Due Diligence Must Include the Systems

The Decision in Front of You

Every acquisition already includes some technology review. The decision is whether that review can change the deal. In most transactions it cannot. It runs after the letter of intent, inside a data room, against documents the seller chose to share, and it reports to an integration team that inherits whatever it finds.

The stakes are set at closing. After that date the target's unpatched servers, shared administrator passwords, unsupported software and undiscovered intrusions belong to the buyer, along with the regulatory exposure attached to the data those systems hold. Remediation that could have come off the purchase price comes out of the buyer's operating budget instead.

FTI Consulting's 2026 survey of 278 senior executives at US companies with 500 or more employees found that nearly one in four had experienced a cyber incident during or shortly after a transaction ¹⁰. Some 42% of respondents reported a significant reduction in deal value, and 20% said a deal was delayed or paused by a cyber incident ¹⁰.

What's Happening

Buyers own the target's past

Marriott announced its acquisition of Starwood in 2015 and completed it in 2016 ¹. An attacker had been inside Starwood's guest reservation system since 2014 and was not detected until September 2018 ¹². The breach exposed records of up to 339 million guests ³. Marriott told the UK Information Commissioner's Office that it had only been able to carry out limited diligence on Starwood's systems ³. The ICO fined Marriott £18.4 million in 2020 and said that diligence is an ongoing duty, "not a time-limited or a one-off requirement" ³.

The US case closed in October 2024. The Federal Trade Commission's order covers three breaches between 2014 and 2020 affecting more than 344 million guest records, and cites failures in access controls, network segmentation, patching, logging and multifactor authentication ¹. Marriott must certify its security program to the FTC every year for 20 years and obtain independent assessments every two years ¹². A coalition of 50 state attorneys general obtained $52 million ². Their settlement also requires "improved diligence in relation to future acquisitions" ¹.

Liability transfers by contract as well as by data. In May 2025 RTX, Raytheon and Nightwing Group agreed to pay $8.4 million to resolve False Claims Act allegations that Raytheon had not implemented required cybersecurity controls on a system used for 29 Defense Department contracts ⁹. The alleged conduct ran from 2015 to 2021. RTX sold the business in March 2024, and it became part of Nightwing, which joined the settlement although the conduct predated its ownership ⁹. The settlement involved no finding of liability ⁹.

Two recent cases where the gap was in the acquired company

Change Healthcare, 2024. UnitedHealth paid $13 billion for Change Healthcare in late 2022 and was modernizing much of Change's technology when the attack came ⁴. On February 12, 2024, attackers used stolen credentials to log in to a Change Citrix remote access portal that did not have multifactor authentication, and deployed ransomware nine days later ⁵. UnitedHealth's policy required MFA on all external-facing systems. The portal had been missed ⁴. Chief executive Andrew Witty testified that some systems in Change's claims and payment business dated back 40 years, that Change's primary and backup environments were not isolated from each other, and that UnitedHealth had to rebuild the platform from scratch ⁴. UnitedHealth put the 2024 cost at $3.1 billion and later estimated that about 190 million people were affected ⁶. The lesson: an integration program leaves inherited access paths open until someone closes them on purpose. Less than two years after closing, one such path cost the buyer $3.1 billion.

PowerSchool, 2024. Bain Capital closed its $5.6 billion take-private of PowerSchool, the school software provider, in October 2024 ⁷. Between December 10 and 28, 2024, an attacker used a single compromised credential to enter PowerSource, the company's customer support portal, and from there reached student information systems ⁷⁸. PowerSchool told TechCrunch that the portal did not support multifactor authentication at the time ⁸. PowerSchool has not confirmed a total, though one outlet reported, citing sources, more than 62 million students and 9.5 million teachers ⁸. At least 23 class actions were filed within weeks ⁷. Whether the weakness could have been found before closing is not public. A support portal with direct reach into customer data and no MFA is the kind of finding a pre-signing access review exists to surface.

Deal teams know this and still under-resource it

Executives report the problem consistently. In Forescout's 2019 survey of 2,779 IT and business decision-makers, 53% said a critical cybersecurity issue or incident had jeopardized a deal, and about 65% said their company had regretted a deal because of cybersecurity concerns ¹¹. The survey is now seven years old. FTI's 2026 data shows the same pattern from inside the deal team: 34% of CISOs said they are not heavily involved in transaction decisions, one in three doubt or are unsure they have authority to stop a deal over cyber risk, and only 23% of executives said they manage cyber risk proactively after closing ¹⁰.

Why the Usual Approach Fails

Technology diligence is sequenced after the price. The letter of intent fixes value and exclusivity first. By the time engineers see anything, the deal has momentum, and findings become integration tasks instead of negotiating points.

The review reads documents instead of testing systems. Data rooms hold policies, network diagrams and a questionnaire the seller completed. None of these shows whether a support portal enforces MFA or whether backups share credentials with production. Change Healthcare's own policy required MFA on external systems ⁴. The written policy would have passed a document review.

Breach history is taken on trust. A target can only disclose intrusions it has detected. Starwood's attacker went unnoticed for four years ¹. A representation that the seller knows of no breach covers only the breaches it knows about.

Technical debt is left out of the model. Forty-year-old claims systems and unsupported platforms carry a replacement cost the buyer will pay ⁴. When that cost appears after closing it becomes a budget overrun with no counterparty.

Integration is treated as the moment to fix security. Integration takes years. Change was still being modernized more than a year after closing ⁴⁵. The target's weakest access path stays open until someone closes it deliberately.

The Framework: Test, Price, Secure

Treat technology and cyber diligence like financial and legal diligence: a workstream with a scope set before the letter of intent, access to systems as well as documents, and a report that goes to the investment committee before signing.

flowchart LR
    A[Scope<br/>before LOI<br/>data and access] --> B[Test<br/>access paths<br/>identities, backups]
    B --> C[Hunt<br/>compromise<br/>assessment]
    C --> D[Price<br/>adjust, escrow<br/>or condition]
    D --> E[Secure<br/>day-one<br/>controls]
    E --> F[Integrate<br/>funded<br/>debt plan]

Scope. Before the letter of intent, agree with the seller that technical diligence includes system access, interviews with the engineers who run production, and time for testing. Treat a refusal as uncertainty and price it.

Test. Enumerate every way into the target: VPNs, remote desktop gateways, vendor and support portals, cloud consoles, email. Check each for enforced MFA. Count privileged accounts and service credentials. Confirm that at least one backup copy is offline or immutable and isolated from production credentials, as CISA's #StopRansomware Guide recommends ¹⁴, and watch a restore.

Hunt. Commission a compromise assessment: a search of logs, endpoints and identity systems for signs of an existing intruder. This is the only diligence step that can find a Starwood before closing.

Price. Convert each finding into money or terms. Cost the remediation and the technical debt, and decide which mechanism carries it (Exhibit 2).

Secure. On the day of closing, reset privileged credentials, enforce MFA on every external path, put the target's endpoints under monitored detection and response, and connect it to your incident response process. Do this before integration starts.

Integrate. Fund the debt plan from the price adjustment, with milestones reported to the board.

Costs, Risks, and Tradeoffs

How to Act

Questions to Ask Your Team

1. On our last three acquisitions, when did technology diligence start relative to the letter of intent, and did any finding change the price?
2. Who on the deal team can stop or delay a signing over a technology finding?
3. Did we test the target's systems, or read documents about them?
4. How many ways in from the internet did the target have on the day we closed, and which lacked MFA?
5. Did anyone look for an intruder already inside before we signed?
6. What did we budget for the target's technical debt, and where did that number come from?
7. Which companies we acquired still run on their original remote access, identity and backup systems?
8. What do our representations and indemnities say about breaches the seller did not know about?

Closing

An acquisition transfers the target's systems to you at closing, whether or not anyone looked at them. The time to find an open portal, an intruder or a forty-year-old platform is before signing, when the finding can still lower the price or change the terms. Make technology and cyber diligence a gate with authority over the deal, test systems instead of reading about them, price what you find, and secure the target on day one.