Cyber Due Diligence in M&A: Hidden IT Risks in Vendor Portfolios

Introduction

Mergers and acquisitions (M&A) are back in full force in 2025, driven by the demand for digital transformation, market consolidation, and competitive agility. But in many boardrooms, an unseen risk quietly rides along with the deal: cyber exposure hidden deep in vendor portfolios. While financial, legal, and operational due diligence are standard practice, IT and cybersecurity due diligence often remain an afterthought — until a breach, regulatory fine, or operational breakdown exposes the true cost of oversight.

The M&A Landscape in 2025: Complex, Digital, and Risk-Laden

The nature of M&A deals has evolved. Modern acquisitions frequently include companies built on intricate SaaS ecosystems, third-party APIs, outsourced DevOps, and AI-powered services. As firms acquire digital-native targets, the IT risk surface they absorb expands exponentially.

According to PwC, integrating cybersecurity into M&A strategies is essential for protecting organizations and unlocking value. Their insights emphasize that over 60% of recent deals involved digital-native firms with complex third-party software stacks—many of which lack formal oversight or complete documentation.

What makes the landscape more precarious is the rise of:

• Decentralized IT: Business units deploying their own tools without centralized approval
• AI-assisted operations: Black-box decision engines, often created by third-party vendors, with no explainability
• Rapid cloud migrations: Targets using multi-cloud environments with fragmented controls

In such environments, the acquiring company inherits not just code and contracts—but every latent vulnerability.

What Traditional Due Diligence Misses: IT and Vendor Blind Spots

Legal teams may review intellectual property rights. Finance teams audit statements. But who inspects whether a target's marketing software has hardcoded credentials, or if an AI chatbot is leaking sensitive data through flawed prompts? These gaps can result in devastating post-acquisition surprises.

Some of the common blind spots in traditional due diligence include:

• Unreviewed third-party contracts: SaaS agreements with poor SLAs, lacking termination clauses or breach reporting obligations
• Overlooked ITGCs: Missing or ineffective IT general controls (especially in SOC 2 audits) tied to revenue systems
• Unknown sub-vendors: Fourth-party risks stemming from outsourced partners your vendor never disclosed

These issues are compounded when acquiring firms assume cyber risks are “minor technical issues.” In reality, they can become material legal and reputational liabilities. A 2023 case involved a fintech firm acquiring a startup whose backend vendor used outdated encryption protocols. Six months later, a breach exposed 1.2 million user records. The acquirer ended up settling with regulators for $7.5 million and faced significant brand damage.

Hidden Risks Lurking in Vendor Portfolios

Let’s break down some of the most critical hidden IT risks embedded within vendor portfolios that are frequently missed in M&A assessments:

• Shadow SaaS: Unsanctioned applications used by departments that bypass procurement — often without security reviews. This was discussed in depth in Shadow SaaS Risk Management.
• Dormant Access Credentials: Former employees or contractors retaining admin access to critical systems post-termination.
• Unsecured APIs: Third-party APIs lacking authentication, rate-limiting, or logging mechanisms — a common issue in fast-scaling start-ups.
• Orphaned integrations: Systems that still rely on outdated plug-ins or libraries that are no longer supported by the vendor.
• AI hallucination and prompt injection risks: Acquired vendor chatbots or co-pilots may be vulnerable to exploitation or data leakage — covered in AI Vendor Risk Management.

These are not theoretical risks. Each one can serve as a point of compromise, operational failure, or regulatory penalty.

How to Evolve Cyber Due Diligence Practices

Cyber due diligence in 2025 must go far beyond penetration tests or vendor questionnaires. It requires a holistic, layered assessment that aligns with IT risk frameworks and M&A objectives. A modernized due diligence program should include:

• Third-Party Risk Audits: Leverage frameworks such as NIST 800-161 or ISO 27036 to assess vendor governance maturity
• Automated SaaS Discovery Tools: Use tools like Zscaler or Palo Alto’s SaaS Security to inventory all apps in use by the target
• Attack Surface Mapping: Red team or purple team simulations can help map external exposures that may not show in reports
• Data Flow Visualization: Understand how customer and regulated data flows through vendors — and where it exits jurisdictions
• Contract Intelligence Platforms: AI tools like Kira or Evisort can scan legacy vendor agreements for hidden risks, poor indemnification terms, and regulatory gaps

Companies should also align cyber due diligence with vendor risk management strategies already in place. Integration post-acquisition is just as important as assessment pre-deal.

Case Example: The Unseen Breach

In early 2024, a U.S. logistics firm acquired a mid-sized analytics company to enhance its supply chain optimization capabilities. The target had impressive revenue, clean books, and solid customer reviews. However, it also relied on an unvetted third-party LLM analytics engine embedded in its SaaS dashboard.

Three months after the acquisition closed, a researcher discovered that the LLM module was logging client queries — including sensitive shipment data — and storing them in an unsecured bucket managed by the vendor's vendor. The breach affected multiple multinational clients and triggered GDPR and CCPA investigations.

The acquiring company had to issue a public apology, halt its product rollout, and rearchitect the system — costing over $12 million in remediation and lost business. Worse, internal audits later showed that the risk was visible but never escalated during diligence because “AI modules were out of scope.”

Conclusion: Rethinking Risk in the Age of Converged Ecosystems

Cyber due diligence is no longer just an IT checkbox — it’s a board-level imperative. With vendor ecosystems becoming more opaque, AI more embedded, and SaaS stacks more sprawling, traditional M&A practices must evolve.

To truly protect deal value and avoid post-close surprises, acquirers must:

• Integrate cyber, vendor, and IT risk experts early in deal planning
• Use automated tooling to surface hidden risks in vendor portfolios
• Ensure that AI modules, SaaS apps, and integration points are fully assessed
• Embed vendor governance and risk frameworks into post-merger integration

The cost of inaction is high — and in the era of converged ecosystems, your weakest vendor link may become your biggest acquisition regret.