses and 30% of charities reported a breach or attack in the 12 months covered. Among medium businesses the figure was 67% and among large businesses 74%. For the mid-sized and large targets most buyers consider, an answer of 'none' is statistically unusual.

The kinds of incident are not exotic. Phishing was the most prevalent and disruptive type of breach or attack, experienced by 85% of businesses and 86% of charities that reported one. Verizon's 2025 Data Breach Investigations Report, which analysed over 22,000 incidents including 12,195 confirmed breaches, found ransomware present in 44% of breaches and credential abuse (22%) and exploitation of vulnerabilities (20%) as the leading initial attack vectors.

Those results change how a buyer should read the target's disclosures. Where a company reports no incident, the likelier explanations are weak detection, narrow definitions of 'incident' or a reluctance to disclose before exclusivity. Each of those is itself a finding. Ask how incidents are logged, who decides what counts, and how many events were investigated and closed over the last three years, including those that proved harmless.

Survey figures need careful reading. The DSIT survey measures breaches and attacks that organisations identified and reported in the 12 months before fieldwork, so it is a floor, not a ceiling, for what actually happened. Smaller businesses report fewer incidents, which may reflect lower exposure or weaker detection. For deal teams the implication is that target size is a poor guide to risk, and that a small acquisition with a large data holding, such as a software or healthcare business, can carry more exposure than its revenue suggests.

What this means for a CISO: replace the yes-or-no question with evidence. Request the incident register, the last two penetration test reports with remediation status, the endpoint detection coverage and the log retention periods. A target that can produce these quickly is demonstrating capability; one that cannot is telling you how long an intruder could have remained unnoticed.

Timing is the repeated weakness. In a Mergermarket survey of 100 senior executives, fielded in Q4 2022 with Admincontrol and published by ION Analytics, 24% said cyber due diligence on their most recent deal began only in the transaction execution phase, and a further 14% said it commenced only during post-closing integration. The survey is dated and from a vendor-sponsored series, but it is the most direct evidence we found of how deals are run.

The result was predictable. More than half of respondents, 52%, reported that a major undiscovered or undisclosed cyber risk came to light during post-closing integration on their most recent deal. For an acquirer, this is the worst moment to find a problem: the price is paid, the warranties may be thin and the target's people are being integrated into the group.

The same survey shows the market understands the stakes. About 69% agreed that a positive cyber diligence appraisal leads to a higher valuation, and vice versa. If that is true, cyber findings belong in the price discussion, not in a separate risk workstream that reports after the investment committee has met. A finding that reduces value by a defined amount is easier to negotiate than a general concern raised late.

Sellers have reasons to resist early cyber access: confidentiality, the risk of a failed deal and fear that findings will be used to cut the price. Buyers can reduce this friction. Offer a clean team under a strict confidentiality protocol, agree in advance the scope of any technical testing, and use an independent assessor who reports findings in categories rather than raw technical detail. Consider asking the seller to commission a vendor assessment, then reviewing the assessor's methods and rerunning a sample. This produces evidence faster than a drawn-out negotiation over access.

What this means for a CISO: ask for a seat at the screening stage, not the confirmatory stage. A light external-facing review, which looks at exposed services, leaked credentials and domain hygiene, can be done without the target's cooperation and takes days. It tells you whether to proceed to a deeper review, and it sets the tone for the data request that follows.

IBM's 2026 Cost of a Data Breach report puts the global average cost of a breach at USD 4.99 million, up 12 percent on the previous year, as reported by Baker Donelson. By sector, eSecurity Planet's summary shows healthcare at USD 6.64 million, financial services at USD 6.29 million, and technology and industrial organisations each at USD 5.50 million. Averages hide a long tail, but they supply a first-order range for a model.

Duration is as important as size. Organisations took an average of 247 days to identify and contain a breach in 2026, reversing several years of improvement, and breaches lasting longer than 200 days cost an average of USD 5.65 million against USD 4.32 million for those resolved more quickly. A target with weak detection is therefore both more likely to have been compromised and more costly if it was.

Newer exposures also matter. Baker Donelson reports that incidents involving shadow AI by employees more than doubled to 43 percent in 2026, from 20 percent in 2025. A target whose staff use unsanctioned AI tools with customer or source-code data has a data governance problem that does not show up in a conventional controls review. Add it to the questionnaire, together with the policy on what staff may paste into external models.

A usable exposure model has five components: incident response and forensics, notification and customer support, regulatory penalties and legal costs, business interruption and lost revenue, and remediation of the underlying weakness. Assign a range to each using the target's size and data profile, then weight the scenarios by the probability implied by detection quality. The point is not precision. It is to give the investment committee a view of the likely cost of an inherited problem, to compare with the value at stake in the price negotiation, and to show which findings justify a change in terms.

Equally important is what not to rely on. Cyber insurance held by the target may have exclusions for prior acts, war or state-backed attacks, or for failures to maintain stated controls, and may not transfer automatically on a change of control. Ask for the policy wording, the retention and the claims history. A target that describes itself as insured but has never tested a claim, or whose cover lapses at completion, leaves the buyer with the full exposure in the first months, when risk is highest.

What this means for a CISO: build a simple exposure range for the investment case. Use sector averages as the low case, adjust upward for sensitive data, weak detection and regulatory scope, and show the board the cost of the 200-day scenario. Agree with the deal team which findings lead to a price adjustment, which to a specific indemnity, and which to a condition to closing.

A credible review has two layers. The first is governance: the target's security leadership, policies, incident response plan, data protection compliance and board reporting. Aviva Risk Solutions' guidance on M&A cyber exposures lists eight pre-merger areas, from security governance through incident response and data protection to supply chain and third-party risk, and technology. We use a similar frame because it is complete, but it is not sufficient on its own.

The second layer is technical evidence. Where access is available, commission a compromise assessment: a targeted hunt for indicators of past or present intrusion across endpoints, identity systems and network logs. Review privileged accounts, stale credentials, remote access methods and unpatched internet-facing systems. These are the ways attackers got in, according to Verizon, and they are testable in days rather than weeks.

Suppliers deserve equal attention. Verizon reports that third-party involvement in breaches has doubled to 30%. The DSIT survey shows how little attention is paid: only 14% of UK businesses reviewed the risks posed by their immediate suppliers, rising from 11% of micro businesses and 21% of small businesses to 32% of medium and 45% of large ones. A mid-sized target is therefore likely to have limited visibility of the suppliers that hold its data.

For technology targets, the review needs additional layers. Source code repositories can hold embedded credentials and unpatched third-party libraries, and development pipelines can be a route into customers' systems. Review who has write access to code and build systems, how secrets are stored, how open-source components are tracked and whether the company issues software that customers install. Cloud and software-as-a-service estates need a similar check: administrator roles, unused tenants and public storage. These are the places where an intruder can sit unobserved while a conventional controls review gives a clean result.

What this means for a CISO: map the target's top ten suppliers by data access and test the contractual protections. Ask for the supplier list, the access each holds, the last assessment and the notification terms. A target that has not reviewed its suppliers is carrying an unpriced liability, and you inherit it with the contracts.

Findings must reach the contract. A general cyber warranty that the target has 'adequate' security is of limited value, because it is difficult to prove breach. More effective are specific warranties on named matters: no known incident in a defined period, no ransomware payment, compliance with notification duties, accuracy of the incident register and data inventory, and compliance with UK data protection law. Disclosure against warranties should be reviewed by the CISO as well as lawyers.

Where diligence finds a specific issue, such as an unremediated vulnerability or an unreported event, use a specific indemnity or a retention rather than relying on a warranty. Escrow or deferred consideration can align the seller with remediation in the first year. Warranty and indemnity insurance policies commonly exclude matters that are known to the buyer, so a finding that is not priced or indemnified may be uninsured.

Regulatory change is another input. Marsh reports that the UK Cyber Security and Resilience Bill is expected to tighten incident reporting, including mandatory initial notifications within 24 hours, with tougher turnover-based penalties. A target in scope of these rules, or serving customers that are, needs an incident response capability that can meet such deadlines. Check that the target's notification procedures work at that speed, not just that they exist on paper.

Interim covenants between signing and completion are often overlooked. They should prevent the target from weakening logging, extending access to third parties, paying a ransom or changing material systems without the buyer's consent, and should require prompt notice of any incident. Add a bring-down of the cyber warranties at completion, so that a breach discovered between signing and closing gives the buyer a right to renegotiate. Agree in advance who funds the remediation work that diligence identifies; leaving it open turns a technical fix into a commercial dispute.

Finally, think about what the seller can credibly promise. A private equity vendor exiting a portfolio company may offer limited warranties and no continuing involvement, while a founder-owner may be willing to stay and fund remediation. Align the protection with the seller's profile: escrow or retention for the first group, an earn-out linked to remediation milestones for the second. The best protection in either case is knowing about the issue before closing, because every contractual remedy is a poor substitute for finding the problem in time to fix it.

What this means for a CISO: draft the cyber conditions alongside the deal team in the first term sheet round. Specify access rights for the confirmatory review, the remedial steps that must be complete before closing, and the interim covenants on logging, access changes and new systems between signing and completion. Many deals lose the leverage to ask for these once exclusivity is agreed.

Closing is not the end of diligence; it is the point at which responsibility transfers. The ICO's finding that diligence is not a one-off requirement means that the buyer's obligations continue through integration. For the first hundred days, the default should be segregation: the target's network is separated from the group, its identities are not federated into the group directory, and any connection is explicit, logged and time-limited.

Start with visibility. Deploy the group's monitoring tools or an agreed equivalent on the target's endpoints and servers, bring its logs into central collection and set a baseline. Reset privileged credentials and keys on the first day, because those are the assets an unseen intruder would hold. Review remote access, service accounts and any shared credentials with suppliers. These are quick measures and they remove the main routes an inherited attacker would use.

Then integrate in stages, with a validation gate for each. Do not connect email, identity or data platforms until the target's controls have been assessed against the group's baseline and the compromise assessment has been completed or refreshed. The IBM data shows what is at stake in dwell time: 247 days to identify and contain, with a USD 5.65 million average for breaches over 200 days. A staged plan reduces the odds that an inherited intruder gets a path to the buyer.

People matter as much as tools. The target's security team often holds knowledge of its systems that exists nowhere else, and key staff may leave once a deal is announced. Identify the individuals who know the environment, agree retention arrangements before closing and bring them into the integration planning. Communicate early with the target's employees about security expectations, reporting channels and what will change, because staff who feel uninformed are more likely to bypass controls. Report progress to the board in the same measures used for the rest of the group.

What this means for a CISO: publish the integration plan to the executive committee with the validation gates and owners, and report progress against it. Accept that integration will be slower in the areas with greater risk. If the business case assumes fast systems consolidation, test that assumption in diligence and make the cyber gates part of the synergy timetable, rather than letting them be treated as obstacles.

Karter McKinley's M&A and Corporate Development work supports acquirers who need cyber findings to shape price, structure and integration. We coordinate the diligence workstreams with specialist cyber assessors and legal advisers, translate technical findings into negotiating positions and build the post-closing integration plan with its validation gates. We do not perform technical security testing ourselves, and our support does not replace advice from qualified lawyers or regulated advisers.