The Hidden Liabilities in the Data Room: Cyber Diligence for UK Dealmakers

Acquisitions rarely fail because the target has no antivirus. They fail because the buyer inherits an identity estate nobody fully understood, a supplier contract with weak breach notification, or a recovery plan that has been tested on paper only. In 2026, cyber due diligence for UK dealmakers needs to move from questionnaire completion to evidence-based challenge.

Where cyber risk hides in a target

Legacy identity systems. Directory services, single sign-on and privileged access management are often the oldest parts of a target's estate. Acquiring a business with unmanaged service accounts, incomplete multi-factor authentication or unsupported authentication protocols can undo years of security investment. The diligence question is not whether identity tools exist. It is whether privileged access is inventoried, reviewed and recoverable.

Unreported incidents. Not every incident reaches the board or the regulator. Some sit in ticket queues, email threads or the memory of a departing engineer. A target may have suffered a ransomware event, a business email compromise or a supplier breach that was contained but never formally reviewed. Buyers should ask for incident registers, near-miss logs and evidence that root causes were closed.

Supplier contracts. Third-party agreements often contain security schedules that look adequate until tested. Notification windows may be too long, audit rights may be absent, and concentration risk may be hidden across a supplier group. For UK acquirers, change-of-control clauses are particularly important. A contract that terminates on acquisition can turn a security issue into a commercial one.

Weak recovery evidence. A target may have backups. That does not mean it can restore. Diligence should ask for restore test reports for tier-one services, evidence of immutable backup configuration and a realistic recovery time objective. A plan that has never been exercised is a hypothesis, not a control.

Insurance and warranties. Cyber insurance is not a substitute for diligence, but it is part of the risk picture. Buyers should review policy scope, limits, exclusions, claims history and notification conditions. Change-of-control provisions may affect cover after completion. Warranty and indemnity insurance may help allocate risk, but it does not repair an insecure identity system.

Requesting proof without derailing the deal

Diligence should be proportionate and staged. Start with a focused request list, not a 300-line questionnaire. Use a clean team where sensitive incident data is involved. Ask for artefacts rather than narratives: redacted incident reports, restore test summaries, ICO correspondence, insurance schedules, supplier security schedules and board risk acceptances.

Sample intelligently. You do not need every ticket; you need enough evidence to test whether the target's account of its controls is credible. Management presentations are useful for context, but they should not replace documentation. Where a red flag emerges, escalate to a specialist review rather than widening the entire request set.

Ten-point diligence checklist

1. Incident history and near misses. Obtain the register, classification method and evidence of root-cause closure.
2. Identity and privileged access. Review service accounts, MFA coverage, legacy protocols, joiner and leaver processes, and administrator reviews.
3. Recovery evidence. Ask for restore test reports for critical services, backup immutability and recovery time objectives.
4. Supplier and contract exposure. Check security schedules, breach notification periods, audit rights, subcontractors and change-of-control clauses.
5. Regulatory correspondence. Review UK GDPR breach notifications, ICO enquiries and sector regulator correspondence.
6. Insurance position. Confirm policy scope, limits, exclusions, claims history and post-completion cover.
7. Vulnerability and architecture debt. Identify internet-facing assets, unsupported systems, patch exceptions and known material weaknesses.
8. Data mapping and retention. Confirm where special category data sits, cross-border transfers, retention practice and shadow AI use.
9. Governance evidence. Review board minutes, risk acceptances, CISO mandate and security budget decisions.
10. Integration and remediation funding. Cost the first 100 days, identify owner accountability and agree warranty or escrow protections.

Aligning with UK regulatory expectations

UK acquirers should map diligence findings to the target's regulatory context. UK GDPR notification duties, FCA and PRA operational resilience expectations, and sector-specific rules all affect how quickly a breach becomes a supervisory issue. For some targets, the National Security and Investment Act may also be relevant. Diligence should show whether the target can meet those obligations after completion, not just whether it has a policy that references them.

From diligence to deal protection

The output of cyber diligence should be a short list of material findings, each with a consequence, a likelihood, a remediation cost and a proposed deal protection. Warranties, indemnities, retention and escrow can allocate risk. They cannot substitute for understanding it. The buyer who asks for evidence before completion is better placed to fund remediation, renegotiate price or walk away. In 2026, buying a breach is avoidable only if the data room is read with the same discipline as the financial statements.