Security Assessment
Evaluating cybersecurity posture and vulnerability exposure
Security assessment identifies vulnerabilities, compliance gaps, and risk exposure that could impact deal value or create post-acquisition liabilities. With average data breach costs exceeding $4.5 million and regulatory fines reaching into the hundreds of millions, security due diligence is no longer optional.
Security in M&A Context: The Stakes
Security issues discovered post-acquisition have real financial consequences:
| Risk Category | Potential Impact | Real-World Examples |
|---|---|---|
| Data Breach | $4.5M average cost (IBM 2023) | Marriott: $124M fine for acquired Starwood breach |
| Regulatory Fines | Up to 4% of global revenue (GDPR) | British Airways: $230M GDPR fine |
| Lawsuits | Class actions, customer claims | Equifax: $700M settlement |
| Business Impact | Customer churn, brand damage | Yahoo: $350M valuation reduction post-breach disclosure |
The Verizon-Yahoo Case Study: After Verizon announced its $4.8B acquisition of Yahoo, two massive data breaches were disclosed affecting 3 billion accounts. Verizon negotiated a $350M price reduction—a direct result of inadequate pre-acquisition security diligence.
Security Assessment Framework
1. Security Governance (Organizational)
Evaluate the security program maturity:
| Element | Mature Organization | Red Flag |
|---|---|---|
| Security Leadership | Dedicated CISO reporting to C-suite | Security is "IT's job" |
| Policies | Documented, reviewed annually, enforced | Policies exist but not followed |
| Training | Regular security awareness, phishing tests | No training program |
| Incident Response | Documented IR plan, tested regularly | No IR plan or untested |
| Third-Party Risk | Vendor security assessments | No visibility into vendor security |
2. Application Security
Assess how security is built into the development process:
- Secure SDLC: Is security considered at design, implementation, and testing phases?
- Code Review: Are security-focused code reviews conducted?
- Static Analysis (SAST): Are automated tools scanning for vulnerabilities?
- Dynamic Analysis (DAST): Is the running application tested for vulnerabilities?
- Dependency Scanning: Are third-party libraries monitored for vulnerabilities?
- Secrets Management: How are API keys, passwords, and certificates managed?
3. Infrastructure Security
| Area | What to Assess | Common Findings |
|---|---|---|
| Network Segmentation | Production isolated from dev/corporate? | Flat network, everything can talk to everything |
| Patch Management | How quickly are patches applied? | >90 day patch windows, unpatched critical CVEs |
| Access Controls | Least privilege? MFA everywhere? | Shared admin accounts, no MFA |
| Endpoint Security | EDR/antivirus deployed? | Incomplete coverage, outdated signatures |
| Cloud Config | Security best practices followed? | Public S3 buckets, excessive IAM permissions |
4. Data Security
- Data Classification: Does the company know what sensitive data it has and where?
- Encryption at Rest: Are databases, file systems, backups encrypted?
- Encryption in Transit: TLS everywhere? Certificate management?
- Access Logging: Who accessed what data and when?
- Data Retention: Is old data properly disposed of?
- Backup Security: Are backups encrypted and access-controlled?
Vulnerability Assessment Methods
Automated Scanning
Quick, broad coverage but limited depth:
- Network Scanning: Nessus, Qualys, OpenVAS
- Web App Scanning: Burp Suite, OWASP ZAP, Acunetix
- Cloud Config: AWS Inspector, Azure Security Center, Prowler
- Container Scanning: Trivy, Clair, Anchore
Penetration Testing
Deeper assessment by security experts:
| Type | Scope | Duration | Cost Range |
|---|---|---|---|
| External Network Pentest | Internet-facing systems | 1-2 weeks | $15K - $40K |
| Web Application Pentest | Specific application | 1-3 weeks | $20K - $50K |
| Internal Network Pentest | Assume breach scenario | 1-2 weeks | $20K - $40K |
| Red Team Exercise | Full attack simulation | 4-8 weeks | $75K - $200K |
Code Review (Security-Focused)
Expert review of security-critical code paths:
- Authentication and authorization logic
- Input validation and sanitization
- Cryptographic implementations
- Session management
- API security
Common Vulnerability Categories (OWASP Top 10 2021)
| Vulnerability | Risk | Remediation Complexity |
|---|---|---|
| Broken Access Control | Unauthorized data access | Medium - requires architecture review |
| Cryptographic Failures | Data exposure | Medium - implementation changes |
| Injection | Data breach, system compromise | Low-Medium - code fixes |
| Insecure Design | Fundamental security flaws | High - may require redesign |
| Security Misconfiguration | Various | Low - configuration changes |
| Vulnerable Components | Known exploits | Low-Medium - updates |
| Auth Failures | Account compromise | Medium - auth redesign |
| Data Integrity Failures | Tampering, malware | Medium - pipeline changes |
| Logging Failures | Undetected breaches | Low - implementation |
| SSRF | Internal system access | Medium - code fixes |
Security Red Flags and Cost Estimates
| Red Flag | Risk Level | Remediation Cost |
|---|---|---|
| No security team or CISO | High | $200K-$400K/year (hiring + program) |
| No penetration testing history | High | $50K-$150K (initial + remediation) |
| Critical unpatched vulnerabilities | Critical | $25K-$100K + breach risk |
| Credentials in source code | Critical | $25K-$75K (rotation + secrets mgmt) |
| No encryption for PII/sensitive data | Critical | $100K-$500K |
| No incident response plan | High | $50K-$100K |
| Failed compliance audit | High | $100K-$1M+ (depends on gap) |
| Previous unreported breach | Critical | Legal exposure + remediation |
Compliance Framework Assessment
| Framework | Applies To | Key Requirements | Audit Cost |
|---|---|---|---|
| SOC 2 | SaaS, service providers | Security, availability, processing integrity, confidentiality, privacy | $30K-$100K |
| PCI DSS | Payment processing | 12 requirements for cardholder data | $50K-$200K |
| HIPAA | Healthcare data | Privacy, security, breach notification | $50K-$150K |
| GDPR | EU personal data | Consent, data rights, breach notification | Varies by scope |
| ISO 27001 | Any organization | ISMS implementation | $50K-$150K |
Security Due Diligence Checklist
Documents to Request:
- Security policies and procedures
- Recent penetration test reports
- Vulnerability scan results
- Compliance certifications and audit reports
- Incident response plan
- Security architecture documentation
- Vendor security assessments
- Security awareness training records
- Breach history and notification records
Questions for Management:
- "Have you ever experienced a data breach?" (Watch for hesitation)
- "When was your last penetration test? Who performed it?"
- "How do you handle vulnerability disclosure?"
- "What's your mean time to patch critical vulnerabilities?"
- "Who has access to production data?"
The Undisclosed Breach: When Security History Surfaces
During TDD of a healthcare SaaS company, our security team discovered something management hadn't disclosed: evidence of a prior breach in server logs. Further investigation revealed that 18 months earlier, an attacker had accessed a database containing 50,000 patient records.
The company had quietly patched the vulnerability but never notified affected patients or the HHS—a clear HIPAA violation. When confronted, leadership claimed they "didn't think it was a reportable incident."
The acquirer renegotiated the deal: $4M price reduction for remediation costs and potential fines, plus a $2M escrow holdback for potential litigation. Six months post-close, HHS did investigate, resulting in a $1.2M fine—covered by the escrow.