Words From The CEO – The Interplay of AI, Cybersecurity Due Diligence, & Mergers and Acquisitions

Merging or acquiring a business today requires great expertise in legal, tax, operational, and technical focus areas. IT due diligence has become increasingly important due to cybersecurity threats, privacy mandates, and the use of artificial intelligence. An IBM Study found that 20% of the organizations interviewed had a data breach due to improperly managed AI tools.

Improperly managed AI and related security threats can ruin a business deal that might otherwise look very promising. A faulty technology infrastructure can cost both the buyer and seller – reduced business valuations for sellers and compliance, reputation, income, and operational impacts for buyers.

Red Flags

Cybersecurity. Are proper compliance certifications in place? Review penetration tests, code reviews, compliance audits, and data & cyber insurance policies. 
Maintenance. Is regular patching in place? Does the infrastructure conduct regular physical and logical testing?
Leadership. Are strategic oversights, policies, and procedures in place?  Is the seller cutting corners on the way out?

Best Practices

IT due diligence takes planning. Here are a few suggestions:

• Start early. For the buyer, begin with skilled resources as soon as the paperwork is dry. For the seller, get ready before you decide to sell. Starting early will give both the buyer and seller time to complete a process that can easily take many months.
• Be detailed. Interview the team to make sure you have the right people, speak weekly if not more often, and be guarded when simple requests become hard.
• Inventory assets and review contracts. Roll up your sleeves and make sure all numbers are correct. Whether it's hardware, software, networks, data centers, or third-party systems, a thorough audit is imperative. Visit and inspect third parties who provide IT services. Remember, you are only as good as your weakest link.
• Evaluate AI. AI is new and requires special considerations. Consider this:
  • How do you know that the AI tools protect data, comply with privacy laws, and are not prone to cyber-attacks?
  • What type of training and certification are provided to those using these tools?
  • Have policies and procedures for AI been written, and are they being followed?
  • Is the existing IT Governance capable of running an AI-driven organization?

Emerging technologies like AI are reshaping the steps required for M&A. IT due diligence must be thoughtful, early, and comprehensive to protect both buyer and seller. 

Happy Fall 2025!