$350M
cut from the purchase price
Hidden breaches cut value
Two undisclosed Yahoo breaches came to light after the deal was announced. Verizon took $350M off the price.
Verizon · Yahoo · 2017 · Source
Independent cyber due diligence for private equity and corporate buyers. We find the breaches, security gaps and hidden liabilities in a target before you sign, and show what each one means for price, escrow and the first 100 days.
Three acquisitions where the buyer found the cyber problem after it was already theirs.
Two undisclosed Yahoo breaches came to light after the deal was announced. Verizon took $350M off the price.
Attackers got into Starwood’s guest database in 2014, two years before Marriott bought the chain. The UK regulator fined Marriott £18.4M.
Attackers were already inside Piriform’s network when Avast bought it. Weeks later, a tainted CCleaner update reached 2.27M users.
Cyber risk now shows up in price, insurance and timelines. Each one has a diligence answer.
A breach surfaces mid-deal or after close. The deal stalls, reprices or falls apart, and escrow and indemnity demands grow.
Unpatched systems, missing controls and a thin security team become your bill after close.
When cyber diligence is thin, underwriters exclude cyber from the policy or price it up.
Vendor sprawl, incompatible tooling and compliance gaps add cost, delay and customer churn after close.
DealGuard follows the deal. Pick a stage to see what we do there.
Find what would change the price or the terms while you can still negotiate.
Keep watch while the deal is in motion, and get insurance and integration ready.
Close the gaps you priced in, then keep the gains through to exit.
Timelines assume a low eight-figure deal. Larger or more complex targets take longer.
Every finding is tied to a deal decision: price, holdback, indemnity or post-close budget. Here is an excerpt from an illustrative report.
Reasonable baseline hygiene, but material gaps in compliance maturity and no formal incident response plan. Findings should inform valuation, indemnification scope and a post-close remediation budget.
Not deal-blocking. Clarify the PCI DSS self-assessment, hold escrow against SOC 2 readiness within 12 months, carve out indemnity for the 2023 vendor incident, and budget a fractional CISO for the first 100 days.
Packages are sized by the target’s headcount, including contractors, and its number of major systems or environments. We confirm the fee after a short scoping call.
Our team has led cyber due diligence and security integration on bank and telecom acquisitions, and run fast reviews for private investors.
A private wealth advisor asked us to evaluate a client’s prospective investment in an AI authentication and identity management company. Early concerns:
We advised the client not to invest and recommended alternative providers.
OTH Security is a cybersecurity and risk firm founded in 2018, with deep experience in fintech, financial services and insurance. We act as the named CISO for growing companies, so we know what a target’s security program should look like from the inside.
Visit othsecurity.com →Two decades building security programs for companies from financial services startups to top 20 international banks, government departments and e-commerce businesses. Has led SOC 2, ISO 27001, SOX, PCI DSS and ITSG-33 programs and built security teams from the ground up.
Ideally before the LOI, while findings can still shape price and terms. We also work during confirmatory diligence, between signing and close, and after close.
Not to start. Attack surface and breach history reviews use public information only. Vulnerability scanning, penetration testing and document review happen with the target’s consent, usually during confirmatory diligence.
By the size of the target: headcount, including contractors, and the number of major systems. We confirm the fee after a short scoping call.
Yes. We document the cyber diligence underwriters ask about and help you answer their cyber questionnaires, which can help limit cyber exclusions in the policy.
An IC tear sheet for the investment committee, an executive report for the deal team and a partner-level readout. The technical detail goes to whoever owns the 100-day plan.
Yes. Sellers use DealGuard to find and fix issues before buyers do, so diligence doesn’t stall late in the process.
It takes about a minute, and there’s no need to name the target. We’ll reply with a proposed scope sized to the target and your timeline.
We’ll reply with a proposed scope. If the deal is moving fast, book a call and we can talk it through today.
Book a 30-minute callYour request didn’t go through. Check the highlighted fields and try again, or email contact@othsecurity.com.