<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-security-acquisition-due-diligence
description: >-
  Conduct security due diligence for mergers and acquisitions by assessing
  target company security posture, identifying hidden cyber risks, estimating
  remediation costs, and producing actionable risk reports for deal teams.
domain: cybersecurity
subdomain: security-leadership
tags:
  - due-diligence
  - mergers-acquisitions
  - risk-assessment
  - cyber-risk
  - deal-advisory
  - integration-planning
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Building Security Acquisition Due Diligence

## Overview

Security due diligence during M&A identifies cyber risks that affect deal
valuation, integration timelines, and post-close liability. A thorough
assessment evaluates the target's security maturity, breach history, regulatory
compliance, technical debt, and integration complexity.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Deal team access | Coordinate with legal, finance, IT |
| Target documentation | Policies, architecture diagrams, audits |
| Assessment framework | Structured evaluation criteria |
| NDA and data room access | Secure document exchange |

## Key Concepts

- **Cyber risk quantification**: Translate security gaps to financial impact
- **Integration complexity**: Assess effort to merge security stacks
- **Hidden liabilities**: Undisclosed breaches, regulatory non-compliance
- **Technical debt score**: Accumulated security shortcuts requiring investment
- **Transition service agreements**: Security obligations during integration

## Workflow

### Step 1: Define Assessment Scope

```python
DILIGENCE_DOMAINS = {
    "governance": ["policies", "roles", "board_reporting", "risk_register"],
    "technical": ["architecture", "vulnerability_mgmt", "patching", "encryption"],
    "operational": ["incident_response", "monitoring", "access_mgmt", "backup"],
    "compliance": ["regulatory_status", "audit_findings", "certifications", "privacy"],
    "history": ["breach_history", "litigation", "insurance_claims", "pen_test_results"],
}
```

### Step 2: Conduct Assessment

```python
from dataclasses import dataclass

@dataclass
class DiligenceFinding:
    """Security due diligence finding."""
    domain: str
    finding: str
    severity: str  # critical, high, medium, low
    financial_impact: str
    remediation_cost: str
    remediation_timeline: str
    deal_impact: str  # "deal_breaker", "price_adjustment", "integration_risk", "acceptable"
```

### Step 3: Quantify Cyber Risk

```python
def estimate_risk_exposure(findings: list[dict]) -> dict:
    """Estimate aggregate cyber risk exposure for deal valuation."""
    cost_map = {"critical": 2_000_000, "high": 500_000, "medium": 100_000, "low": 25_000}
    total = sum(cost_map.get(f["severity"], 0) for f in findings)
    deal_breakers = [f for f in findings if f.get("deal_impact") == "deal_breaker"]
    return {
        "total_risk_exposure": total,
        "deal_breakers": len(deal_breakers),
        "recommended_price_adjustment": total * 1.5,
        "integration_budget_estimate": total * 0.7,
    }
```

### Step 4: Produce Due Diligence Report

```bash
node agent.js assess --target acme_corp --domains all
node agent.js quantify --findings assessment_results.json
node agent.js report --target acme_corp --format executive
```

## Verification

| Check | Method |
|---|---|
| All domains assessed | Checklist coverage against framework |
| Findings validated | Evidence-backed with document references |
| Risk quantification reviewed | Finance team sign-off on estimates |
| Report delivered | Deal team received and acknowledged |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [ISO 27001 — Information Security Management](https://www.iso.org/standard/27001)
- [M&A Cyber Due Diligence Best Practices](https://www.isaca.org/)
