Role of Security Assessment in Mergers and acquisitions (M&A)

Due diligence Review (DDR) is critically important component in the M&A process, be it financial numbers or legal/ regulatory obligations with big monetary stakes.  Amidst all these, cyber security continues to be ignored or not even considered during such a M&A.

Look at the M&A deal of Yahoo -Verizon wherein the whole deal was cut short of millions of dollars, due to ignoring the cybersecurity review which was never even considered. Yahoo accounts had been breached and attackers stole personal data for all users. Due to this negligence of cybersecurity, it took a beating in the deal. Limiting such due diligence to a company’s IT systems rather than treating cybersecurity as a risk category in its own right means ignoring the serious risks that cyber threats create to all or any firms and to M&A deals involving them. Also, organizations going into any M&A deal must see the fact, not only they acquire the company, but also acquire the cyber security posture of it.

Cyber security assessments have a great role to play in M&A due diligence to avoid a security vulnerability or a breach. The deal value of M&A is estimated to be at a global value of $2.51 trillion.

To have a good M&A deal going, organizations must look into:

• Information security risk factors must be considered a top priority
• Does the nonheritable network have important risk, vulnerabilities, privileged users or folks with surreptitious body privileges?
• Companies should be ready to see, in real-time, a holistic view of Identity within the acquired network, whether cloud, on premise, or hybrid.
• Understanding of normal, suspicious and risky user behaviour: who is accessing what, when, where and with what devices.
• Companies should review areas of risk that may be proactively cleaned up, notably the weak passwords, stale accounts, and privileged users.

A new study by Forescout Technologies indicates the role of Cybersecurity may be vital in a M&A due diligence.  Further the study states that most of the organizations do not provide enough time to evaluate all the security standards before the acquisition process.

Many organizations have been exposed to cybersecurity issues which puts the M&A deal into jeopardy. No one wants to buy a breach, and it is critical to perform cyber security assessment thoroughly prior to any acquisition. “Never trust, Always Verify” being the new Mantra nowadays will solve many problems in the M&A process. With security breaches soaring in the world, conducting a strict cybersecurity assessment will provide a smoother M&A process with No regrets.