Straight answers.
When should cyber due diligence start?
Before terms are largely agreed. Early AI-assisted analysis and public-data review can flag areas worth investigating, with the depth of diligence increasing as deal certainty grows.
Does the target company need to know?
An early public-data review uses publicly available information. Document and control reviews require access to relevant evidence, so target involvement depends on the agreed scope.
How is this different from a penetration test?
A penetration test probes technical weaknesses. Our focus is the target's valuable assets, relevant attack methods and existing exposures — and what the evidence could mean for valuation, negotiation points and deal terms.
Who reads your reports?
Deal teams, investment committees and their advisors. Findings are framed in deal language, connecting cyber exposure to acquisition value rather than simply producing a technical remediation checklist.
Why focus on assets rather than a generic checklist?
The same control gap can have different consequences in different businesses. Starting with the target's crown jewels puts industry context, relevant attack methods and acquisition value at the center of the review.
Do you work with private equity firms?
The approach is built for M&A deal teams, including private equity, corporate development and their advisors. Review depth is matched to the target and the stage of the transaction.
Where does AI fit?
AI helps process information economically enough to support analysis earlier in the deal cycle. It supports the review; it does not establish that a target is secure or that every exposure has been found.