What are the biggest cyber red flags in due diligence?

The biggest cyber red flags in technical due diligence are the ones that change the price or stop the deal: signs of an undisclosed or ongoing breach, a core product the buyer may not fully own, regulatory exposure that could lead to fines, and security gaps too deep to close within the investment plan. Most other findings belong in the post-completion plan.

Every target has security weaknesses. The job of diligence is not to list them all, but to separate the few that affect value, liability or the ability to close from the many that are simply work to schedule after completion. This guide focuses on that first group: what makes a finding a red flag, which ones most often move a price or end a deal, and what to do when you cannot get the access you need to be sure.

What makes a finding a red flag

Diligence teams need a consistent test, or every finding starts to look urgent. A useful one asks four questions:

1. Does it affect value? Will it cost a material amount to fix, reduce revenue, or weaken the investment thesis?
2. Does it create an open-ended liability? Could it lead to regulatory fines, claims or contractual penalties that are hard to size?
3. Can it be fixed before completion? If it can, it may become a condition rather than a price point.
4. Can you trust the answer? If the evidence is thin or the seller cannot back up its claims, uncertainty itself becomes the risk.

A finding that scores highly on the first two and badly on the last two is a red flag. The NCSC warns boards that many incidents result from vulnerabilities in acquisitions or older legacy systems, which are often overlooked (NCSC, Cyber Security Toolkit for Boards, retrieved 20 October 2026). Diligence is the point at which they are cheapest to find.

Red flags that can stop a deal

Signs of a current or past compromise

The most serious finding is evidence that the target has been breached and either does not know or has not disclosed it. Indicators include unexplained administrator accounts, gaps in logging that coincide with suspicious activity, unreported incidents, or a history of ransomware that was “handled” without investigation.

The risk is that the attacker is still there. When Marriott acquired Starwood in 2016, Starwood’s systems had already been compromised in 2014, and the attack was not detected until September 2018. The ICO fined Marriott £18.4 million in 2020, noting that the need for a controller to carry out due diligence on its data operations “is not time-limited or a ‘one-off’ requirement” (ICO, Marriott International Inc Penalty Notice, 30 October 2020, retrieved 20 October 2026). Where indicators of compromise appear, a focused compromise assessment before signing is usually cheaper than inheriting the attacker.

A core product the buyer may not fully own

For software businesses, the product is often most of the value. Red flags include code written by contractors without clear assignment of intellectual property, and open-source components used in breach of their licences. Some licences carry obligations that matter commercially. The GNU Affero General Public License, for example, requires anyone who modifies the software and offers it to users over a network to make the modified source code available to those users (GNU AGPL v3, section 13, via SPDX, retrieved 20 October 2026). If a proprietary SaaS platform has been built around modified AGPL code, its owners may have to offer the source of the modified components to every user, which can undermine the value of that code. Licence questions need your legal advisers, but technical diligence is what finds the components in the first place.

Regulatory exposure that is hard to size

Under UK GDPR, the higher maximum fine is £17.5 million or 4% of worldwide annual turnover, whichever is higher (ICO, data protection fining guidance, retrieved 20 October 2026). Organisations must report notifiable personal data breaches to the ICO without undue delay and, where feasible, within 72 hours of becoming aware (ICO, retrieved 20 October 2026). A target that has suffered breaches it never reported, or that handles payment card or health data without the controls those obligations require, carries a liability that is difficult to price. In regulated sectors such as financial services, gaps against sector rules can also put permissions or key customer contracts at risk.

Answers you cannot verify

If a target refuses reasonable technical access, cannot produce basic evidence such as recent test reports or backup records, or gives answers that contradict what you later observe, treat it as a finding. It does not always mean something is being hidden, but it means you are pricing a risk you cannot see.

Red flags that change the price

Some findings rarely stop a deal on their own, but they shift value enough to renegotiate.

Disclosed breaches with continuing liability

Breaches discovered during a deal can change its terms. When Yahoo disclosed major data breaches during its sale to Verizon, the parties cut the purchase price by $350 million and agreed to share certain breach-related legal and regulatory liabilities (Verizon and Yahoo joint announcement, 21 February 2017, via SEC filing, retrieved 20 October 2026). The lesson for smaller deals is the same: a known breach carries costs that need to be reflected in price, indemnities or both.

Core systems that are out of support

An unsupported platform at the centre of the business is a cost the seller has not paid. Microsoft ended support for Windows 10 on 14 October 2025, after which it no longer provides security updates outside its time-limited Extended Security Updates programme (Microsoft, retrieved 20 October 2026). The same applies to unsupported databases, server operating systems and end-of-life network equipment. Replacing them is usually a project with a cost that can be estimated and deducted.

Security too weak to rule out compromise

Shared administrator accounts, no multi-factor authentication on remote access and no central logging do more than create risk. They mean nobody can say with confidence whether the business has already been breached. That uncertainty should either be resolved before signing or reflected in the terms.

Recovery that would not work

If backups are not protected from ransomware, or a restore of critical systems has never been tested, the business may not survive a serious incident in its current form. The cost of building reliable recovery is a direct adjustment to value.

Security debt against the buyer’s standard

Even without a single dramatic finding, a target may need significant investment to meet the buyer’s own security standards, insurer requirements or customer demands. Sizing that gap gives the deal team a number to negotiate with.

Turning red flags into deal terms

Once a red flag is sized, the deal team has a few options: adjust the price, seek a specific indemnity, require remediation as a condition of completion, plan the fix after completion, or walk away. The right choice depends on how certain and how quantifiable the risk is, and is a decision for the deal team and its legal advisers.

One constraint is worth knowing early. Warranty and indemnity insurance generally excludes matters that fall within the deal team’s knowledge, including issues disclosed in the data room or identified in due diligence reports (WTW, Navigating W&I insurance exclusions, retrieved 20 October 2026). A red flag found in diligence usually cannot be passed to an insurer, so it has to be dealt with in the price or the purchase agreement.

Common mistakes

• Treating every finding as a red flag. A report that lists 200 issues at the same severity gives the deal team nothing to act on.
• Accepting the seller’s penetration test as diligence. It shows what the seller chose to test, when they chose to test it.
• Ignoring signs of compromise because the deal timetable is tight. An undetected attacker transfers with the business.
• Leaving software licensing to the lawyers alone. They need technical input to know which components are in the product.
• Losing the findings after completion. Red flags priced into the deal still need fixing once you own the business.

Frequently asked questions

Should a red flag always stop the deal?

No. Most red flags can be priced, protected against or fixed. A deal usually only stops when the risk cannot be sized, cannot be contained, or undermines the investment thesis itself, such as an inability to establish who owns the core product.

Can we rely on the seller’s own penetration test report?

Treat it as useful background, not independent evidence. Check its date, its scope and whether the findings were fixed and retested. A report that covers only the public website says little about the internal network or cloud estate.

What if the target will not allow technical access before signing?

Agree what evidence can be shared instead, such as configuration exports, recent test reports, policies and interviews with key staff. Be explicit in your report about what could not be verified, so the deal team prices that uncertainty. Some buyers also make specific checks a condition of completion.

Is a target with cyber insurance a lower risk?

Not necessarily. A policy shows the target has bought cover, not that its controls work. If the proposal form answers do not match the real environment, the policy may not respond as expected, which is itself worth checking during diligence.

Getting started

The value of diligence lies in telling the deal team which findings matter and what they are worth. Our technical due diligence service is built around that, and our M&A deal security solution carries the findings through to the first 100 days. If you invest across a portfolio, see how we support private equity firms.

If you have a deal in progress, talk to our team.