Whatever you acquire, you acquire its problems too. That was the thread running through a conversation we recently brought together on inherited risk in M&A, with three people who each see it from a different chair:
- Don Aviv, Interfor International. Enhanced due diligence: ownership, relationships, geopolitical exposure, and the less obvious risks around a transaction.
- Mark Stamford, OSec. The technical view: what is actually happening inside an environment.
- Ed Harris, Mauser Packaging Solutions. The CISO who has to live with whatever comes through the door once a deal is done.
The conversation went well beyond the usual cyber due diligence checklist. Here is what came out of it.
It usually comes back to people
Don works in a world of financial and cyber risk, but he kept returning to a simpler truth: most of what his diligence uncovers comes back to people. And wherever there are people, there are usually things that were not disclosed properly. Over the years he has surfaced shell companies, undisclosed relationships, secret marriages, and other details that completely change how a buyer sees a company, or the people behind it. That was the question the panel was built around: when red flags appear around ownership, relationships, or the broader business, what else might they be telling you?
The technical view is not as different as you would expect. Mark pointed out that the serious things he finds are very often mundane. Not an exotic zero-day or a sophisticated attack, but old infrastructure nobody remembered existed, systems that were never properly shut down, credentials that were poorly managed, or something everyone assumed someone else was handling.
Industry shapes how visible any of this is. Manufacturing environments run a wide range of technology, much of it old, which makes cyber risk hard to gauge. Sectors like finance have more established frameworks, so buyers get a clearer baseline to measure against. And because the three speakers work across different countries, the amount of diligence varies too. In some markets buyers run extensive checks that can reshape a deal; in others a handshake can seem to be enough. How litigious a market is, and what its regulations demand, drives much of that gap.
Findings rarely kill a deal. They reprice it.
Where the discussion got interesting was whether findings like these actually kill deals. Mark has seen technical findings serious enough to create a real problem for a transaction. But Don’s view was that, in most cases, they do not blow up the deal. They change its economics. The deal gets repriced.
A problem does not make a company unbuyable. It changes what the buyer believes that company is worth.
We tend to treat due diligence as binary: the company passes, or something is wrong and the buyer walks. In practice it is far more commercial. Buyers are not always hunting for the cleanest asset, either. A business with weak security, compliance gaps, financial pressure, or poorly managed assets can still be attractive if the buyer believes those problems are fixable and the price reflects the work. Sometimes the weakness is the opportunity.
The distinction that matters: did you know before you bought?
The important line is whether you knew about the problem before you bought it.
Knowingly acquiring a company with security debt and pricing it into the deal is a very different thing from discovering, six months later, that you inherited a far larger problem than anyone disclosed. When something undisclosed does surface, the response comes down to three questions:
- How severe is it?
- Was it deliberately hidden?
- How does it need to be addressed?
Diligence is not about proving everything is perfect. It is about getting enough visibility to understand what you are actually buying, and what that risk is worth.
Putting a number on inherited risk
So how do you put a dollar value on the risk you are inheriting, and what would it have been worth to know about those gaps before the deal closed?
Mark noted that CISOs have wrestled with this for almost as long as cyber has existed. What is the financial impact of a given vulnerability? Every approach has strengths and weaknesses. His advice: align findings to business objectives rather than presenting them in purely technical terms. Companies spend heavily on security but often cannot show how much risk they have reduced, and that same missing proof becomes the reason the next investment gets delayed.
The cost of timing, though, is easier to see. In Mark’s experience, fixing issues uncovered in diligence before a deal closes costs on average 50% less than handling them later, during integration.
Then someone has to live with it
Once the acquisition happens, someone has to deal with what was bought. That is where Ed sits.
He has been through enough M&A as a CISO to have built his own process: a tool stack, a checklist, and a way of prioritizing what his team looks at first. Some things get fixed immediately. Some get documented and folded into the broader security program. Some are simply going to take time.
It is the least glamorous version of the job. Don gets to uncover the stories. Mark gets to find what is technically wrong. Ed is the one who gets told, in one form or another, “this is yours now. Figure it out and fix it.” And security is still often brought in too late to change any of it. By the time the CISO is involved, many of the commercial decisions are already made.
That leaves him with two kinds of risk. There are the things he can control: the checks his team runs, what they find, what they prioritize and fix. And there are the things that simply arrived with the acquisition. He may never have approved a given system, vulnerability, or practice. He would never have chosen it. But once the company owns it, his team owns the problem. Being able to say clearly “this was inherited, here is what we found, here is what we are doing about it” offers some protection. It does not make the risk disappear.
”We inherited it” stops working
So we asked the panel directly: does “we inherited it” really hold up once a deal is done? The uncomfortable answer was that, eventually, the line between who created the problem and who owns it matters less and less. Whether it is an undisclosed relationship Don uncovers, a technical weakness Mark identifies, or an environment Ed absorbs, the acquiring company ends up owning the exposure.
M&A risk isn’t one category
The biggest takeaway: M&A risk is not really one category of risk. Cyber, financial, operational, and people risk overlap far more than we like to pretend. A technical weakness can move a valuation. A people issue can expose an ownership problem. Something that looks like a minor operational quirk before the deal can become an expensive security problem after it.
What to actually do
All three speakers landed in the same place:
- Do the diligence. You will never uncover everything before a transaction closes, and that is fine. The goal is enough visibility to make better decisions about what you are buying and what it is worth.
- Have an integration toolkit ready. A defined set of tools and processes you apply every time, plus a 30-day plan for handling major issues fast.
And get security a seat at the table during the process, not after it. When security can inform stakeholders early, they make better calls about what they are buying, what it is worth, what they are willing to inherit, and what needs to be fixed first.
Because whether the problem came from someone else’s architecture, someone else’s management team, or a decision made five years before you arrived, once the deal is done it becomes yours.
You didn’t build it. You own it anyway.