Cybersecurity Due Diligence
M&A Cyber Due Diligence for Private Equity, Acquirers and Lenders
Verizon cut $350 million from the Yahoo price after Yahoo's data breaches came to light. We find the breaches, the gaps and the cost to fix them before you sign, at a fixed fee from $45,000.
Scope My Cyber Due DiligenceBring us in before the LOI. After close, we source the fixes at no cost to the company: the provider it chooses pays us.
Cybersecurity due diligence is the review of a target company's breach history, security controls, compliance status and remediation cost before an acquisition, investment or loan closes. It matters because the risk transfers with the deal: Verizon cut the price of Yahoo's operating business by $350 million after Yahoo's data breaches came to light (Yahoo and Verizon joint release, February 2017), and Marriott was fined £18.4 million by the UK regulator over a breach that began in Starwood's systems two years before Marriott bought it (Mayer Brown). A cyber due diligence assessment tells you three things in deal terms: whether the target has already been compromised, what it will cost to bring its security to the standard you need, and how those findings belong in the price, the escrow, the indemnities and the 100-day plan. Metro Colo Advisory runs it for private equity firms, corporate acquirers, lenders and portfolio company boards at a fixed fee from $45,000, alongside our data center due diligence and data center consulting practices. After close, we source the remediation through our managed security services practice, and the provider the company chooses pays us.
Sources: managed SOC band at 200 to 1,000 assets, Vendr; MDR list prices $8.99 per endpoint a month (Unio pricing index) to $175,000 per 500 assets (AWS Marketplace), MCA calculation x 1,000; DSPM contract range, Vendr; SASE $7.21 to $15.57 per user a month, TeleGeography, MCA calculation x 12 x 1,000; CMMC Level 2 certification $117,768 for other than small businesses, DoD estimate in the CMMC final rule; penetration testing $15,000 to $75,000 per engagement, Vendr. In-house seat: MCA calculation, 8,736 hours / 1,776 productive hours = 4.92 analysts x $129,180 BLS median pay x 1.46 benefits ratio. Figures as of October 2026. Free to cite with a link to this page.
Send the target's sector, headcount, number of sites, deal stage and the date you need findings. We read it and come back with what the assessment should cover, what can be done outside-in before you have access, and the fixed fee in writing. You'll hear back within 24 hours.
Why Cybersecurity Due Diligence Matters in M&A
A buyer inherits the target's attackers along with its systems. The cases below are public, and each one turned on something that a cyber due diligence assessment looks for.
| Deal or rule | What happened | What it cost or requires |
|---|---|---|
| Verizon and Yahoo2016 to 2017 | Yahoo disclosed major data breaches while the sale of its operating business to Verizon was pending | Price cut by $350 million to about $4.48 billion; Yahoo kept 50 percent of certain post-close breach liabilities and all shareholder suit and SEC liabilities (joint release) |
| Yahoo and the SEC2018 | Yahoo's security team learned of a December 2014 intrusion within days; it was first disclosed in 2016, while the Verizon sale was closing | $35 million SEC penalty for misleading investors (SEC) |
| Marriott and Starwood, UKacquired 2016, fined 2020 | A 2014 attack on Starwood's systems ran on after the acquisition, affecting up to 339 million guests; Marriott said it could carry out only limited due diligence on Starwood's systems | £18.4 million fine, reduced from a proposed £99.2 million; the regulator said due diligence "is not a time-limited or a one-off requirement" (Mayer Brown) |
| Marriott and Starwood, US2024 | The FTC cited three breaches from 2014 to 2020 affecting more than 344 million customers; after the 2016 acquisition, Marriott became responsible for both brands' security | $52 million to 49 states and the District of Columbia, and a security program certified to the FTC annually for 20 years (FTC) |
| SEC cyber disclosure rulesadopted July 2023 | Public companies must disclose material cybersecurity incidents on Form 8-K Item 1.05 and describe their cyber risk management annually | The 8-K is generally due four business days after the company determines an incident is material (SEC) |
Cybersecurity Due Diligence Checklist
These are the ten areas a cyber due diligence assessment covers, what we check in each, and the finding that usually changes the deal. The same list works as a cybersecurity due diligence checklist for your own data room request.
| Area | What we check | The finding that changes the deal |
|---|---|---|
| 1. Breach history | Incident log, notifications, regulator and insurer correspondence, leaked credentials and data on criminal markets | An incident that was never investigated, or one that is still open |
| 2. External attack surface | Internet-facing systems, exposed remote access, unpatched known vulnerabilities, forgotten domains and cloud assets | Exploitable services on the internet today; exploited vulnerabilities were the way in for 31 percent of breaches (Verizon 2026 DBIR) |
| 3. Identity and MFA | MFA on email, remote access and admin accounts; privileged account count; offboarding; service accounts | Remote access or admin accounts without MFA |
| 4. Endpoint coverage, EDR and MDR | Share of laptops and servers with EDR installed and reporting; who watches the alerts at night | Coverage gaps, or alerts nobody reviews outside business hours (see MDR vs EDR) |
| 5. Backups and ransomware readiness | Immutable or offline copies, restore tests with dates, recovery time for the systems that bill customers | Backups reachable from the main network, or no restore test on record; ransomware was in 48 percent of breaches (Verizon 2026 DBIR) |
| 6. Third-party risk | IT providers with remote access, key software suppliers, data processors, contract security terms | An outsourced IT provider with standing admin access and no oversight; third parties were involved in 48 percent of breaches (Verizon 2026 DBIR) |
| 7. Sensitive data | Where customer, patient, payment and controlled data sits, including cloud storage and SaaS | Regulated data in places nobody can list (see DSPM) |
| 8. Compliance status | CMMC and NIST 800-171 for defense work, HIPAA, PCI DSS, SOC 2, state privacy law, SEC disclosure readiness for a public acquirer | Revenue that depends on a certification the target does not hold (see CMMC enclave) |
| 9. Cyber insurance | Limits, retentions, exclusions, prior acts coverage, the security answers on the last application | Application answers the controls do not support, which can put a claim at risk |
| 10. Tech debt and remediation cost | End-of-life systems, unsupported software, current security spend, staffing | A run-rate security budget well below what the gaps cost to close |
Cyber due diligence vs IT due diligence
IT due diligence asks whether the target's systems can run and scale the business: infrastructure, applications, licenses, integration cost and the IT team. Cyber due diligence asks whether those systems are already compromised and what it costs to defend them. The two overlap on tech debt and integration, and we run them together when the deal calls for it, with infrastructure questions handled by our IT infrastructure consulting practice and data center assets covered by data center due diligence.
Outside-In vs Full Cyber Due Diligence Assessment
A cyber risk assessment for an acquisition comes in two depths. Which one fits depends on how much access the seller will give you and how far along the deal is.
Where Cyber Due Diligence Fits in the Deal Timeline
Screening, pre-LOI
Outside-in assessment. Tells you whether cyber belongs in the bid, before you have access or exclusivity.
LOI and exclusivity
Full confirmatory assessment: data room requests, interviews with the IT and security leads, control testing, compromise check.
Purchase agreement
Findings become price, escrow, specific indemnities, cyber reps and the conditions your insurer will accept.
Signing to close
Interim covenants and pre-close fixes, such as MFA on remote access. Keep the target's network separate until it is verified clean.
First 100 days
The remediation plan is bought and run: MDR or SOC live, network and data controls in place, a penetration test to confirm.
The first three stages set what the fixes cost the seller instead of you. After signing, every gap the assessment missed is paid for out of the hold period. Source: deal stages as commonly structured; disclosure timing from the SEC. Free to cite with a link to this page.
How Findings Turn Into Price Adjustments, Escrows and Indemnities
A cyber finding is only useful to a deal team if it arrives as a number and a mechanism. This is how each type of finding usually lands in the agreement.
| Finding | Usual deal mechanism | Why |
|---|---|---|
| Known breach or active compromise | Specific indemnity, escrow or holdback, and sometimes a closing condition | Representations and warranties insurance covers unknown breaches of the reps, not issues found in diligence (McGriff) |
| Missing controls with a known costno MDR, no MFA, no tested backups | Price adjustment, or a seller covenant to fix before close | The remediation cost is a recurring expense the target's numbers do not carry yet |
| Compliance gap tied to revenueCMMC, HIPAA, PCI DSS | Specific indemnity, closing condition, or a valuation haircut on the revenue at risk | A defense contractor without the required CMMC level cannot win the contracts that need it |
| Areas that could not be assessed | Special cyber representation, broader escrow, conditional insurance exclusions | Insurers may hold conditional exclusions until outstanding diligence materials arrive (McGriff) |
| Thin or mismatched cyber insurance | Require prior acts coverage or a tail at close | The cyber policy may sit primary, with the R&W policy excess of it (McGriff) |
| Public acquirer, weak incident process | 100-day plan item: incident response and materiality process | The acquirer has four business days to file once it finds an incident material (SEC) |
That is when cyber findings can still change the price and the terms. Send the target and the timeline, and we will scope an assessment that fits inside your exclusivity window, at a fixed fee agreed in writing first.
Remediation Cost Estimating
Remediation cost is the number that moves a price, so we build it from published ranges, not guesses. Here is how the common fixes price at two target sizes. Each line has its own pricing page with more detail.
| Fix | 500-employee target | 1,000-employee target |
|---|---|---|
| 24/7 monitoring and responsemanaged SOC or MSSP | $150,000 to $300,000 a year | $150,000 to $500,000 a year |
| Endpoint detection and responseMDR, list prices | $53,940 to $175,000 a year | $107,880 to $350,000 a year |
| Zero trust access and network securitySASE, per user | $43,260 to $93,420 a year | $86,520 to $186,840 a year |
| Sensitive data discoveryDSPM, one platform's contract range | $76,550 to $214,100 a year | $76,550 to $214,100 a year |
| Penetration test and retestpenetration testing cost | $15,000 to $75,000 per engagement | $15,000 to $75,000 per engagement |
| CMMC Level 2 certificationassessment only, before implementation | $117,768 per three-year cycle | $117,768 per three-year cycle |
| Firewalls, backup and recoverymanaged firewall, backup, DRaaS | Quote-based | Quote-based |
Sources: managed SOC bands at 500 endpoints and 200 to 1,000 assets, Vendr. MDR: $8.99 per endpoint a month (Unio) x 12 = $107.88 x 500 = $53,940, x 1,000 = $107,880; $175,000 for 500 assets (AWS Marketplace), $350 per asset x 1,000 = $350,000. SASE: $7.21 and $15.57 per user a month (TeleGeography) x 12 = $86.52 and $186.84 x 500 or 1,000 users. DSPM: Vendr, not size-specific. Penetration testing: Vendr. CMMC: DoD estimate for other than small businesses, CMMC final rule. Figures labeled MCA calculation are multiplied out from these sources.
Cyber Diligence That Speaks in Deal Terms
Most cyber assessments arrive as a technical report the deal team has to translate. Ours arrives as numbers and mechanisms for the purchase agreement, and it continues after close if you want it to.
A fixed fee, then no cost
The diligence is a fixed fee from $45,000, paid by you and agreed in writing first. Remediation sourcing after close costs the company nothing: the provider it chooses pays us.
One assessment, the whole picture
Breach history, controls, compliance, insurance and remediation cost in one written deliverable, instead of separate reports from each workstream.
Price leverage
Every gap is priced from the published ranges on this page, from $15,000 for a penetration test to $500,000 a year for 24/7 monitoring, so it becomes a number in the price negotiation.
Independence
We sell no security product and are not tied to any vendor. If the target is clean, or cyber diligence is not worth it on this deal, we will say so.
Timing
Findings move the price only before signing, so bring us in before the LOI. After close, send the remediation requirement to us before the company asks providers for pricing; once it asks one directly, that provider will not register an advisor.
After Close: Remediation Sourced at No Cost to the Company
The 100-day plan is where the assessment's findings get bought. We take the remediation requirement to the providers that fit, negotiate the rate, the term and the service levels, and the provider the company chooses pays us, so it costs the company nothing. This is a separate placement engagement from the diligence, disclosed in writing; the company is free to buy anywhere. Each service has its own pricing page.
24/7 monitoring
Managed SOC or MSSP coverage for a target with no one watching at night.
SOC as a serviceEndpoint detection and response
MDR across every laptop and server, with response included.
MDR pricingPenetration testing
A test after the fixes, to confirm they worked and to give the board evidence.
Penetration testing costCMMC and controlled data
A CUI enclave or a full GCC High move for a defense contractor target.
CMMC enclaveSend the findings or the requirement before the company asks any provider for pricing. We take it to the providers that fit and negotiate the terms. The provider you choose pays us, so it costs you nothing. You'll hear back within 24 hours.
Cybersecurity Due Diligence for Private Equity, Acquirers and Lenders
Private equity firms
Cyber findings priced into the bid, and the same remediation plan run across the portfolio after close, so every company is held to one standard.
Corporate acquirers
Whether the target is safe to connect to your network, what integration costs, and what your own disclosure obligations will be if something is found later.
Lenders and credit funds
Cyber as a credit risk: a ransomware event can stop billing. We test the borrower's recovery against the covenant package. See also data center financing.
Portfolio company boards
An independent read on where the company stands, what is fixed and what is not, for directors who need more than the IT team's own report.
Where the target owns or leases data centers, we run the facility side too: power, leases and valuation through data center due diligence and data center valuation. Targets in regulated sectors often bring hosting obligations with them; see compliance colocation, HIPAA colocation and financial services colocation.
From $45,000. Every engagement is scoped to the target and the deal stage, so the fee is set once we know what the work needs to answer.
Six Mistakes in Cyber Due Diligence
Relying on the seller's questionnaire
A yes to "Do you have MFA?" is not evidence. Ask for the report that shows which accounts have it.
Starting cyber work after the price is agreed
Findings that arrive after signing can only be paid for, not negotiated. The outside-in read costs least and is worth most before the LOI.
Treating R&W insurance as cover for cyber
The policy covers unknown breaches of the reps. Anything diligence found, or should have found, needs its own indemnity or escrow.
Connecting the networks on day one
Joining an unverified target to your network gives any attacker already inside it a path into yours. Verify, then connect.
Reporting risk without a cost
A list of high, medium and low findings gives the deal team nothing to negotiate with. Each one needs a remediation cost and a deal mechanism.
Stopping at close
The UK regulator said due diligence is not a one-off requirement. The 100-day plan, and the test that confirms it worked, finish the job.
What This Page Cannot Tell You
Whether your target is already compromised
That takes the target's logs and endpoint data, read by someone looking for an attacker.
What your target's gaps cost to close
The ranges on this page become one number only with the target's headcount, endpoints, sites and current tools.
How the findings should land in your agreement
That depends on the deal structure, your insurer's position and what the seller will accept.
Whether cyber diligence is worth it on this deal
Sometimes an outside-in read is enough. Sometimes it is not worth doing at all, and we will say so.
In writing, at a fixed fee agreed before work starts, from $45,000. We sell no security product, and no provider pays us on a diligence assignment.
Frequently Asked Questions
What is cybersecurity due diligence?
Cybersecurity due diligence is the review of a target company's breach history, security controls, compliance status and remediation cost before an acquisition, investment or loan closes. It tells the buyer whether the target has been compromised, what it costs to fix the gaps, and how those findings belong in the price and the purchase agreement.
What does a cybersecurity due diligence checklist include?
Ten areas: breach history, external attack surface, identity and MFA, endpoint coverage and MDR, backups and ransomware readiness, third-party risk, sensitive data, compliance status such as CMMC, HIPAA and PCI DSS, cyber insurance, and tech debt with the cost to remediate it.
What is M&A cybersecurity due diligence?
It is cyber due diligence run as part of a merger or acquisition, timed to the deal: an outside-in read before the letter of intent, a full confirmatory assessment during exclusivity, and findings turned into price adjustments, escrows, specific indemnities and a 100-day plan before signing.
How much does cybersecurity due diligence cost?
Metro Colo Advisory runs cyber due diligence at a fixed fee from $45,000, agreed in writing before work starts and scoped to the target and the deal stage. No provider pays us on a diligence assignment.
What is the difference between an outside-in and a full cyber assessment?
An outside-in assessment uses only public data, such as internet-facing systems, known vulnerabilities and leaked credentials, and needs no access to the target. A full assessment tests controls against evidence from the data room and interviews, and can include a check for an attacker already inside the network.
When should cyber due diligence start in a deal?
Before the letter of intent, with an outside-in read, then a full assessment during exclusivity. Findings can change the price and terms only before signing; after that they are paid for out of the hold period.
What is the difference between cyber due diligence and IT due diligence?
IT due diligence asks whether the target's systems can run and scale the business, including infrastructure, applications, licenses and integration cost. Cyber due diligence asks whether those systems are compromised and what it costs to defend them. The two overlap on tech debt and integration.
How do cyber findings affect the purchase price?
Missing controls with a known cost usually become a price adjustment or a seller covenant, because the fix is a recurring expense the target's numbers do not carry. Known breaches usually become a specific indemnity or escrow, because representations and warranties insurance covers unknown breaches, not issues found in diligence.
Does representations and warranties insurance cover cyber risk?
It covers unknown breaches of the cyber representations, not issues found in diligence. If diligence turns up red flags, insurers can exclude cyber loss, apply lower sublimits or higher retentions, or require separate cyber coverage as a condition.
What happened with Marriott and Starwood?
An attack on Starwood's systems began in 2014. Marriott acquired Starwood in 2016 and uncovered the breach in 2018. The UK regulator fined Marriott 18.4 million pounds in 2020, and in 2024 Marriott agreed to pay 52 million dollars to 49 states and the District of Columbia and to run an FTC-certified security program for 20 years.
How did the Yahoo breaches affect the Verizon deal?
Verizon and Yahoo cut the price of Yahoo's operating business by 350 million dollars, to about 4.48 billion dollars, and Yahoo kept 50 percent of certain post-close breach liabilities and all liabilities from shareholder suits and SEC investigations. The SEC later fined Yahoo's successor 35 million dollars for failing to disclose the breach.
Who pays for remediation sourcing after close?
The provider the company chooses pays us, so it costs the company nothing. It is a separate placement engagement from the diligence, disclosed in writing, and the company is free to buy remediation anywhere.
Scope Cyber Due Diligence Before You Sign
If you are looking at a target, in exclusivity, lending against a company or sitting on a portfolio company board, send the target's sector, size and deal stage. We will set out what the assessment should cover and the fixed fee, and if it isn't a fit, we will say so. You'll hear back within 24 hours.
Know all three before the purchase agreement is signed, and put each one where it belongs.
Deals and diligence: data center due diligence, data center valuation, data center financing and data center consulting.
Post-close security: managed security services, MDR, SOC as a service, DSPM and penetration testing cost.
Compliance and infrastructure: CMMC enclave, GCC High, IT infrastructure consulting and cloud repatriation.
