M&A Cybersecurity: Due Diligence and Integration Risks

Mergers and acquisitions create cybersecurity risks at every phase: during due diligence when access to sensitive data expands, during the announcement when the deal becomes a target, and during integration when incompatible systems are connected. The 2017 Verizon-Yahoo deal saw a $350 million price reduction after Yahoo disclosed two massive data breaches affecting 3 billion accounts. Marriott inherited the Starwood breach (500 million records) through its 2016 acquisition, facing over $120 million in fines for a breach that occurred before the acquisition closed.

Due Diligence Phase

Assess the target’s security posture. Before the deal closes, evaluate the target company’s security program through questionnaires, documentation review, technical assessments, and third-party security ratings. Key areas: incident history, vulnerability management maturity, compliance status, data inventory, pending litigation related to security, and cyber insurance coverage.

Review breach history. Undisclosed or undiscovered breaches become the acquirer’s liability post-close. Conduct dark web monitoring for the target’s data, review their breach notification history, and assess whether their incident response capabilities would have detected a sophisticated breach.

Evaluate technical debt. Legacy systems, unpatched infrastructure, shadow IT, and technical debt represent security risks that carry cost implications for remediation. Quantify these costs as part of deal valuation.

Data privacy compliance. Assess the target’s compliance with GDPR, CCPA, HIPAA, and other applicable regulations. Non-compliance carries financial penalties and operational restrictions that affect deal value.

Announcement to Close

The public announcement of a deal makes both companies targets. Attackers know that M&A activity creates distraction, urgency, and changes in processes that lower security vigilance. The period between announcement and close sees elevated phishing targeting both organizations, often impersonating deal-related communications.

Heightened monitoring. Increase security monitoring for both organizations during this period. Watch for phishing campaigns referencing the deal, unusual access patterns, and data exfiltration that could indicate insider trading or competitive intelligence gathering.

Integration Phase

Network integration risks. Connecting two corporate networks can expose the more secure organization to the less secure one’s vulnerabilities. Do not rush network integration. Assess and remediate the acquired network before connecting it.

Identity management. Provisioning access for acquired employees and deprovisioning access for departing employees during integration is complex. Orphaned accounts and excessive permissions during transition create windows of vulnerability.

Harmonize security standards. Establish a unified security baseline and create a remediation plan for bringing the acquired entity up to standard. This may take 12-24 months for significant security gaps.

For the vendor risk framework applicable to acquisition targets, see our vendor risk management guide. To plan integration security, explore our incident response plan guide.

Post-Integration Monitoring

After integration, maintain heightened security monitoring for 6-12 months. The integration period is characterized by unusual activity patterns, new access provisioning, and system changes that create both legitimate noise and cover for malicious activity. Baseline the acquired environment’s normal behavior early and monitor for deviations.

Conduct a comprehensive security assessment of the integrated environment within 90 days of completion. Verify that all planned security controls have been implemented, orphaned accounts from the acquired entity have been deprovisioned, and network segmentation meets the design specifications. This post-integration assessment frequently reveals gaps between planned and actual security posture.

The Cost of Getting It Wrong

Inadequate cybersecurity due diligence in M&A has resulted in some of the most expensive security-related losses in corporate history. Verizon’s acquisition of Yahoo saw a $350 million price reduction after undisclosed breaches came to light. Marriott inherited the Starwood breach liability including over $120 million in regulatory fines and years of litigation. These cases demonstrate that cybersecurity due diligence is not a technical detail but a material financial risk factor that directly impacts deal valuation and post-close liability.