Cyber Risk Intelligence for Transactions

Cyber exposure now affects valuation, deal structure, representations and warranties, and post-close integration cost. A breach discovered after signing can become an indemnity dispute; one discovered after closing becomes the buyer's problem.

Cyber review usually begins late, inside confirmatory diligence. It relies on a seller-completed questionnaire, a data-room document request, and interviews with the target's IT lead. A specialist firm may be engaged once exclusivity is signed.

• By the time cyber review starts, the deal team has already committed legal, financial, and management time.
• Questionnaires reflect what the seller believes or chooses to disclose, not what is observable.
• Compromised credentials, exposed infrastructure, and prior extortion events are often absent from the data room.
• Across a portfolio, cyber posture is reviewed once at acquisition and rarely measured again.

We assess what is observable from outside the organization before significant diligence resources are committed, then continue measuring it for as long as the asset is held.

Pre-diligence assessments are passive and outside-in. No systems belonging to the target are tested, accessed, or scanned in an intrusive manner without the target's written authorization.

Findings describe observable indicators of risk as of the observation date. They are not an audit opinion or a guarantee of the absence of compromise.

• Per-target assessment, fixed fee.
• Annual portfolio subscription, priced by number of portfolio companies.
• Deal-team panel arrangement: a pre-agreed rate card and turnaround for funds with steady deal flow.

Submit a confidential request. A principal will respond within one business day.