Contact
Contact

Services

Pre-deal cyber due diligence that turns findings into decisions

The question is not simply “does the target have security controls?” The useful questions are what risk is being inherited, what matters to the investment thesis and what needs to happen before and after completion.

Cyber due diligence evidence and assurance informing board and investment decisions

What this covers

  • Inherited risk

    What security, technology and resilience risk comes with the target — expressed in investment language.

  • Investment thesis impact

    Which findings could affect value creation, customer confidence, regulatory exposure or exit.

  • Evidence quality

    What can be demonstrated now, where evidence is weak or incomplete and what remains assumption rather than evidence.

  • Pre-deal actions

    What needs attention before completion versus what can wait for the hold period.

  • Post-deal plan

    A practical Continuous Security Improvement Plan with prioritisation, ownership and sequencing.

  • Specialist testing

    Clear guidance on when penetration testing, code review or other specialist work is genuinely required.

Cyber due diligence should support an investment decision, not simply describe the target’s current controls. JandaSec assesses material cyber and technology risk in business context: what could affect the transaction, value creation, resilience, customer confidence, regulatory exposure or exit — and what practical work should happen before and after completion.

Deal timing also matters. Signing, completion and public announcement can bring additional scrutiny, operational change and external attention. JandaSec considers that period explicitly: what should be addressed before completion or announcement, what residual risk is being accepted, whether monitoring and response arrangements are ready, and which actions should begin immediately after the deal closes.

Assessment areas may include

  • Cyber strategy, governance and accountability
  • Security leadership and resourcing
  • Identity and privileged access
  • Infrastructure and cloud
  • Product, SaaS and secure engineering
  • Vulnerability and patch management
  • Monitoring and incident response
  • Data protection and sensitive information
  • BCDR and cyber recovery
  • Third-party risk and material dependencies
  • AI governance and AI-enabled product risk
  • Customer assurance, compliance and certification
  • Security culture and evidence quality

From diligence to value creation

The useful output from due diligence is not simply a list of findings. It should show what matters to the transaction, what needs action before completion and what should become part of the first-year security improvement plan.

That allows investors and management teams to understand likely remediation effort early, allocate investment sensibly and avoid discovering preventable security work only after ownership has changed.

Outputs may include

Due diligence should identify what is working as well as what needs attention. Credible strengths, effective controls and good evidence can be just as relevant to an investment decision as identified weaknesses.

  • Executive context and findings summary
  • Board / investment brief
  • Prioritised cyber risk assessment
  • Continuous Security Improvement Plan
  • Cybersecurity Observed Strengths
  • Assumptions and evidence gaps
  • Pre-deal and post-deal actions
  • Recommended specialist testing where required

Risk judgements are informed by evidence, business context and uncertainty. They support decision-making rather than pretending to provide mathematical certainty.

Boundary

JandaSec cyber due diligence is an independent cyber risk and assurance assessment. It is not, by default, penetration testing, vulnerability scanning, source code review, legal advice or software licence analysis. Where specialist testing or advice is required, that work is separately scoped or delivered through appropriate specialists.