Topic starter
18/08/2026 2:34 pm
TL;DR: M&A activity rose sharply in 2025, with deal value up 40% and volume up 7%, while 40% of acquirers found major cybersecurity issues during post-acquisition integration and fewer than 10% of deals included cyber due diligence, according to Ground Labs and IMAA. Data discovery has become a control for valuation, liability, and integration risk, not just a compliance exercise.
Editorial analysis by NHI Mgmt Group, based on content published by Ground Labs: “Ensuring data security in mergers and acquisitions (M&A)”.
By the numbers:
- 40% of acquirers discovered major cybersecurity issues during post-acquisition integration, according to Ground Labs.
- Less than 10% of deals incorporated cyber due diligence during the M&A process, according to Ground Labs.
- 2025 saw a surge in deals that increased in both value by 40% and volume by 7%, according to Ground Labs.
Key questions
Q: What breaks when data discovery is not in place during M&A due diligence?
A: When discovery is missing, the buyer cannot see what sensitive data, legacy systems or inherited access paths it is acquiring.
Q: Why does hidden data increase regulatory and liability risk after an acquisition?
A: Hidden data makes it impossible to judge whether the target is carrying personal, regulated or contractually sensitive information that triggers CCPA, GDPR or PCI DSS obligations.
Q: What are the signs that M&A data governance is failing?
A: Warning signs include unclear data inventories, no documented access map for sensitive datasets, heavy reliance on manual discovery and late-stage security findings during integration.
Practitioner guidance
- Inventory sensitive data before signing Map regulated, personal and business-critical data across on-premises and cloud systems before the transaction terms are finalised.
- Tie data stores to access paths Document which human and non-human identities, integrations and service accounts can reach each sensitive dataset.
- Use discovery outputs in diligence decisions Translate discovery findings into deal terms, remediation priorities and estimates for post-close integration cost and regulatory exposure.
Bottom line: M&A creates a visibility problem as much as a valuation problem, because unknown data and undocumented access can survive the deal and inflate liability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:20 pm
Data discovery is now a valuation control, not a housekeeping task: M&A teams are no longer just buying a business, they are buying its data exposure profile. If sensitive data, regulated records and legacy access cannot be located quickly, the buyer is pricing blind and the seller is negotiating without evidence. Practitioners should treat discovery results as deal inputs, not post-close cleanup artefacts.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Business leaders plan to spend $124 million on average on AI in 2026, and 91% say data security and risk will shape their AI strategy.
A question worth separating out:
Q: How should buyers and sellers divide responsibility for pre-close data hygiene?
A: Sellers should remove redundant data, surface sensitive records and show where exposure exists before diligence accelerates. Buyers should validate those claims, test for regulatory exposure and tie any unresolved risk to price, remediation commitments or deal conditions.
👉 Read our full editorial: Data discovery is now a deal-risk control in M&A integration