The CISO's role in M&A: diligence, integration, and the risks that hide in deals

TL;DR: In M&A the CISO has two jobs: price the target's security risk into the deal before signing, and keep the integration from becoming the breach. Diligence should focus on history, identity, and exposure rather than policy binders; integration should treat the target's network as hostile until proven otherwise. The prerequisite for both is being in the room early.

What can security diligence actually determine?

Under deal timelines and limited access, not everything — so focus where signal density is highest. History: incidents, claims, regulator contact, and the target's cyber-insurance loss runs (an underused source of truth). Identity and access: the fastest maturity proxy there is — MFA coverage, privileged account management, joiner-leaver hygiene. External surface: what the internet can see of the target right now, measurable without their cooperation. Obligations: data-protection exposure by jurisdiction, contractual security commitments to enterprise customers, open audit findings. The gap: where written policy and observed reality diverge — the width of that gap is itself the finding. What diligence rarely catches: an active, quiet compromise. For crown-jewel acquisitions, budget for compromise-assessment forensics, not just questionnaires.

How does the deal team use what security finds?

Findings become deal mechanics, which is why timing matters. Material risks price into valuation or purchase-price adjustments; uncertainties become reps and warranties (and their insurance), escrows, or closing conditions ("MFA on all remote access before close"); known incidents become special indemnities. A CISO who reports "their security is weak" gives the deal team nothing; one who reports "expect $X remediation over 18 months, one open regulatory matter, and a customer contract with breach-termination rights" gives them levers.

What are the day-one and integration priorities?

Day one: credential resets for privileged access, visibility deployment (EDR/logging) into the target estate, an inventory of every existing connection between the companies (there are always more than the deal team knows), and a communications plan — M&A announcements reliably trigger phishing campaigns against both workforces. The connectivity question: treat the target network as untrusted; connect through controlled, monitored chokepoints; and resist the business pressure for immediate full trust. Staged integration beats fast integration every time the difference matters. The sequencing: identity consolidation first (one directory, one MFA story), then email and collaboration, then the long tail of applications — with the target's security staff treated as an asset to retain, since they know where the bodies are buried.

What should the CISO negotiate internally?

Three things before the next deal, not during it: a standing seat in the M&A process under NDA from diligence onward; a pre-agreed security diligence playbook so 30-day timelines don't produce improvisation; and an integration budget line in every deal model — because the most common failure isn't missed diligence, it's a two-year "temporary" flat-open network connection that everyone meant to fix. Acquisitions are how mature companies import risk at scale; the CISO's leverage is almost entirely a function of how early they're allowed to see it.