Cyber Diligence Gaps That Surface After the Deal Closes
October is Cybersecurity Awareness Month, and it is a fair moment to look at the part of cyber risk that arrives through a transaction. When you acquire a company, you also acquire its systems, its accounts, and whatever has already gone wrong inside them. The diligence window rarely shows all of it.
Ordinary IT governance asks whether a company keeps baseline security policies. Transaction diligence asks how two technology environments, identity systems, and data stores will behave once they connect. Cyber diligence gaps are not simply a sign of careless dealmakers. They follow from how the process works, and they tend to show themselves after the money has moved. My reading is that the first 90 days after closing is when this tends to happen, because that is when the buyer's own operators first work inside the target's environment. That timing is a judgment about how deals unfold, not a measured figure.
Why the Diligence Window Hides So Much
Start with the constraints on buyers. In a 2021 perspective, Due diligence for Mergers and Acquisitions through a cybersecurity lens, Deloitte lists the obstacles. Sellers often hesitate to share details that could lower the price or derail the sale. In a high-value deal, competing bidders compress the time available. Target organizations may restrict access to the tools that can identify breaches and assess logs, citing confidentiality. A carve-out adds its own problem, because the business being sold may depend on its former parent for security services.
Buyers describe the same pressure. In a Q4 2022 survey of 100 senior executives at European investment banks, law firms, and private equity firms, all recently on the buy side, Mergermarket and Admincontrol found that the largest share said cyber diligence on their latest deal began only in the execution phase. According to Under attack: Cyber due diligence demands more of dealmakers, 24% said that was the case, another 14% said it began only after closing, and the biggest challenge respondents named was accurately vetting the information they received (39% of first-place votes).
A Q4 2025 survey of 150 senior US investment banking executives by SRS Acquiom and Mergermarket points the same way. In 2026 Best Practices in M&A Due Diligence, 84% expected more scrutiny of cybersecurity diligence over the next 12 to 24 months, and 51% called technology diligence the single most burdensome part of a review. Both surveys capture the views of bankers, lawyers, and investors, not measured outcomes, and each came from a commercial research or services firm.
In a 2019 release, Forescout Study Reveals Cybersecurity Concerns on the Rise Amid M&A Activity, Julie Cullivan, then chief technology and people officer at Forescout, a vendor of device visibility and control products, said "you don't just acquire a company, but you also acquire its cybersecurity posture" and added that assessing every asset before signing is nearly impossible, so cyber diligence has to continue through the combining of the two businesses. William Penley, an executive director at Morgan Stanley, makes the point from the buyer's side in Emerging Risk Considerations in Global M&A Transactions, a paper from the insurer Chubb that draws on 2017 deal data. His firm has always done technical, tax, legal, and environmental diligence, he said, and "it is now just as important to conduct cyber due diligence."
Clean Reports Can Still Leave Cyber Diligence Gaps
One documented case shows the mechanism. Marriott International acquired Starwood Hotels and Resorts Worldwide in September 2016. Attackers had compromised Starwood's systems in 2014, and Marriott did not detect the intrusion until September 2018, 2 years after closing. The Information Commissioner's Office (ICO), the UK data protection regulator, set out its findings in Marriott International Inc, Penalty Notice - 30 October 2020 and imposed an £18.4 million penalty. Marriott did not admit liability.
The Marriott International Inc, Penalty Notice - 30 October 2020 records Marriott's account that it could carry out only limited diligence on Starwood's systems and databases during the acquisition. The ICO made no finding about that period and left open whether deeper diligence was possible during a takeover. Its findings covered what happened after the General Data Protection Regulation (GDPR) took effect on 25 May 2018.
What the notice does show is how assurances can mislead. According to the Marriott International Inc, Penalty Notice - 30 October 2020, Marriott relied on assurances from Starwood's management and on reports from independent payment card security assessors stating that multifactor authentication protected the payment card environment. The ICO did not fault that reliance, even though the conclusion was wrong. Those assessments tested the perimeter. They did not test whether anyone would notice an attacker who was already inside.
The Marriott International Inc, Penalty Notice - 30 October 2020 says adequate diligence would have included a review of the monitoring and logging systems. Alerts on the guest database covered only the tables that held payment card data, so the first alert tied to the intrusion since the acquisition fired when the attacker queried a table that carried card details. Marriott estimated that 339 million guest records were affected, and it said some guests may appear in more than one record.
The lesson is narrower than a call for more diligence. A clean report answers the question it was scoped to ask. Cyber diligence gaps form in the distance between that question and the one a buyer needs answered after closing, which is whether the target can see an intruder who already holds a valid login.
What the First 90 Days Expose and What They Miss
After closing, the buyer's operators count devices, review accounts, and map which vendors have access to which systems. That work surfaces what the window missed. Mergermarket's Q4 2022 survey of European buy-side executives, Under attack: Cyber due diligence demands more of dealmakers, found that 52% of respondents saw a major undiscovered or undisclosed cybersecurity risk come to light after closing, while the two businesses were being combined, on the most recent deal they handled.
Connecting the networks is itself a risk. The Chubb authors of Emerging Risk Considerations in Global M&A Transactions argue that a forensic review done during diligence may stop being a credible picture once the deal closes, because combining networks means temporarily removing filters where the two environments meet. Identity is a common weak point. The guide Identity and Access Management: Recommended Best Practices for Administrators, from the Cybersecurity and Infrastructure Security Agency and the National Security Agency, lists accounts of former employees that were never suspended among the techniques bad actors use. It advises administrators to inventory assets and identities, apply least privilege, use phishing-resistant multifactor authentication for privileged users, and watch for unusual traffic that could signal lateral movement. The guide is advisory and not written for deals, but its inventory step applies before any two networks connect.
Privacy rules add another layer. Deloitte notes in Due diligence for Mergers and Acquisitions through a cybersecurity lens that a buyer must identify the cybersecurity and privacy laws that apply to the target, such as GDPR and the California Consumer Privacy Act, and obtain assurance that the target complies.
Marriott shows the other side of that window. Its gap did not surface within 90 days. According to the Marriott International Inc, Penalty Notice - 30 October 2020, Marriott planned to fold parts of the Starwood network into its own over 18 months, and the retirement of the Starwood systems, first planned for the first quarter of 2018, was not completed until December 2018. The ICO was clear that a system due for retirement still has to meet its data protection duties while it runs.
Here operations takes charge. A system that keeps running apart from the buyer's own keeps whatever controls it had at closing until someone decides to change them. Security teams cannot own that interim period alone, because the decisions that lengthen or shorten it, such as which system retires when and what budget funds the move, belong to operations and finance. A buyer who leaves the period unowned has accepted the exposure by default.
Pre-Close Findings Change Price and Terms
Finding a problem is half the job. PwC writes in Understanding cyber due diligence that cyber diligence should reveal deal-breakers, or more likely deal-changers, and that the buyer should quantify those issues and either push the target to fix them before closing or renegotiate the price and possibly other terms. It adds that good diligence should yield a roadmap of critical remediation items along with the responsibility, cost, and timeline for each.
The Verizon and Yahoo deal shows how that works in practice. The companies signed their agreement on 23 July 2016. In Verizon and Yahoo amend terms of definitive agreement, a news release dated 21 February 2017, they cut the price by $350 million and agreed to share certain legal and regulatory liabilities from data breaches Yahoo had incurred. Yahoo took 50% of cash liabilities from non-SEC government investigations and third-party litigation after closing and kept the liabilities from shareholder lawsuits and SEC investigations.
Deborah Golden, cyber and strategic risk leader at Deloitte Risk & Financial Advisory, made the same point in a 2020 release, Deloitte Future of M&A Trends Survey: Dealmaker Optimism Remains High as Alternatives to Traditional M&A Take Center Stage. She said a breach can affect valuation and deal structure, and that leaving cyber out of the risk picture can bring reputational damage and significant remediation costs that nobody had counted.
The lesson is not that every cyber problem should cut a purchase price. Information found while the deal is still open gives a buyer choices on price, protections, and whether to proceed.
Questions That Close the Gap Earlier
Some answers will not arrive before signing. Questions that close cyber diligence gaps test visibility rather than paperwork, and they stay useful after closing.
What does the target actually have, and who can confirm the inventory of devices and accounts is complete?
What did each assessment or attestation cover, and what did its scope leave out?
How would the target detect an intruder who already holds a valid login, and what can it show about incidents it may not have noticed?
Which connections between the two environments should wait until identity systems, privileged accounts, and remote access are checked?
Who owns each known gap after closing, with what budget and by what date?
Deloitte notes in Due diligence for Mergers and Acquisitions through a cybersecurity lens that buyers can write control requirements into the sale and purchase agreement for the high-risk areas diligence identifies, and that the security team should assess risk at each stage of combining the businesses, whether the technology is merged or kept apart.
Regulators are moving the same way. Under Decision and Order, In the Matter of Marriott International, Inc. and Starwood Hotels & Resorts Worldwide, LLC, issued by the Federal Trade Commission on 20 December 2024, Marriott must assess any acquired entity's security program after closing and carry out a plan and timeline for the gaps, with the plan covering the entity's IT assets before they enter production use. The order binds Marriott's own future acquisitions. It is not a rule for every buyer.
What This Evidence Can and Cannot Prove
Marriott is one large, cross-border case. Verizon and Yahoo was a very large public deal. Deal structure also matters. A share purchase, an asset purchase, and a carve-out can allocate liability differently, and jurisdictions assign data protection duties in different ways, so a buyer needs local legal advice on the specific transaction. Chubb sells cyber and deal insurance, Forescout sells security products, Penley and Golden speak as practitioners, and the Deloitte survey covered US dealmakers.
A fair objection is that deeper diligence slows a deal and can cost a buyer the auction. That risk is real. The evidence here does not argue for demanding access a seller will not give. It supports saying openly what the window could not see, pricing that uncertainty, and assigning someone to close it afterward.
Whatever the window could not show now belongs to the buyer. For your next deal, decide who will verify it, by what date, and what the terms say if they find something.
This article offers general information for executives and other leaders. It is not legal, regulatory, or cybersecurity advice. Duties and liabilities vary by jurisdiction and deal structure, so consult qualified advisers on any specific transaction.
When a Deal Touches Every Function at Once
Acquisitions, carve-outs, and rapid growth strain security, systems, people, and cash all at once. Aspirations Consulting Group works with executives and other leaders at these inflection points, helping them bring clarity to decisions that cross functions and the strategy to carry those decisions out. Learn how the firm supports leaders through a transaction or a transition.
Weekday Insight for Leaders Weighing the Next Deal
ACG Strategic Insights reaches more than 10 million executives and other leaders worldwide every weekday, and you can receive it with a complimentary subscription.
Thanks for reading!
~ Jerry Justice
Living to Serve, Serving to Lead™
Comments