Cybersecurity Due Diligence in 2025:

The Brutally Honest Version Buyers and Sellers Both Need to Read

The New Reality

A clean balance sheet no longer saves a deal. One unpatched Log4j instance, one forgotten admin account, or one $4 million ransomware payment you “forgot” to disclose can now wipe 15–50 % off the valuation — or kill the transaction entirely — after the LOI is signed. This is not theoretical. It happened in 68 % of mid-market technology and healthcare deals that collapsed or were renegotiated in 2024–2025.

What Actually Happens When You Skip Proper Cyber DD

Buyer discovers a material breach → immediate 20–30 % price chip (or walk-away)
R&W carrier excludes cyber → seller forced into 24-month escrow of 10–25 % of proceeds
Post-close incident within 12 months → buyer triggers full indemnity claim and reputational suicide for the seller
PE firms that ignored it once now have a blanket policy: no ISO 27001 + SOC 2 Type II + recent clean pen-test = no term sheet

The 2025 Minimum Bar (No Longer Negotiable)

If the target cannot tick all of these, you are buying a ticking bomb:

ISO 27001:2022 (or at minimum a credible 2022-transition plan completed)
SOC 2 Type II report issued in the last 12 months (Security + Confidentiality criteria)
External penetration test ≤12 months old with zero critical / ≤5 high findings remediated
EDR/XDR deployed and reporting on 100 % of endpoints and servers
MFA enforced everywhere (email, VPN, cloud consoles, RDP gateways)
Privileged access management tool (CyberArk, BeyondTrust, Delinea, etc.) or at least a working vault with no shared credentials
Immutable, offline, or air-gapped backups tested quarterly
Cyber insurance with ≥$10 M limit and explicit ransomware coverage
Incident response retainer with a reputable forensics firm (not just a plan on paper)

Red Flags That Instantly Kill Credibility

“We’re basically ISO compliant”
SOC 2 Type I only
“Our MSSP does pen-tests” (internal or by the same company that sells you the SOC service)
Crown-jewel admin accounts still shared or using 60-day password rotation
No breach disclosure in the last three years (statistically improbable for any company >$20 M revenue)
“We self-insure” for cyber risk
Backups are online and writable by the same domain admins

The 2025 Valuation Haircut Table (What the Market Actually Does)

Issue	Typical Price Adjustment
No ISO 27001 or SOC 2 Type II	5–12 %
Material breach <24 months, not disclosed	15–40 % or deal termination
No EDR/XDR	6–10 %
No MFA on remote access	4–8 %
No immutable backups	5–9 %
Cyber insurance < $5 M or none	3–7 % + escrow demand
Critical vuln >90 days old	100 % escrow until fixed

Multiple issues compound quickly. A $100 M deal missing three items routinely closes at $55–65 M — or not at all.

Seller Playbook: How to Avoid Leaving Money on the Table

Do this 12–18 months before any process:

Get ISO 27001 and SOC 2 Type II (yes, it costs $250–600 k and takes 9–14 months — worth every penny)
Run a proper external pen-test and fix everything critical/high
Deploy real EDR and PAM
Buy proper cyber insurance
Document everything in a secure data room from day one

Result: you will close 30–60 days faster and at 10–25 % higher multiple than peers who “wing it.”

Buyer Playbook: One-Page Demand List

Send this on day one of exclusivity:

Under NDA within 5 business days:

Current ISO 27001:2022 certificate
Latest SOC 2 Type II report + bridge letter
Last two pen-test executive summaries
Cyber insurance declarations page
EDR deployment screenshot (100 % coverage)
Evidence of immutable backups and latest test
Breach log for last 36 months (yes, even the small ones)

No meaningful pushback allowed. If they stall, walk.

Final Truth

Cybersecurity https://securevdr.info/secure-data-room-choosing-guide/ due diligence is no longer a “nice-to-have” box on the checklist. It is now the single biggest value driver — or destroyer — in private M&A and growth-equity deals.

Pretending otherwise in 2025 is not old-school toughness. It’s just expensive ignorance.