Armour Cybersecurity’s CSO Arani Adhikari and CEO David Chernitzky unpack the essentials of cyber due diligence—learn how to assess risk exposure, integrate security cultures, and protect value from signing to close.
Episode Summary
Cybersecurity has moved from a single line item in technology due diligence to a deal-shaping factor in mergers and acquisitions. In this episode of Beyond the Breach, Armour Cybersecurity CEO David Chernitzky and CSO Arani Adhikari draw on years of buy-side and sell-side engagements to explain why cyber due diligence now sits alongside financial and legal review in every serious transaction. They walk through the full M&A lifecycle, from silent pre-deal research to post-merger integration, and share real cases where skipping the cyber review turned a nine-figure acquisition into a write-off.
Why Cybersecurity Belongs in Every M&A Deal
Traditional due diligence asked three questions: are the books clean, who are the people, and what technology and clients come with the deal. Cyber risk was an afterthought. That changed as acquirers began inheriting breaches. A recurring pattern the Armour team has handled first-hand: attackers gain a quiet foothold in a smaller company and wait. When an acquisition is announced, they know the buyer will soon tighten controls and close their window, so they detonate ransomware within weeks of closing. The buyer discovers it purchased a liability, not an asset.
The financial stakes are concrete. IBM’s research puts the average cost of a breach for a US organization at roughly $4.5 million, and the episode covers a 150-year-old UK business whose value went to zero within three months of a ransomware attack because it simply could not recover operations.
The M&A Lifecycle Through a Cyber Lens
Silent due diligence (pre-deal). Before committing to a costly formal review, buyers can run non-intrusive checks: dark web exposure scans, leaked credential searches, third-party vendor risk, and external posture assessment. If a company’s core intellectual property is already for sale on the dark web, the IP premium in the asking price evaporates. This stage filters which targets are worth a full diligence spend.
Formal cyber due diligence. Once a letter of intent is in place, specialists evaluate the target 360 degrees: governance, processes, people capacity, controls, and technology. The two questions that matter most: can this business keep operating if attacked, and can it protect its revenue? Compromise assessment goes a level deeper, placing sensors in the environment to detect attackers already inside before the deal closes.
Negotiation leverage. Gaps found in diligence translate directly into deal terms. Remediation costs can be priced into the offer, and buyers can require specific fixes as closing conditions so day one does not start with an active threat inside the fence.
Post-merger integration. Whether the target stays a separate entity or gets absorbed, security cultures must be merged deliberately. The episode’s cautionary example: acquired teams still running shared local-admin accounts on legacy Windows 7 machines, connected straight into the parent company’s network. Without top-down standardization, an acquisition becomes a backdoor.
Portfolio monitoring and sell-side preparation. Private equity firms and family offices increasingly monitor cyber risk across their whole portfolio between purchase and exit. On the sell side, preparation pays: one Armour client began tightening controls eighteen months before going to market, passed two buyer due diligence reviews with zero cyber findings, and used that record as a competitive differentiator against other sellers.
Key Takeaways
- Cyber due diligence determines whether you are buying an asset or a liability, and it belongs at the start of the deal process, not the end.
- Attackers time ransomware deployment around acquisition announcements, when their access window is about to close.
- Dark web and external posture checks before formal diligence can disqualify bad targets cheaply.
- Compromise findings rarely kill a deal; they reprice it and set remediation conditions.
- Standardized security templates across a portfolio turn hard lessons into repeatable protection.
- Sell-side security preparation is a value maximizer and a competitive advantage, not just a cost.
Who This Episode Is For
Private equity firms, family offices, investment banks, corporate development teams, and business owners preparing for a sale. Armour Cybersecurity supports buy-side diligence, sell-side readiness, compromise assessments, and continuous portfolio risk monitoring for clients globally.
Have a topic you want covered on a future episode? Drop your ideas in the comments on our channel.
