ISF Podcast17 Jun 2025

S35 Ep3: The Silent Risk in M&A: Cyber Security Oversights That Cost Millions

Financial due diligence is common practice when companies merge or one business acquires another. Cyber security due diligence, however, is not quite as common. Yet, in a world where the threat landscape changes by the day and risk is growing increasingly complex, solid cyber security practices are more important than ever.

Today, Steve and Tavia dig into this very topic, and, more specifically, what role cyber security has in a merger or an acquisition. How is a cyber security review done? Why are they important? How do we balance speed with thoroughness? How do we interpret the results? There’s a lot to dig into here.

Key Takeaways:

Cyber due diligence is paramount in a corporate acquisition or merger.
Risks of not doing cyber due diligence include both financial and reputational.
Cyber due diligence is a team game.

Tune in to hear more about:

Who should be responsible for conducting the cyber review (4:34)
How organizations can build cyber into their due diligence process (14:05)
Examples of where insufficient cyber due diligence proved costly (19:05)

Standout Quotes:

“You can't play a team sport without a team. And for me, M&A is a team game. You can't go it alone. I think it would be a mistake for somebody to think that they could do this kind of work solo. Because as we've seen with cyber maturing, it now touches so many different parts of the organization. You do need to be involved.” - Steve Durbin
“I think people are getting it. What I'm seeing now is people get it, but they don't know how to do it. That's where the cyber professional really now has to step up.” - Steve Durbin
“Pre-deal, I think it is about being focused. It's about identifying, prioritizing the high risk areas that are out there that you want to look into. It's about doing things like making sure that the governance is there. It's about scanning for some of the known vulnerabilities. If you are in one particular market sector and you're buying a company in another because of expansion growth, you're going to need to be covering off a whole range of different things that perhaps might be unusual for you because you haven't been having to look into those areas.” - Steve Durbin

Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(353)

353: SUMMER LISTENING: Rest After Stress: The Psychology of High Performance

Today, Steve speaks with Lauren Farina, psychotherapist and founder of Invited Psychotherapy & Coaching. Lauren and Steve discuss how wellness is becoming a bigger part of the workplace and how we can...

18 Aug 26min

352: SUMMER LISTENING: Geoff White – Ransomware Is a Business and It's Competing Against You

In today’s episode, we welcome another ISF veteran: journalist Geoff White. The last time Geoff was a guest on the podcast, it was 2024 and he had just released a book about how the tech industry laun...

11 Aug 28min

351: SUMMER LISTENING: Steve Durbin – How Quantum and Geopolitics Are Redefining Resilience

Today, Steve returns to Business Matters with Juliette Foster. In this conversation, Steve recaps 2025 in cyber and shares what he sees as the biggest risks heading into 2026. The two also discuss res...

4 Aug 27min

350: SUMMER LISTENING: Alex Bovee – Identity in the Age of Agentic AI

In this episode, Steve speaks with Alex Bovee, co-founder and CEO of C1, a technology company focused on identity security online. Steve and Alex discuss why identity still often is an afterthought wh...

28 Jul 23min

349: Steve Durbin – When Governments Shift: Reimagining UK Cyber Strategy and Business Resilience

Today, Steve returns to Business Matters with Juliette Foster. The United Kingdom has a new Prime Minister: Andy Burnham, and Steve speaks with Juliette from a cyber and business perspective about wha...

21 Jul 29min

348: Geoff White – Ransomware Is a Business and It's Competing Against You

7 Jul 28min

347: Alex Bovee – Identity in the Age of Agentic AI

30 Jun 23min

346: James Wilkson - The Human Factor: Leadership, Risk and the AI Era

Today, Steve speaks with James Wilkson, managing partner at AEC Global Search Consultants, an executive search and advisory firm. James and Steve discuss why today’s leaders must be flexible and emoti...

23 Jun 21min