These figures highlight a shift in the cyber threat landscape: it no longer stops at the targeted company’s perimeter but extends across its entire ecosystem.
This reality has a direct impact on how technological risks are assessed during mergers and acquisitions involving software assets. Acquirers must now evaluate cyber risk holistically, measuring not only the exposure of the core technological asset but also that of all its dependencies.
Key points to remember about cybersecurity risk analysis in M&A
- The exploitation of software vulnerabilities is now the primary entry point for cyberattacks.
- Assessing a tech company’s cyber risk requires a comprehensive view that includes all suppliers and software dependencies.
- For investors, the challenge lies in translating technical findings into concrete risks, required investments, and potential impacts on growth.
- A vulnerability is not inherently a dealbreaker: its significance depends entirely on its context and the feasibility of remediation.
From compliance risk to economic impact
Companies already dedicate a significant portion of their IT resources to security. According to ENISA’s NIS Investments 2025 study of 1,080 European professionals, cybersecurity accounts for 9% of IT budgets (4).
Regulation remains the primary driver for these investments, cited by 70% of surveyed organisations. However, 42% also point to the prevention of financial or reputational risks (4). Cybersecurity must therefore be treated as an economic risk capable of impacting customers, business continuity, future costs, a company’s capacity to grow, and ultimately, its valuation.
Translating cyber risks into financial risks
During an acquisition, merely identifying that a target company has security flaws provides very little value without proper context.
During the audit or due diligence phase, a deal team needs to understand exactly how a vulnerability impacts the asset’s growth projections. To achieve this, teams structure their analysis around three key dimensions:
- The post-closing embedded risk. Could specific vulnerabilities compromise the product, data, customers, or business continuity? Are the observed weaknesses isolated incidents, or do they signal a more structural problem?
- The budgetary impact (CAPEX / OPEX). Remediation may require time, new tools, additional skills, or process overhauls. These requirements translate into OPEX or CAPEX that must be factored into the value creation plan.
- Ability to support the business plan. An architecture and organisational structure suited for a few dozen clients will not necessarily meet the security standards required when a company scales to hundreds of customers, enters new markets, targets key accounts, or executes a build-up strategy.
How to assess cybersecurity risks during a due diligence?
In most cases, the acquiring company evaluates the target’s cyber posture through an in-depth cybersecurity audit, or due diligence.
This cyber component is frequently integrated into a broader technology due diligence process, which examines the software asset as a whole to identify cybersecurity flaws alongside intellectual property risks or long-term maintainability issues.
This due diligence will highlight vulnerabilities using several comprehensive analysis methods:
- Code scanning: an essential baseline step to identify known vulnerabilities and catalogue open-source dependencies,
- Network footprinting: a non-intrusive method that reveals potential external entry points into a network,
- Penetration testing: an active assessment of the system’s resilience against external attacks.
Taken at face value, the raw data from these analyses often reveals a high volume of vulnerabilities that might unnecessarily alarm investors. The role of tech due diligence is precisely to contextualise these findings, filtering out false positives and evaluating the scan results against the company’s roadmap, industry benchmarks, and governance standards.
Conclusion
A cybersecurity analysis of a software asset often exposes deeper systemic issues, such as insecure development processes, an ageing architecture, accumulating technical debt, or poor governance. Ultimately, the security posture serves as an excellent indicator of the target company’s overall technological maturity. And this is exactly what a prospective acquirer needs to understand.
Sources
- Verizon Business, 2024, 2025 et 2026 Data Breach Investigations Report.
- Verizon Business, 2026 Data Breach Investigations Report, 19e édition, 2026.
- Verizon Business, 2025 Data Breach Investigations Report, 2025.
- European Union Agency for Cybersecurity (ENISA), NIS Investments 2025, décembre 2025.
Author: Philippe Thomas, CEO at Vaultinum.
Philippe brings 20+ years of experience in finance and technology. CEO of Vaultinum, he combines expertise in AI and machine learning with financial insight, writing on AI, value creation and scalability in Private Equity.