Acquisition & investment
Pre-deal assessment of a target's cyber maturity, incidents, liabilities and remediation costs.
Services · Assurance, Reviews & Due Diligence
Security Due Diligence
Understand the cyber risk you are buying, funding or depending on.
Arrange a meetingWhy it matters
Financial-sector acquisitions, investments and critical supplier relationships bring cyber and regulatory risk with them. Questionnaires alone rarely reveal it. We carry out structured, evidence-based due diligence that focuses on the issues most likely to affect value, regulatory exposure and operational resilience.
Questions this engagement answers
- 01Has the target or supplier suffered incidents it has not disclosed?
- 02Are its security claims supported by evidence?
- 03What would it cost to bring its security up to our standard?
- 04What contractual protections do we need before we sign?
What the engagement can include
Supplier due diligence
Operational due diligence on security and technology providers, using a structured framework.
Evidence review
Testing claims against policies, certifications, test results, insurance and incident history.
Post-deal planning
Integration priorities and a remediation plan for the first months after completion.
How we work
- 1
Frame
Agree the decision being made, timescales and the risks that matter most to it.
- 2
Request
Issue a focused information request and questionnaire built on our due diligence framework.
- 3
Verify
Review evidence and hold discussions with the target or supplier's leadership.
- 4
Advise
Report findings in time to influence price, terms or the decision itself.
What you receive
- Due diligence report with clear risk ratings
- Red flags and issues for negotiation or contract terms
- Estimated remediation priorities
- Recommendations for ongoing oversight
Illustrative scenario
A confident questionnaire, a thin evidence file
A managed security provider answers every questionnaire item positively. When asked for evidence, it cannot provide recent recovery test results, and its cyber insurance excludes subcontractor failures that its service depends on. These findings lead to specific contract commitments before appointment, rather than surprises after.
Buck's view
“Due diligence should change decisions. If the findings cannot influence the price, the terms or the choice of partner, the work has been done too late.”
Professor Buck Rogers, Poro Advisory