Private equity · Strategic buyers · Business owners
M&A Cyber & Regulatory Due Diligence
Cyber diligence for buyers. Readiness for sellers.
Identify cyber risk, assess remediation priorities and prepare evidence for your transaction decisions.
Evidence for your decision
A technical finding should lead to a transaction decision.
Unfunded remediation, unsupported systems, weak access controls or unclear data obligations can challenge the assumptions behind a deal. We connect the evidence to potential business consequences so buyers can examine their investment assumptions and sellers can prepare substantiated responses to diligence questions.
Our work supports valuation discussions, diligence follow-up and investment planning. We distinguish substantiated findings from management representations, missing evidence and issues requiring specialist or legal review.
For buyers and sellers
Different roles. A focused scope for each.
For buyers / Buy-side diligence
Know what you may inherit.
Examine the target's security posture, available incident history, critical dependencies and evidence supporting its control claims. Identify security-related technical debt and unresolved obligations before close.
For your investment decision: examine acquisition assumptions, identify remediation cost drivers and prioritize integration work. Findings give your team and counsel a basis for discussing deal protections and closing requirements.
For sellers / Sell-side readiness
Prepare before the buyer asks.
Identify weaknesses before the sale process, prioritize corrective work and organize evidence for buyer diligence. Help management substantiate security claims, explain remaining risks and show the work already completed.
For your sale preparation: a clearer diligence response, an organized evidence index and a documented remediation record that helps reduce uncertainty during review.
Continuing through ownership
Turn diligence into progress.
Portfolio support
Act after close. Prepare for a future exit.
Translate findings into a prioritized first-100-days plan, with accountable owners, dependencies and closure evidence. Review integration risks and track agreed controls across portfolio companies.
For operating partners and portfolio leadership: investment priorities, progress reporting and a record of improvements that supports preparation for a future sale.
What you receive
Deliverables matched to your role in the deal.
We agree the audience, depth, access and delivery milestones around your transaction timetable. Buyer reviews support the investment committee; seller reviews support management and its deal advisers. Each conclusion identifies the evidence reviewed and the limits of the work.
- Transaction decision brief
- For buyers: material findings, investment implications and unresolved questions for the investment committee. For sellers: readiness gaps, evidence priorities and issues to address before buyer diligence.
- Cyber and technical debt register
- Documented exposures, affected assets, evidence quality, remediation priorities and dependencies.
- Remediation investment view
- Cost drivers and indicative effort or budget ranges where evidence supports them, with assumptions and items requiring vendor validation. These inform planning; they are not vendor quotations or a valuation opinion.
- Ownership or exit action plan
- Sequenced actions, proposed owners and completion criteria, with a first-100-days roadmap or sell-side evidence index matched to the engagement.
What we examine
Focus on the exposure that matters to the deal.
Security posture & resilience
Identity and privileged access, vulnerability management, recovery evidence, incident readiness and material service-provider dependencies.
Security-related technical debt
Unsupported platforms, deferred security work, manual controls and inherited configurations that may require investment or complicate integration.
Regulatory & contractual readiness
Evidence supporting the target’s stated obligations, customer commitments and security claims. We coordinate with counsel on applicability, interpretations and legal consequences.
Governance & control evidence
Accountability, risk decisions, prior findings and assurance reports. Where agreed, selected control tests examine whether documented procedures operate in practice.
Angel Montilla, Founder & Managing Director, leads the scope, technical review and discussion of findings. His background includes Big Four experience at KPMG and risk and control work at BNY, including BNY Pershing.
- CRISC
- CISM
- ISO/IEC 27001 Lead Auditor
That background informs an evidence-led approach to risk assessment, security governance and control review. The engagement connects technical findings to the decisions facing your investment and operating teams.
Before we begin
Can you work within a transaction deadline?
We agree scope and milestones against the deal timetable and the evidence available. A focused red-flag review can precede deeper work. Access constraints, unanswered questions and items carried beyond close remain explicit in the deliverable.
How does regulatory due diligence fit with legal counsel?
We assess technical controls and evidence relevant to the requirements identified for the engagement. Counsel determines legal applicability and advises on deal terms. We do not provide a legal opinion or certify regulatory compliance.
Does the review cover all technology diligence?
The core scope covers cyber risk and security-related technical debt. Product architecture, source-code quality, intellectual property, financial diligence and full forensic investigations require separately agreed specialist work. Any technical testing requires appropriate authorization.
Can the findings support valuation and negotiations?
Findings can inform assumptions about remediation investment, operating exposure and integration priorities. Your investment team, financial advisers and counsel decide how those findings affect valuation and terms. A review cannot guarantee a purchase price, successful exit or absence of undiscovered issues.
What should we share in the first conversation?
Whether you are buying, preparing to sell or managing a portfolio company, along with the sector, expected timetable and decision you need to support. We agree confidentiality and secure information-sharing arrangements before requesting sensitive deal materials or access to a data room.
A clearer basis for the next decision
Define the priorities for your transaction.
Discuss your acquisition, sale preparation or portfolio priorities.
Discuss a transaction →
