M&A Diligence
Quantitative cyber due diligence for PE and strategic acquirers: the CCOD worked example, the 72-hour IC playbook, the R&W insurance vs price-reduction decision, and the year-zero baseline for portfolio companies.
- 2of 9
Security Due Diligence in M&A: A Guide for Both Sides
Cybersecurity due diligence in M&A — what acquirers should look for in a target, and how sellers should prepare. A practical guide for both sides of the deal.
Read - 3of 9
Inside a Cyber Cost of Deal: A Worked Example for Investment Committee
The target was a mid-market SaaS. $80M enterprise value, healthcare-adjacent. The deal partner wanted one IC slide. Here's the five-pillar math and the $736K number behind it.
Read - 4of 9
R&W Insurance or Price Reduction? How to Use a Quantified Cyber Number at the Negotiating Table
They picked R&W. Eighteen months later, the known-findings carve-out did exactly what those carve-outs always do. Here's when each commercial option actually works.
Read - 5of 9
The Year-Zero Cyber Baseline: How PE Operating Partners Make Diligence Findings Worth Something Post-Close
The PDF lives in a SharePoint folder no one opens. The diligence findings die on the day the deal closes. Here's how operating partners stop that from happening.
Read - 6of 9
Cyber Diligence in a Q3 Close: The 5-Day Version
What a compressed cyber diligence honestly delivers in five business days — Tier-1 exposure analysis, vendor concentration, data sensitivity, and a defensible Cyber Cost of Deal number. What you cut, what you can't safely cut, and where the compression breaks down into pretend work.
Read - 7of 9
PE Portco Security Governance: The Quarterly Board Packet the Fund Actually Needs
Kroll's 2026 PE cyber survey puts the average portco incident at $2.1M and ACA's 2026 benchmark finds half of PE portcos at elevated or high cyber risk. This is the three-slide quarterly packet that replaces the folder of heat maps and lets the fund answer the LP's aggregate-exposure question before an incident forces the answer.
Read - 8of 9
What the SEC Requires for Cyber Disclosure in M&A: Item 1.05, Reg S-K Item 106, and the Deal Team's Playbook
Three SEC rules — Item 1.05 8-K, Reg S-K Item 106, and Item 2.01 8-K — set the cyber disclosure duty around any M&A deal that touches a public acquirer or soon-to-be-public target. When the 4-business-day clock starts, what the diligence package must contain to support a defensible filing, and the three enforcement cases every deal team should know cold.
Read - 9of 9
Third-Party Risk During a Portfolio Restructure
Every vendor risk playbook assumes steady state. Then the fund closes a carve-out, or bolts on a competitor. What actually happens to the vendor register at close, which change-of-control triggers fire in week one, and the ninety-day playbook that separates the portcos the fund puts on the next platform strategy from the ones it quietly downgrades.
Read
Ready to put this into practice?
See how vCISO Lite operationalizes the methodology behind this series.