M&A cyber and AI due diligence before you sign.
Targets increasingly run on AI tools and AI vendors. We find the security, data and AI governance issues that affect value, timing and integration, and explain them in terms a deal team can use: price, reps and warranties, escrow and Day 1 actions.
Cyber diligence, plus the AI questions most reviews miss.
- Security posture: identity and MFA, privileged access, endpoints, email, backups and recovery, external attack surface, incident and breach history, cyber insurance.
- AI inventory and dependence: which products and processes rely on AI, and on which vendors and models.
- Data rights: whether customer or patient data was used to train models, and under what terms.
- AI claims vs. reality: whether the AI described in the deck is in the product and works as described.
- AI governance maturity: policy, ownership and evidence, measured against NIST AI RMF and ISO/IEC 42001.
- Regulatory exposure: HIPAA, financial-services, CMMC and other obligations that follow the business.
Deliverables
- Red-flag summary for the investment committee
- Scored findings with remediation cost, time and deal impact
- Items to address in reps, warranties, escrow or price
- Day 1 security and AI baseline plan and 100-day priorities
Led by Edmond K. Sarpong, CISSP, CISM, CISA, CRISC, PMP, AIGP, AAISM.
Discuss a deal under NDA →Matched to your timeline and access.
Both formats are built for compressed deal windows and limited target availability.
| Red-flag assessment | Full cyber & AI diligence | |
|---|---|---|
| Best for | Early evaluation, competitive processes, smaller targets | Under LOI with data-room access and management sessions |
| Typical window | About one week | Two to three weeks, scaled to complexity |
| Output | Executive red-flag summary with deal blockers and follow-up questions | Scored deal-risk report mapped to NIST CSF, ISO/IEC 27001, CIS Controls and NIST AI RMF, with remediation economics and Day 1 blockers |
From screening to integration.
Technology & cyber due diligence
Scope, domains and formats in detail.
Due diligence →Sell-side cyber readiness
Find and fix issues before the buyer does.
Sell-side readiness →Day 1 security & FieldOps
When the target has no security team, we deploy one.
Day 1 →Post-merger integration
Turn Day 1 into a controlled 100-day plan.
Integration →PE portfolio services
Security and technology value across the hold period.
Portfolio services →Full M&A advisory
The technology and cyber workstream, run like a deal workstream.
M&A advisory →Reading: What a one-week red-flag assessment answers · Ten findings that should delay integration · What an investment committee should ask · The first 72 hours after an acquisition · Scoring diligence against NIST, ISO and CIS
Frequently asked questions
What is M&A cyber due diligence?
An evidence-based review of a target's cybersecurity before a deal closes: identity and access, infrastructure and cloud, endpoints, backups, incident history, regulated data and third-party access. It tells the buyer what it is inheriting, what it will cost to fix, and whether anything should change price, terms or timing.
What does AI due diligence add?
It asks the questions traditional cyber diligence misses: which products and processes depend on AI, which AI vendors the target relies on, whether customer or patient data was used to train models and under what rights, whether AI claims in the deck hold up, and whether any AI governance exists.
How long does it take?
A red-flag assessment takes about one week using data-room documents, an external exposure review and focused management Q&A. Full technology, cyber and AI diligence under LOI typically takes two to three weeks, scaled to target complexity.
How is M&A due diligence priced?
Fixed fee, scoped to the deal after a short call under NDA. You receive a written quote before work starts. Many buyers start with the one-week red-flag assessment, which also sharpens the scope of full diligence.
Who performs the work?
Engagements are led by Edmond K. Sarpong (CISSP, CISM, CISA, CRISC, PMP, AIGP, AAISM). Findings are scored against NIST CSF, ISO/IEC 27001, CIS Controls, NIST AI RMF and ISO/IEC 42001.
Do you work on bank and credit union mergers?
Yes. For financial-institution targets we add core and third-party vendor dependence, AI inside vendor products, and the information security and governance evidence examiners will expect from the combined institution.
Do you sign an NDA?
Yes, from the first substantive conversation.
Have a deal under LOI?
We are comfortable working under NDA from the first conversation, and we will tell you quickly whether a red-flag week or full diligence fits.