Cyber due diligence: a risk-based approach to value protection for PE firms

The cyber due diligence framework 

Effective cyber security DD follows a proportionate, risk-based methodology scaled to deal size and potential returns. The goal is not to impede deals but rather to consider whether relevant information is factored in before details are finalised. The results are used primarily to elevate cyber security risks and the investment and effort required to bring cyber postures up to a secured standard to reduce the risk of unauthorised access. 

Cyber security concerns rarely function as deal-stoppers on their own. When they do derail transactions, it is normally in tandem with quality of earnings and other tax issues that exist. Firms typically begin with a general assessment, covering cyber security policies, security incident history, technical security tools, and infrastructure and architecture, before drilling down into any identified areas of concern in relevant cost centres. 

“Cyber security due diligence teams are balancing two distinct time horizons that could impact deal numbers: immediate remediation costs required to bring the target company up to acceptable industry security standards and longer-term red flags that could undermine future value creation.” – Tyler Leach, Director, Forvis Mazars US

Certifications such as ISO 27001 and SOC 2 can provide useful starting points for an assessment, but they are not always comprehensive enough to evaluate the whole risk profile of a target company. Previous cyber incidents warrant particular scrutiny as to whether remediation has occurred fully and if not what, additional measures an investor will want to consider. Representations and warranties insurance, commonly obtained as part of deal structures, evaluate cyber security as part of the underwriting process. During the diligence process it is important to evaluate all security incidents and document the remediation steps performed and implemented to be able to answer detailed questions during the underwriting process. 

The diligence process must be comprehensive to identify "key and critical red flags" that could impact security risks, investment costs, current valuation, and future returns. This requires assessing not just current security posture but also the organisation's capacity for improvement and alignment with industry standards. Whilst true for platform deals, this is especially pertinent for add-on deals, where alignment with the acquiring company’s cyber postures is important.  

Common findings during cyber due diligence 

Those in regulated industries typically demonstrate a stronger cyber security posture by necessity – the direct financial risk of non-compliance and regulatory scrutiny mandate natural incentives for a more robust cyber security posture. 

Whilst gaps can exist in any organisation’s cyber posture, smaller businesses in particular more frequently surface recurring findings during DD. Due to resource constraints internally, cyber security is outsourced to managed service providers with limited investment backing, which can create challenges for these organisations to achieve a strong cyber maturity profile based on their risk profile.  

Common findings include: 

• Limited asset tracking and visibility can create security and cost hardware obsolescence as bringing these systems up-to-date and enhancing the security posture will require investment in both technology and processes. 
• Immature patch management practices, coupled with inadequately protected endpoints, create vulnerabilities that could expose the business to known security risks.  
• Cybersecurity insurance missing certain areas of coverage and lower aggregate policy limits create gaps for full coverage in the event of an incident. 
• Governance gaps that indicate a lack of strategic oversight around cyber decision-making and policy implementation. Good governance is resource intensive and many target organisations require significant investment to implement effective cyber governance. 

AI is a key focus, both for investment and for due diligence 

As much as AI maturity is a point of interest for investors and firms, AI is also a critical area for cyber DD. Organisations leveraging AI for business-critical functions should also display maturity in other areas like governance and segmentation.  

Firstly, firms must investigate what target companies actually mean when they claim to use AI, understand accessing, and understand the type of AI in use. Investigators must carefully understand the usage of the AI, what governance has been put in place to safeguard its usage, the data being used by the model for training, and the organisation’s overarching AI strategy for current and future business operations. Any data integrity, data privacy, bias, or ethical issues must be understood to effectively mitigate the risks of any AI implementations, whether existing or planned. 

“Sometimes it turns out the AI is not truly being leveraged at all, and sometimes it is a very sophisticated AI tool being utilised without the appropriate guardrails in place. Claims around AI maturity can differ from the reality of how it is being applied, and the gaps often reveal security concerns that need addressing.” – Tyler Leach, Director, Forvis Mazars US

As firms continue to accelerate their AI ambitions, understanding how their organisation can harness the AI technology will be increasingly important, as 47 percent of executives report AI as the investment expected to deliver the greatest return in 2026, whereas 40 percent report it to be cyber security.  

Key considerations when evaluating AI usage include governance frameworks, data sensitivity, and whether systems are properly contained or sharing information externally. One of the most important pieces of the AI puzzle is workforce enablement. Employers must consider if their employees are adequately educated and enabled around its usage as well as ensure that there are policies and trainings in place to guide inputs and monitor outputs. Depending on the scope of the AI tooling, enabling the user base could become a significant and costly requirement for firms to factor in. Cyber security is also shaping how organisations prioritise and deploy AI. 

Generative AI presents particular challenges in regulated spaces, where companies often proceed more cautiously than their counterparts in less regulated industries. However, this conservative approach tends to result in stronger governance practices around emerging technologies when they are implemented. 

When firms become the subjects of their own scrutiny  

PE firms, especially in the midmarket, are well known for running lean, meaning rarely are these cyber security investigations being conducted internally to the firm. Instead, firms leverage operating partners and consultants to evaluate target companies and make recommendations. 

Of course, firms themselves have cyber security needs. Dictated by the industries in which they operate and the investors with whom they partner, these firms often find themselves needing to meet standards beyond what their own internal risk profiles would require. To address this, more and more firms are leveraging these same operating partners for their own cyber security, matching their security posture to the standards they are driving throughout their holdings. But because of their increased awareness and knowledge of cyber security through DD, they can avoid many of the traps smaller target companies fall into through outsourcing. 

Protecting future value through cyber due diligence 

As digital transformation accelerates across industries, cyber security DD represents an essential mechanism for protecting investment value in private equity transactions. Whilst the approach remains risk-based and proportionate to deal size, firms that prioritise this aspect of DD will be more successful at protecting both immediate transaction success and long-term value creation. 

Frequently asked questions