Cybersecurity not part of M&A due diligence: survey

Dealmakers recognize cybersecurity as a risk but it is one that is not assessed during mergers and acquisitions.

A survey by international law firm Freshfields Bruckhaus Deringer found 90 percent of respondents think a cyber breach would reduce a deal’s value but 78 percent admitted cybersecurity is not a part of M&A due diligence.

“It’s surprising that dealmakers recognize the growing threat of cyber attacks to businesses, but generally aren’t addressing the risk during deals,” said Chris Forsyth, co-head of the firm’s cybersecurity team, in a statement. “You wouldn’t dream of buying a chemical plant without assessing environmental risk, so why would you buy a data-driven business without assessing the risks it faces around data management and cybersecurity?”

More than 200 “dealmakers” from corporations, financial services providers, investors and legal services providers responded to the survey. Sixty-three percent of respondents were from North America, with 34 percent coming from Europe, the firm said.

Fifty-one percent of those from North America versus 39 percent from Europe have noticed cybersecurity become a greater part of due diligence within the last year. More US respondents report cybersecurity audits, appointments of internal specialists and additional use of external cybersecurity specialists.

“While the environment is starting to change, there is still much more emphasis on transparency in the US than in Europe, with the SEC threatening enforcement action against companies for failure to notify cyber breaches,” added Jane Jenkins, co-head of cybersecurity and defense team for the law firm.

Cybersecurity appears to be a bigger concern among buyers than sellers. Of acquirers, 30 percent said they fear a cyber incident derailing a transactions but 81 percent of sellers are unconcerned or only slightly concerned of a similar scenario, reported Freshfields Bruckhaus Deringer.