Key cybersecurity considerations throughout the M&A process

Cybersecurity has been a pressing consideration in M&A for years. Amid increasing digitisation in the dealmaking process, the growing sophistication of cyberattackers and mounting concerns that M&A often creates more gaps for them to exploit, this consideration has never been more important.

Cyber-attacks can impact any stage of the M&A process, from pre-sale preparation to post-deal integration, and can have a devastating effect for both buyer and seller wherever and whenever they occur.

As a result, dealmakers on both sides need to be wary of the threats they might face during M&A transactions and take pro-active steps to ensure that a deal is not scuppered by a cybersecurity breach.

This month, we look at the cybersecurity issues that vendors should focus on during the pre-sale preparation process, how both buyer and seller need to be on their guard during due diligence, negotiation and the closing of the deal and where buyers can take steps to minimise the threat posed by cyberattackers during post-deal integration and build a more secure business for the future.

Pre-sale preparation

Ensuring comprehensive cybersecurity policies and practices in place
Fundamentally, the exit preparation process is, firstly, about ensuring the business is ready to go to market and, secondly, taking steps to make it as valuable and attractive to potential buyers as possible.

Cybersecurity will play a key role in this. A business with strong cybersecurity infrastructure, well-developed action plans and policies in place and a track record of security will, naturally, be both more valuable and more attractive.

Pre-sale, owners should seek to ensure that their cybersecurity policies and practices are as comprehensive as possible. Rather than simply investing in the latest technologies and products, the first step here should be to conduct a thorough audit of the current cybersecurity infrastructure.

Cybersecurity Audit
Assuming the business does not already have a dedicated cybersecurity professional or team in place, then a qualified cybersecurity professional (or cybersecurity firm, depending on the size of the business) can be hired to assess the current state of the company’s security infrastructure.

From this, the business will gain a valuable report detailing vulnerabilities and risk areas within the existing system, as well as recommendations for improvements – providing a blueprint for bolstering the infrastructure.

Address critical weaknesses
One of the most pressing reasons to get an audit done at the outset of a sale preparation process is so that the business can be made aware of any critical vulnerabilities that need to be addressed urgently.

Failure to spot such weaknesses can be harmful in several ways. Firstly, should the business be the victim of a successful cyberattack during the sale, then this would be hugely damaging both to the process (potentially leading to significant delays or even derailing the deal entirely), as well as the company’s reputation, to the point that the buyer’s valuation of the firm might plummet.

Secondly, should the deal proceed to the point where a potential buyer is conducting due diligence, then these previously unforeseen weaknesses may be brought to light. Again, this would have a severely damaging effect on the buyer’s valuation of the firm and could threaten to derail the deal.

Finally, should a sale somehow go through without these weaknesses being spotted or addressed, then the buyer will find themselves vulnerable post-deal. A hack could have a devastating effect on post-deal integration and may even prove damaging to the former owner – for example if the transaction incorporated an earn-out structure.

Develop an action plan
With critical weaknesses addressed and a comprehensive audit detailing other areas in which security can be bolstered, the company can then produce an action plan outlining the steps required for fully optimising its cybersecurity infrastructure.

An action plan is likely to comprise a variety of steps aimed at either bolstering existing cybersecurity infrastructure and policies or implementing new elements. The key steps will typically involve cybersecurity tools, policies and response plans and personnel.

A company might, for example, develop a 90-day-action plan which may encompass the initial assessment stage and the addressing of critical weaknesses, before moving on to implementing new policies and technologies, bolstering existing systems and infrastructure and, finally, testing and monitoring the new setup.

Cybersecurity tools
While tightly structured, well-documented policies and efficient staff-training are vital parts of cybersecurity, tools and technologies are arguably the backbone of a successful cybersecurity infrastructure.

These days, the vast majority of companies utilise cybersecurity tools in some way. During the pre-sale period, the focus should be on optimising the use of existing tools, replacing those that are no longer effective and introducing new tools that help to address vulnerabilities or bolster security.

When boosting their cybersecurity infrastructure pre-sale, businesses should look at increasing their use of, or incorporating, tools such as firewalls, antivirus/malware software, virtual private networks (VPNs – these are especially valuable for businesses with a significant number of remote workers) and endpoint detection and response tools.

Such tools are widely available from a range of providers and many will offer packages bundling together numerous features. While this can be convenient, owners should also be wary of the potential risks of having your entire cybersecurity suite reliant on one provider (more on that later) and it may prove more effective to shop around and find the best option for each individual tool.

Cybersecurity policies
The next core component of a cybersecurity infrastructure is a strong set of policies. Again, following an audit a company can seek to create a set of policies or refine and update existing ones.

Policies should cover aspects such as data protection and privacy, incident response plans outlining steps to take during and after a breach, password management, access control and authentication and acceptable use policies pertaining to company devices and networks.

These policies should be documented and shared with all employees and stakeholders, ensuring that they are known and standardised throughout the business, can be readily consulted and, crucially, are demonstrable to potential buyers.

While they are distinct, cybersecurity policies are, of course, closely linked to the suite of cybersecurity tools that the company deploys. In some cases, policies may inform the technologies that are used – for example, companies that place a strong focus on access control and the principle of least privilege may employ a role-based access control (RBAC) system with automated provisioning and de-provisioning.

Training
When discussing cyberattacks, it may seem natural to focus mainly on the vulnerabilities of technology or on the role that tools play in plugging holes and preventing malicious attacks. However, the human element is perhaps just as vital.

According to the World Economic Forum’s 2022 Global Risks Report, 95 per cent of cybersecurity incident result from human error. Workers are particularly vulnerable to threats such as social engineering scams and phishing attacks, as well as general errors.

By the same token, a well-trained workforce that can identify threats such as phishing scams, understands safe protocols such as secure file-sharing and is able to spot and report suspicious activity can arguably be just as important in protecting a business as a whole infrastructure of cutting-edge tools.

Pre-sale, owners should develop (or outsource) a strong training programme for employees, involving regular update sessions and measurable outcomes, ensuring that it is well-documented and repeatable with new employees.

During the sale

Preventing cyberattacks on M&A deals
When two parties enter negotiations over a potential M&A deal, the process naturally involves the sharing of significant volumes of highly sensitive information – including financial, operational and technical data.

M&A deals are therefore popular targets for cybercriminals seeking to exploit any weaknesses – whether human or technological – in communication channels and gain access to such data.

In the digital age, M&A deals are heavily reliant on technology to facilitate communication, due diligence and other key aspects of the process. While this has delivered huge efficiencies for M&A transactions, it has also created numerous points that attackers can seek to exploit. Since the COVID-19 pandemic, this use of tech in M&A and the risks that come with it have only increased.

Successful cyberattacks on M&A transactions can be hugely damaging in a number of ways. Firstly, of course, if sensitive data is accessed then companies can incur significant financial losses, legal liabilities and reputational damage, as well as potentially being put in a position where hackers demand ransom payments.

Secondly, a successful cyberattack during the negotiation stage of an M&A deal risks putting the transaction in jeopardy. It will likely force the two parties to reassess the communication channels they are using, potentially exposes the proposed deal long before it would normally have been announced and, depending on the weak point that hackers targeted, could foster a sense of mistrust between vendor and buyer that could risk ending negotiations.

For owners hoping to exit their business and buyers seeking to make an acquisition, then, strong cybersecurity measures are vital to facilitating a smooth, successful and secure M&A transaction.

Ensure secure communications
The most effective strategy that parties involved in M&A transactions can use to ward off cyberattacks is to work together to ensure that communication channels are as secure as possible throughout the deal.

Virtual data rooms (VDRs) have become an invaluable part of the M&A process over recent years, offering end-to-end encryption that enables vendors and buyers to securely communicate and share and store sensitive documents during deals.

For more information on the role VDRs play in dealmaking and how to choose the right one for your M&A transaction, read our in-depth analysis of VDRs in M&A – including a list of leading VDR options ranging from low-cost options to full-featured solutions.

Naturally though, it may not always be feasible to conduct all communications via a VDR. However, even when using other communication channels – for example, email or video call – buyers and sellers should always utilise secure platforms offering end-to-end encryption and avoid sharing sensitive information via unsecured channels such as personal email accounts or messaging apps.

Secure collaboration tools can also be used to protect sensitive and confidential information when reviewing and editing sensitive documents.

Limit access as far as possible
The principle of least privilege (PoLP) - the approach which limits user access to the minimum required permissions for them to fulfil their role - is one of the guiding concepts behind cybersecurity best practice, and is one that should also be adopted during M&A deals.

PoLP guards against cyberattacks by reducing the potential attack surface hackers can target, preventing the spread of malware and by creating transparency – enabling organisations to see exactly who accessed what data and when.

In an M&A deal, this can be implemented by restricting access to sensitive information only to essential personnel. Operating under this principle and defining clear roles and permissions will enable buyers and sellers to reduce the threat of unauthorised disclosures or leaks.

Technologies such as multi-factor authentication (MFA) tools can help to ensure that only the right user accounts access particular items of sensitive deal-related information. VDRs will typically offer MFA tools and also monitor and log access to information, helping to detect anomalies.

Of course, limiting access also extends to sharing information. Throughout negotiations, due diligence and working out deal terms, vendors should only share the necessary information at each stage and could even take steps to redact inessential, sensitive information in documents they do share. Buyers can help to facilitate this secure practice by only requesting documents as and when they are actually needed.

Be proactive
It may sound vague, but adopting a proactive approach to cybersecurity during an M&A deal – as opposed to sitting back and expecting technology and common sense to keep the transaction secure – can be key.

Proactivity means taking steps such as actively monitoring for threats, such as by setting up real-time monitoring on the systems (e.g. VDRs) used during the deal, conducting frequent vulnerability scans on systems such as comms platforms.

Both parties could also conduct risk assessments on systems used in the deal, the potential for insider leaks and on third-parties (for example, lawyers, advisors or technology providers) that are involved in the transaction.

Proactivity extends to having unified incident response plans in place. Incident response plans should outline various potential threats that might be faced and the steps required to respond to them, for example protocols for reporting the breach and actions for recovery.

Beyond simply coming up with a response plan, it would also be valuable to test its efficiency by conducting a mock drill of a scenario such as a data leak or ransomware attack. This will enable both parties to identify and iron out potential weaknesses in the response plan.


Risk factor – Generative AI
According to a 2024 Bain & Company report, just 16 per cent of dealmakers currently use Gen AI in their dealmaking processes. However, this is expected to increase to 80 per cent over the coming three years, with AI expected to be used for everything from target identification to document review.

As well as introducing a host of efficiencies (and potential errors) into the M&A process, the growing use of Gen AI will also generate new cybersecurity concerns. Indeed, 36 per cent of Bain & Co respondents cited cybersecurity as one of the most concerning risks of using Gen AI in M&A.

Using Gen AI in dealmaking might throw up a number of threats. Gen AI models require huge amounts of input data in order to generate outputs and this might mean sensitive data being uploaded to third-party servers, making it vulnerable to threat actors. The same is true of the outputs from these Gen AI models. Gen AI platforms are typically operated by third parties who may not meet the standard of security required to protect such sensitive data.

This does not mean that dealmakers should completely avoid Gen AI, but simply proceed with a strong sense of caution. Ensure that only reputable providers with strong security credentials are used, establish clear guidelines and training for what data can be input into AI tools and, where possible, ensure that sensitive data is anonymised or redacted.


Buyers: Probe thoroughly in due diligence
For buyers, due diligence is the time to gauge the target company’s cybersecurity credentials. This will, fundamentally, help them to decide whether they go ahead with a deal and, if they do, play a major role in determining key aspects such as their valuation and negotiating position, all the way through to post-deal integration planning.

The first step will be to request all relevant documentation relating to the target’s cybersecurity infrastructure and protocols, as well as cybersecurity audits if they have had one taken and detailed information on incident history.

The buyer should then undertake their own research, ideally with the assistance and input of a cybersecurity professional, to evaluate and verify the information provided. Buyers should thoroughly evaluate policies, practices and infrastructure, assess third-party vendor relationships and compliance with relevant data regulations (such as GDPR) and probe the adequacy of their current protections for sensitive data.

Due diligence will also be vital in flagging up things that the vendor has either failed to disclose – such as previous incidents or unaddressed vulnerabilities highlighted in an audit – or has failed to identify and remedy – such as critical vulnerabilities in their existing infrastructure, policies or training protocols.

Any alarming discoveries or revelations at this stage could have a major impact on the buyer’s valuation or decision to proceed with the deal, underlining just how vital it is to undertake thorough cybersecurity due diligence.

Should the buyer opt to proceed with the deal, then the cybersecurity findings gleaned during the due diligence phase will be invaluable, helping to provide valuable insight on the areas in which cybersecurity infrastructure can be improved and optimised during the post-deal period.

Post-sale

Cybersecurity integration
Cybersecurity is a crucial consideration for new business owners during the immediate post-deal period, as they are faced with the challenge of understanding and adjusting to the new systems and infrastructure, addressing any critical vulnerabilities and, ultimately, creating a stronger cyber infrastructure to keep the business secure well into the future.

Transition roadmap
As we just mentioned, the information gathered during due diligence can be used as the core of a plan to adjust and improve cybersecurity post-acquisition. There are likely to be a number of considerations to focus on as part of the integration, including aligning the protocols, policies and practices of the target company and the owner's own business, unifying IT systems, closing any gaps that exist in the infrastructure and identifying long-term cybersecurity goals.

A transition roadmap that establishes the crucial elements of cybersecurity integration will be key, enabling a new owner to establish a timeline for the various tasks they need to fulfil. A roadmap will range from pressing early tasks like addressing critical vulnerabilities to longer-term plans for eventually building the optimal cybersecurity infrastructure.

This will enable an owner to define their objectives and milestones, establish and define a team for completing the transition, prioritise tasks and set deadlines or target times for meeting the key goals.

Fix vulnerabilities
Should a buyer have identified significant vulnerabilities in a target company’s cybersecurity infrastructure during the due diligence phase, then this is certain to be one of the first areas of focus once the acquisition has been completed.

Depending on the severity of the vulnerability, it may be prioritised before drawing up a post-deal plan and, in some cases, a buyer may even insist that the vulnerabilities are fixed as a condition of the deal going forward.

Whether the issues are technical, personnel-related (i.e. insufficient/no cybersecurity training) or pertaining to the company’s cybersecurity policies, the new owner will need to carefully consider how best to remedy the problem in a sustainable, long-term way.

As with strategising for cybersecurity integration following the deal and planning to build a strong infrastructure for the future, consulting a cybersecurity professional or firm can be helpful in responding to the most pressing concerns post-acquisition.

Harmonise systems
As well as assessing the target firm’s cybersecurity setup for vulnerabilities during the due diligence period, buyers should also use the opportunity to inventory the tools and policies that form the infrastructure in order to check for differences and potential points of incompatibility.

Having a strong, unified cybersecurity infrastructure protecting the consolidated business should be one of the key goals of the post-deal period and any incompatibilities or inconsistencies between the two pre-existing systems could be a hindrance to achieving this.

Once the target company’s tools, systems and policies have been inventoried and checked against the existing infrastructure, the buyer will be able to spot areas in which there are incompatibilities.

These could manifest in several ways: the target company may use hardware that is incompatible with the antivirus software that the buyer’s firm uses; the target may not operate using the Principle of Least Privilege (PoLP); or maybe the target company operates with a far more rigorous cybersecurity training regime for employees than the buyer.

Once these have been catalogued, the buyer can use the post-deal period to work through inconsistencies and remedy incompatibilities. This might include eliminating redundant or outdated tech, integrating newly acquired systems or tools, deploying updated tools across the combined business or ensuring that the whole business adheres to a single set of cybersecurity policies.

Harmonising the two cybersecurity policies as one will be one of the more labour intensive periods of the post-deal integration phase (which is saying something), but the result will be a far more streamlined, secure cybersecurity environment.


Risk factor - Be wary of tech consolidation
According to a 2024 report from Resilience, M&A and technology consolidation have led to cybersecurity vulnerabilities that threat actors are evolving their tactics to exploit.

According to the report, vendor data breaches or ransom attacks exploiting a third-party vendor accounted for 35 per cent of attacks in 2023. In the first half of 2024, this increased to 40 per cent – with Resilience predicting that this figure would rise further still.

This increase came alongside a similar rise in global M&A deal volumes, leading Resilience to warn that modern, interconnected business systems and rising dealmaking activity were amplifying the impact of attacks.

Resilience asserted that tech consolidation (companies consolidating their technology systems following M&A deals) can lead to catastrophic consequences in the event of a breach, noting that many whole industries were reliant on a single supplier for critical software services.

Vishaal Hariprasad, Resilience co-founder and CEO, commented: “Increased vendor interdependence and M&A activity have created an unprecedented opportunity for hackers, with far more points of failure and potential for human error.”

“Now more than ever, we need to rethink how the C-suite approaches cyber risk. Businesses are interconnected like never before, and their resilience now depends on that of their partners and others in the industry.”

In a world where technology consolidation is widespread and growing, businesses engaged in M&A should be especially vigilant about investing in robust security measures, comprehensive insurance policies, cybersecurity expertise and staff training.


Strengthen for the future
Once the acquisition is complete, pressing issues have been fixed and the two cybersecurity infrastructures have been harmonised, the new owner can then begin in earnest to plan for the future.

From a cybersecurity perspective, this means focusing on continuous improvement in their infrastructure. Building a strong cybersecurity system is not just a one-time job that is finished when the owner is satisfied.

In order to truly minimise the risk of cyberattack, companies are required to adapt to emerging threats in an ongoing manner. Cyberattackers are constantly evolving their methods and will not give up, even in the face of a system that seems strong in the here and now.

In order to remain vigilant, owners should ensure that they schedule regular audits and assessments to check for and respond to any cybersecurity vulnerabilities in their existing infrastructure.

They should also seek to stay abreast of any emerging threats that could affect their business. While staying on top of all developments in the world of cybercrime is a big ask, owners can schedule regular consultations and ensure that employees regularly undergo top up training courses to ensure they are as up to date as possible.

These points underline one of the key points of strong cybersecurity: continuous improvement means continuous investment. Whether upgrading systems or training employees, an effective, responsive cybersecurity infrastructure requires considerable expenditure.

However, while the price may be high, the alternative is even more costly.

Share this article

Latest Businesses for Sale

---

---

---

View more businesses for sale