ISF Podcast17 Jun 2025

S35 Ep3: The Silent Risk in M&A: Cyber Security Oversights That Cost Millions

Financial due diligence is common practice when companies merge or one business acquires another. Cyber security due diligence, however, is not quite as common. Yet, in a world where the threat landscape changes by the day and risk is growing increasingly complex, solid cyber security practices are more important than ever.

Today, Steve and Tavia dig into this very topic, and, more specifically, what role cyber security has in a merger or an acquisition. How is a cyber security review done? Why are they important? How do we balance speed with thoroughness? How do we interpret the results? There’s a lot to dig into here.

Key Takeaways:

Cyber due diligence is paramount in a corporate acquisition or merger.
Risks of not doing cyber due diligence include both financial and reputational.
Cyber due diligence is a team game.

Tune in to hear more about:

Who should be responsible for conducting the cyber review (4:34)
How organizations can build cyber into their due diligence process (14:05)
Examples of where insufficient cyber due diligence proved costly (19:05)

Standout Quotes:

“You can't play a team sport without a team. And for me, M&A is a team game. You can't go it alone. I think it would be a mistake for somebody to think that they could do this kind of work solo. Because as we've seen with cyber maturing, it now touches so many different parts of the organization. You do need to be involved.” - Steve Durbin
“I think people are getting it. What I'm seeing now is people get it, but they don't know how to do it. That's where the cyber professional really now has to step up.” - Steve Durbin
“Pre-deal, I think it is about being focused. It's about identifying, prioritizing the high risk areas that are out there that you want to look into. It's about doing things like making sure that the governance is there. It's about scanning for some of the known vulnerabilities. If you are in one particular market sector and you're buying a company in another because of expansion growth, you're going to need to be covering off a whole range of different things that perhaps might be unusual for you because you haven't been having to look into those areas.” - Steve Durbin

Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(359)

358: Steve Durbin - No Symptoms, No Family History: Why Every Man Should Get Tested

This week’s episode is unique and personal. Earlier this year, Steve announced that he had been diagnosed with stage 3 prostate cancer. Today, Steve and and Producer Tavia Gilbert sit down to talk abo...

13 Okt 52min

357: Legal Owl Podcast: Steve Durbin on AI, Geopolitics and Legal Cyber Resilience

We’re back with the second part of Steve’s appearance on John “Jock" Brocas’ podcast “Legal Owl”. Today, Steve and Jock discuss artificial intelligence, the global powers shaping the cyber landscape, ...

6 Okt 25min

357: Legal Owl Podcast: Steve Durbin on Cyber Risk in the Legal Industry

The tables turn in this episode, as Steve becomes the guest on “Legal Owl,” a podcast by John “Jock" Brocas, the executive coach whom you might remember from one of our shows earlier this year. In thi...

22 Sep 23min

356: From the archive – Communication, Listening and Being Heard

In this episode, ISF Chief Executive Steve Durbin talks with Dame Inga Beale, the former CEO of Lloyd’s of London, about the role that listening played when she became the first (and only) female CEO ...

15 Sep 27min

355: Eric O'Neill – Hackers Don't Break In, They Log In: Trust as the New Perimeter

Today, Steve is joined by former FBI agent Eric O’Neill. Eric is a cyber security expert and author, but he’s probably most well-known as the man who brought down Peter Hanssen, a Russian spy who beca...

1 Sep 31min

354: SUMMER LISTENING: Emerging Threats for 2026

Today, Steve looks toward the horizon, at the threats and challenges that enterprises and business leaders will face in 2026 and beyond. He also gives advice on how everyone, from the board to the pra...

25 Aug 28min

353: SUMMER LISTENING: Rest After Stress: The Psychology of High Performance

Today, Steve speaks with Lauren Farina, psychotherapist and founder of Invited Psychotherapy & Coaching. Lauren and Steve discuss how wellness is becoming a bigger part of the workplace and how we can...

18 Aug 26min

352: SUMMER LISTENING: Geoff White – Ransomware Is a Business and It's Competing Against You

In today’s episode, we welcome another ISF veteran: journalist Geoff White. The last time Geoff was a guest on the podcast, it was 2024 and he had just released a book about how the tech industry laun...

11 Aug 28min