Mergers and Acquisitions Cyber Risk Executive Briefing: What Boards Should Ask Before and After a Deal

When a company buys another company it also buys every attacker already inside that company's network, every unrotated credential and every security debt the seller chose not to mention. This briefing is for board members, deal committees, chief executives and chief financial officers who approve acquisitions and want to know what cyber risk does to value, liability and integration. It explains how cyber findings move price and deal terms, why inherited breaches are the most expensive surprise, and why the months after closing carry as much risk as the diligence itself. It ends with the questions to put to management, the red flags in their answers, metrics and a 90-day plan. The practitioner method (outside-in assessment, document requests, interview questions, day one controls) is in the Cyber Due Diligence in Mergers and Acquisitions Guide; this page stays at board level.

The risk in one paragraph

An acquisition transfers the target's security history to the buyer on the day the deal closes. If the target was breached before the deal and nobody found it, the buyer inherits the incident, the regulatory exposure and the customer harm, and usually discovers it only after connecting the two networks. Marriott is the reference case: according to the US Federal Trade Commission, attackers were inside Starwood's network from around July 2014, Marriott acquired Starwood in 2016, and the intrusion that reached 339 million guest records was not detected until September 2018. Marriott then carried the consequences: a 20-year FTC order and a separate $52 million settlement with 49 states and the District of Columbia. The board question is therefore not "did the target pass a questionnaire?" but "what would it cost us if the target is already compromised, and how quickly would we find out?"

Why this is a board-level issue now

• Disclosure clocks run from the buyer's determination. Under the US SEC rules adopted in 2023, a listed company must file a Form 8-K under Item 1.05 generally within four business days of determining that a cybersecurity incident is material. An incident found in an acquired subsidiary is the parent's incident once it is material to the parent. See the SEC Cyber Disclosure Executive Briefing.
• Boards must describe their oversight. Regulation S-K Item 106 requires the annual report to describe the board's oversight of cybersecurity risk and management's role and expertise. A material acquisition with no cyber diligence is hard to square with that description.
• Silence during a deal has been punished. The SEC fined Altaba, formerly Yahoo, $35 million in 2018 for failing to disclose a breach of hundreds of millions of user accounts that its security team had learned about within days in December 2014. The breach became public in 2016 while the Verizon acquisition was closing.
• Directors are expected to own cyber governance. The UK Cyber Governance Code of Practice (DSIT with the NCSC, April 2025) asks boards to own cyber risk, agree risk appetite, receive formal reporting at least quarterly and make sure cyber is integrated with audit and assurance. A transaction changes risk appetite overnight.
• Integration is when attackers move. Connecting directories, extending trusts, opening network paths and granting migration accounts broad rights creates exactly the access an intruder in either company wants.

How cyber risk changes deal value

Cyber findings affect the deal in four ways. Boards should expect management to show which of them applies to each material finding, rather than a single red, amber or green rating.

The Cyber Risk Quantification Guide explains how to express findings as a loss range that a deal team can use. Many cyber policies contain change of control terms, so do not assume the target's cover continues after closing; ask the broker before signing. See the Cyber Insurance Executive Briefing.

Inherited breaches: the risk diligence rarely finds

Standard diligence relies on documents, questionnaires and interviews. They tell you what the target knows about itself. They do not tell you whether an attacker is present today. Three practical points follow for boards.

• Ask for evidence of absence, not a statement. A compromise assessment (threat hunting across endpoints, identity logs and cloud audit logs by an independent team) before closing, or as a condition of integration, is the only way to look for an intruder who has not yet acted.
• Look outside in before you have access. Exposed services, leaked credentials, known vulnerable edge devices and past breach disclosures can be reviewed without the target's cooperation and are often the first sign of trouble.
• Machine credentials are the long tail. Service accounts, API keys, OAuth grants to third parties and certificates often survive every staff change and are rarely in the target's inventory. They are how an old intrusion stays alive. See the Identity Integration in M&A Guide.

Integration risk: the first 100 days

The safest default is to treat the acquired company as an untrusted third party until it has met a minimum security baseline. That means no domain trust, no flat network connection and no shared administrator accounts on day one. Access between the two companies should run through a controlled path, for example application-level access through an identity provider or a zero trust access broker, rather than a site-to-site VPN that exposes both networks to each other.

Five questions for the board to ask

1. What did we find, and what did it change? Ask for the material cyber findings and, for each one, whether it moved price, terms, integration timing or nothing. A diligence that changed nothing either found nothing or was not used.
2. How do we know the target is not already compromised? Ask whether a compromise assessment was done or is a condition of integration, who did it, and what it covered (endpoints, identity, cloud, email).
3. What are we inheriting that we must report? Ask which regulators, contracts and disclosure regimes apply to the target, whether any incidents were reported or should have been, and how a newly found incident would be judged for materiality at group level.
4. What is the integration security baseline and who signs it off? Ask for the minimum controls (phishing-resistant MFA for administrators, endpoint detection, logging into our monitoring, privileged account inventory) that must be met before any network or directory connection, and who has authority to delay integration.
5. What protects us if something surfaces after closing? Ask how long the breach warranties and indemnities run, what escrow or holdback exists, and whether insurance cover transfers or must be replaced.

Red flags in management answers

• "Cyber was covered in the questionnaire." A questionnaire is self-reported. It is a starting point, not assurance.
• "We will connect the networks on day one to realise synergies." This trades a schedule target for the buyer's whole attack surface.
• "The seller would not let us see that." Refusal to share penetration test reports, incident logs or a privileged account list is information in itself.
• "There have been no incidents." Every organisation of size has incidents. No record usually means no detection.
• No named owner for integration security. If nobody can say who decides that the baseline has been met, nobody will stop a risky connection.
• No budget line for remediation. Findings without money attached will wait until the next audit or the next breach.

What good looks like

• Cyber is in the deal thesis from the first screening, with an outside-in review before the letter of intent and deeper diligence once there is access.
• Findings are quantified as ranges and translated into specific price adjustments, warranties, indemnities or conditions.
• A compromise assessment is completed before closing or before any connection.
• The acquired company is isolated until it meets a written baseline, signed off by the buyer's CISO.
• Identities, privileged accounts and machine credentials are inventoried, and every credential that the seller's staff or vendors could know is rotated.
• The board receives integration security status at each meeting until the baseline is met, then in normal quarterly reporting.

Where to invest first

1. A repeatable M&A cyber playbook. Serial acquirers need a standard scope, document request list, scoring method and baseline so each deal does not start from nothing.
2. Compromise assessment capacity. A retained provider, or an internal hunt team, that can be on site within days of signing.
3. Identity consolidation. Tooling and staff to bring acquired identities, privileged accounts and service accounts under the buyer's controls quickly. See the Board Briefing: NHI Risk.
4. Monitoring reach. Getting the acquired company's endpoint, identity and cloud logs into the buyer's security operations is the fastest way to reduce inherited risk.

Metrics to track

A 90-day plan

For a board that wants to put this in place before the next transaction, or for the first 90 days after a deal closes:

1. Days 1 to 30: Agree who owns cyber in M&A and the authority to delay integration or recommend walking away. Approve a standard diligence scope and an integration baseline. For a recent deal, confirm the acquired company is isolated and that its administrator and vendor credentials have been rotated.
2. Days 31 to 60: Commission a compromise assessment of the most recent acquisition if none was done. Bring acquired logs into group monitoring. Inventory identities, privileged accounts, service accounts and third-party connections, and revoke anything without an owner.
3. Days 61 to 90: Review deal templates with legal counsel so breach warranties, indemnities and closing conditions are standard. Confirm insurance cover for acquired entities. Report to the board on the baseline status of every acquisition from the last three years.

Common failure patterns

• Diligence on paper only. The target's policies are reviewed, but no one looks at logs, identities or external exposure, so an active intrusion goes unseen.
• Integration driven by the synergy schedule. Networks and directories are joined before the target meets any baseline.
• Machine identities ignored. Human accounts are migrated carefully while service accounts, API keys and OAuth grants carry on unchanged.
• Protections that expire too soon. Breach warranties run for a year when intrusions are commonly found much later.
• Security staff lost in the transition. The people who know where the target's weaknesses are leave before the knowledge is captured.

Lessons from incidents

• Marriott and Starwood. The FTC's 2024 action describes an intrusion that began at Starwood around July 2014, before the 2016 acquisition, and was found in September 2018. A second breach then hit Marriott's own network between September 2018 and February 2020. The lesson for boards: an acquired network must be hunted, not just assessed, and the buyer's own controls must improve at the same time.
• Yahoo and Verizon. The SEC found that Yahoo's security team knew of the December 2014 theft within days but the breach was not disclosed until 2016, during the Verizon acquisition. The lesson for boards on both sides: known incidents must reach the deal team and the disclosure process.
• Change Healthcare. In February 2024 attackers used a stolen credential on a remote-access portal at Change Healthcare, part of UnitedHealth Group's Optum, that did not require MFA. A single subsidiary control gap disrupted a much larger group. The lesson: the group's baseline must reach every subsidiary. See the Change Healthcare Breach 2024.

Practitioner checklist

• Run an outside-in review (exposed services, leaked credentials, past disclosures) before the letter of intent.
• Request penetration test reports, incident records and the privileged account inventory under the confidentiality agreement.
• Make a compromise assessment a condition of closing or of network connection.
• Express each material finding as a loss range and propose the matching term or price change.
• Write the integration baseline and the named sign-off before closing.
• Rotate every credential that seller staff, contractors or vendors could know, including service accounts and API keys.
• Inventory and re-approve every third-party connection and OAuth grant into the target.
• Report integration security status to the board until the baseline is met.

Standards and references

• US SEC: Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure Rules
• US FTC: FTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches
• US SEC: Altaba, Formerly Known as Yahoo, Charged With Failing to Disclose Massive Cybersecurity Breach
• UK Government: Cyber Governance Code of Practice
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

How NHI Mgmt Group can help

We provide independent identity and non-human identity assessments for acquisitions, with a focus on the privileged accounts, service accounts, API keys, OAuth grants and certificates that carry old access through a change of ownership. Our NHI Foundation Level Training Course helps security and IAM teams govern machine identities across merged estates. Contact us to arrange a board briefing.

Related NHI Mgmt Group resources: Cyber Due Diligence in Mergers and Acquisitions Guide · Identity Integration in M&A Guide · SEC Cyber Disclosure Executive Briefing · Third-Party and Supply Chain Risk Executive Briefing. This briefing summarises regulatory expectations for board members and is not legal advice.