Building Security into Your M&A Process Part 1: Due Diligence

This is the first part of a four-part blog series where I will cover each of these phases of the M&A process and how you can build security into each phase.

If you read the news, you already know that we’re seeing a huge uptick in mergers and acquisitions (M&A). Global M&A volumes hit a record high in 2021—increasing by 64% over the previous year and topping $5 trillion for the first time ever. This activity continues to surge in 2022 as companies use M&A to manage the still-unpredictable economic effects of the COVID-19 pandemic and find their strategic footing. Deals can help them streamline assets, establish or extend digital capabilities, acquire top talent, and otherwise strengthen their competitive positions.

M&As are all about speed and secrecy. Your business development group will start by researching companies—and in the beginning, it’s completely stealth. In fact, the business development group may be the only people who know what specific companies are even being considered. Once that core team identifies a company that fits their plans, they’ll move forward with the formal M&A process—which we’ve defined in four phases. 

Phase One: Due Diligence

The due diligence phase of the M&A process is where information will start being shared between the acquirer (i.e., the buyer) and the target (the company that’s being acquired). 

One of the critical errors that many businesses make to keep things as quiet as possible early on is that they don’t inform their security team that an M&A is being explored. Often a security expert is engaged along with the broader team after the due diligence is done and the letter of intent is signed. But that’s really too late. If I’m that due diligence team, I want to understand the security posture of the target company as early as possible. I need to know what technologies they currently have in place to understand the risk levels and the security team will want to start planning out the day one integration. 

Business development groups should always involve at least one person from the security team among the trusted entities read in early in the transaction process. A security expert will help ensure secure information sharing and they can also help identify some big potential risks before the companies sign a letter of intent. 

Target companies may stop doing investments to boost their profit and loss (P&L) statement—including some things that should have been made for maintaining safe operations. Therefore, a key part of this phase has to be evaluating the target company’s impact on the overall security of the organization. You want to discover all the potential costs and the risks of the transaction in advance. And there may be things that aren’t evident on the surface. A cybersecurity due diligence review should evaluate all aspects of the target’s security—including policies, procedures, account management, regulatory compliance, applications, APIs, and cloud/infrastructure security.

It’s not that different from buying a house. A house inspector helps the buyer understand any repairs that need to be made to keep the house safe, and that information helps with negotiating the final terms of the sale. Or if the inspector discovers problems that are too great a risk (like a cracked foundation), it gives the buyer a chance to move on to another property that’s a better investment.

If I’m working for the acquirer, I’m going to be looking at a target from a security perspective to determine the kinds of investments that will have to be made in order to bring them up to the equivalent of the acquiring company. That will be probably the most quantifiable part of it. The second part, though, is going to be how likely is it that they’ve already had a breach that no one knows about. Early detection of an attack or breach could save the acquirer from unwittingly taking on a material liability that might be both expensive and generate bad press. 

Acquiring companies have suffered hefty losses by discovering a target’s past data breaches only after completing the final deal transactions. This can result in significant fines and reduction in the target company’s overall deal value. You might need to do millions in clawbacks. In one example from a few years ago, Verizon reduced its offer for Yahoo by $350 million after discovering two massive data breaches in Yahoo’s recent past that had not been fully disclosed

Data is also going to start moving back and forth between the two companies during due diligence. The target is going to send financials, and often data will come the other direction from the acquirer as well. Security needs to be able to see these data flows to make sure information sharing is handled properly. 

Stay tuned for Part 2, where I will talk about integration planning and public announcement. For more about how you can fit security into your M&A process, download a copy of the Smoothing Out M&A solution brief.