What is a penetration test in due diligence?

A penetration test in due diligence is a short, targeted security test of an acquisition target, commissioned by the buyer, the seller or an investor, that replaces the target's statements about its security with evidence. It covers the external attack surface, the main application, the cloud environment and, where granted, the internal network, and its findings are translated into price, warranties, indemnities and the 100-day plan.

When in the deal should the penetration test happen?

During confirmatory due diligence, after the letter of intent and exclusivity are signed and before the share purchase agreement is finalised. Choose the tester and draft the scope at LOI stage so the test starts on day one; two to three weeks is usually enough for a decision-grade result.

Who commissions the test, the buyer or the seller?

Either. Buyers commission it to confirm what they are acquiring and to inform the SPA. Sellers commission a vendor due diligence test before the process starts so findings are fixed or priced before a buyer finds them. Investors test at entry, across the portfolio, before bolt-ons and ahead of exit.

What can be tested in two to three weeks?

An external attack surface test, a grey-box test of the crown-jewel application, a cloud configuration review, a compromise indicators review and a review of prior reports, run in parallel. An internal assumed-breach test is added when the seller grants network access. The goal is the components that move the deal, not full coverage.

Is a high CVSS score a reason to walk away?

Rarely on its own. Deal risk depends on exposure, the data behind the weakness, whether it is a point finding or a systemic pattern, and the effort to fix it. Evidence of an existing compromise is the finding that most often pauses a process; a critical but quickly fixable flaw usually becomes a remediation covenant with a retest.

Can a buyer rely on the seller's existing pentest report?

Only as a map, unless the tester issues a reliance letter to the buyer. A report is addressed to the party that commissioned it, and findings fixed under sale pressure should be retested. Check the scope, the date, the tester's independence and whether retest evidence exists, then re-perform the parts that matter to the valuation.

How is the report kept confidential during the deal?

The tester signs the deal NDA directly, the report sits in a restricted and watermarked folder of the data room, and access is limited to a clean team of deal lead, counsel, the acquirer's security lead and the target's CISO. Where the parties compete, that structure keeps the exchange within merger control rules.

1 November 2026 · 10 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)

Penetration testing in M&A due diligence: what a buyer, a seller and an investor should test before the deal closes

Financial, legal and commercial due diligence are standard in every acquisition. Cyber due diligence is still too often a questionnaire. A penetration test replaces the target's statements about its security with evidence, inside the two to three weeks a confirmatory phase allows. This guide explains who commissions it, when it fits in the deal timeline, what can realistically be tested, and how to translate the findings into price, warranties and the 100-day plan.

Scope a due diligence penetration test

Why a penetration test belongs in cyber due diligence

When you acquire a company you acquire its systems, its data, its technical debt and any intruder who is already inside. Technical due diligence usually covers architecture, scalability, licences and key-person dependency. Cyber due diligence, where it exists, often rests on a questionnaire answered by the target's IT lead and a stack of policies. Both describe intentions. A penetration test describes reality: whether the customer portal can be taken over from the internet, whether the cloud environment leaks data, whether the internal network falls to one compromised laptop, and whether there are signs that someone has already done any of this.

The reasons this matters have hardened since 2018. Under the GDPR, a breach discovered after closing is the acquirer's breach to notify within 72 hours (Article 33) and the acquirer's fine to pay (Article 83). The Marriott acquisition of Starwood is the canonical case: an intrusion that began before the deal was discovered two years after closing, and the UK Information Commissioner's Office fined the acquirer in 2020. In the Verizon acquisition of Yahoo, breaches disclosed during the process led to a renegotiated price and shared liability. Under NIS2, Article 20 makes management bodies accountable for the risk-management measures of the entity they now own, and Article 21(2)(d) extends that to the supply chain the target brings with it. Warranty and indemnity insurers increasingly exclude cyber losses unless technical diligence was performed.

A due diligence penetration test is therefore not the same engagement as an annual compliance test. It is shorter, more targeted, read by lawyers and investment committees rather than engineers, and its findings are expressed in deal terms. The method is the same: a manual test by certified testers following PTES and NIST SP 800-115. The scope, the audience and the reporting differ.

Three lenses: buyer, seller and investor

Who commissions the test changes what it is for, what access exists and how the report is used.

Buy-side due diligence

The acquirer confirms what it is buying before price and share purchase agreement are fixed. The test targets the systems that carry the deal thesis: the product, the customer data, the cloud estate, the integration points. Findings feed valuation, warranties and indemnities, closing conditions and the integration plan. Access is negotiated through the seller and often limited to external testing plus a defined internal slice.

Vendor (sell-side) due diligence

The seller tests before the process starts so findings are fixed, or at least known and priced, before a buyer discovers them. A recent, independent report with retest evidence in the data room removes a negotiation chip from the buyer and shortens the confirmatory phase. Sellers who skip this hand the buyer the narrative on security at the moment the price is being discussed.

Investor and private equity

A fund tests at entry to set the baseline and the 100-day plan, across the portfolio to compare companies on one yardstick, before a bolt-on is merged into a platform company, and ahead of exit so the vendor report is clean. The test is also governance evidence toward limited partners and insurers that cyber risk is managed at portfolio level.

Timing: where the test fits in the deal

A deal moves in phases, each with a different level of access and a different use for the findings. Plan the test for the phase, not the other way round.

1. Letter of intent and exclusivity

Once the LOI is signed and exclusivity granted, the buyer has standing to request technical access. Choose the testing provider and draft the scope now, so the test starts on the first day of confirmatory diligence rather than halfway through it. Before the LOI, only passive reconnaissance on public information is appropriate, and even that should be agreed with counsel.

2. Confirmatory due diligence

The window in which the test runs: usually two to six weeks for the whole exercise, of which the penetration test occupies two to three. Access is granted by the target under a three-party authorisation (acquirer commissions, target authorises, tester performs) with the NDA extended to the tester. Testing is scheduled around the target's operations and its staff are told as little as the process allows.

3. SPA negotiation: warranties, indemnities and disclosure

Findings arrive while the share purchase agreement is drafted. Known vulnerabilities disclosed by the seller in the disclosure letter are generally carved out of the general warranties, so a report in the data room cuts both ways: it informs the buyer and protects the seller. Buyer's counsel converts material findings into specific indemnities, remediation covenants with deadlines, a closing condition where a finding is severe, or a retention held until the retest is clean.

4. Signing to closing

Critical findings are remediated by the seller under the agreed covenants, and a retest confirms them. Where merger control applies, information sharing between the parties stays restricted; results flow through the clean team, not to operational staff on either side.

5. The 100-day plan and integration

After closing, remaining findings become the first security workstream of the integration plan. The highest-risk moment is identity integration: connecting directories, single sign-on and networks turns a weakness in the acquired company into a weakness in the acquirer. A full internal test of the combined environment belongs at the end of the 100 days.

What can realistically be tested in two to three weeks

A due diligence test is scoped for decisions, not for completeness. These components are chosen because they move the deal, and most can run in parallel.

Component	Access needed	Indicative effort	What it tells the deal team
External attack surface and perimeter test	A list of domains and IP ranges; the tester discovers the rest	3 to 5 days	What an attacker sees today: exposed services, forgotten systems, credential exposure, the likely route in from outside
Crown-jewel application (grey box)	Test accounts in two or three roles, a staging or production environment	4 to 6 days	Whether the product that carries the valuation can be compromised, whether tenants can see each other's data, how mature the engineering is
Cloud configuration review	Read-only auditor access to the main cloud accounts	2 to 4 days	Identity and access hygiene, storage exposure, logging, segregation; a fast proxy for operational maturity
Internal network and Active Directory, assumed breach	A standard user account and network access, if the seller grants it	3 to 5 days	How far one compromised laptop gets: domain takeover in hours is a different company from one that contains it
Compromise indicators review	Logs, endpoint telemetry and identity audit trails	2 to 3 days	Whether the target is already breached; the single finding that changes a deal most
Review of prior reports and remediation evidence	The data room	1 to 2 days	Whether past findings were fixed or carried forward for years, and whether the testing history was real

Reading the report for deal impact: CVSS is not deal risk

A severity score tells engineers what to fix first. It does not tell an investment committee what the finding means for the transaction. Translate each material finding through five questions.

1. Exposure and exploitability

Is the weakness reachable from the internet without credentials, or does it need an insider? A medium-rated flaw on the public customer portal usually outweighs a critical one on an isolated internal test server. The report should state the realistic attack path, not only the score.

2. Data and regulatory consequence

What sits behind the finding: personal data volumes, special categories, payment data, trade secrets, contracted confidentiality? That determines GDPR exposure under Articles 33, 34 and 83, sector obligations such as PCI DSS or DORA, and the contractual liabilities the buyer inherits.

3. Point finding or systemic pattern

One injection flaw is a bug. The same class of flaw across every module, default credentials on infrastructure and no logging anywhere is a culture. The first is a remediation line item; the second is an engineering programme and a question about the team you are buying.

4. Remediation effort against the deal

Can it be fixed in days by the current team, or does it require rearchitecting a platform built on an unsupported framework? Ask the tester for effort in words: patch, configuration change, redesign, replacement. That effort, not the score, justifies a price adjustment, a specific indemnity or a retention.

5. Evidence of existing compromise

Signs of an active or historic intrusion move the conversation from vulnerability to incident. They trigger notification obligations, legal privilege questions and an incident response engagement, and they can legitimately pause a process. This is the one category where the buyer should insist on a full investigation before signing.

Red flags in cyber due diligence

Individually, each is a question for the management presentation. Together, they describe a target whose security claims should not be relied on without testing.

No penetration test in the last 12 to 18 months, or a test whose scope excluded the product that carries the valuation
A report with no retest evidence, or the same findings reappearing year after year
A report produced by the target's own IT provider or managed service partner, which has a commercial interest in a clean result
An automated vulnerability scan presented as a penetration test
Security owned by nobody in particular: no named accountable person, no funding line, no board reporting
Shared administrator accounts, no multi-factor authentication on remote access or cloud consoles, unsupported systems in production
Customer contracts that promise certifications, testing cadences or breach notification terms the target cannot evidence
A data room that contains policies and certificates but no logs, no incident register and no evidence that controls operate

Confidentiality: data room, clean team, NDA and reliance

A penetration test produces the most sensitive document in the data room: a verified list of how to break into the company. The tester is bound by the deal NDA directly, not only through the acquirer. The report sits in a restricted, watermarked folder of the virtual data room, with access limited to the clean team: the deal lead, counsel, the acquirer's security lead and the target's CISO or equivalent. Operational staff on either side do not see it until closing. Where the parties are competitors, merger control rules restrict what commercially sensitive information may be shared before clearance, and the clean team structure keeps the test compliant with them.

On reliance: a report is addressed to the party that commissioned it. A buyer reading the seller's report should not assume it may rely on it legally; either obtain a reliance letter from the tester, or treat the report as a map and re-perform the parts that matter. Sellers commissioning a vendor report should ask in advance whether reliance can be extended to a future buyer. Raw evidence, credentials observed during the test and exploit details stay with the tester and are destroyed on an agreed schedule after the process ends.

Warranties, indemnities and the post-close retest

The findings end up in three places in the share purchase agreement. General warranties state that the target complies with data protection law, has had no security incidents and has disclosed all known vulnerabilities; the report tests whether those statements are true before you rely on them. Specific indemnities cover the material findings the test did uncover, so that the cost of a breach through a known weakness sits with the seller for an agreed period. Covenants and closing conditions require remediation of critical findings before closing, with a retest as the acceptance criterion. Warranty and indemnity insurers read the report too; an independent test with retest evidence is often the difference between cyber being covered and cyber being excluded.

The retest matters as much as the test. Remediation claimed during a sale process is remediation under time pressure. A verification retest confirms that each critical and high finding is closed, that the fix did not introduce a new weakness, and that the compensating controls promised in the disclosure letter exist. After identity and network integration, a full internal test of the combined environment is the first security milestone the acquirer should own itself.

How HackersHub supports deal teams

HackersHub has performed offensive security work for over ten years from Amsterdam, Netherlands, for acquirers, sellers and investors. Due diligence engagements are led by Michael van Mameren and staffed by testers who all hold at least OSCP, with OSWE and CREST-certified members on the team. We scope to the deal: external attack surface, crown-jewel application, cloud estate and, where access is granted, the internal network, in parallel within the confirmatory window, under the deal NDA and inside the clean team structure your counsel sets.

The report is written for two readers. The investment committee receives an executive summary that expresses each material finding as exposure, data consequence, remediation effort and recommended deal mechanism. Engineers receive the CVSS-scored findings with evidence, the attack narrative and prioritised remediation. A verification retest of medium and higher findings within 90 days is included, which usually covers the signing-to-closing period. Our clients rate us 4.9/5 across 127 reviews.

Frequently asked questions

Related guides and services

Signing in a few weeks and still relying on a questionnaire?

We scope a due diligence penetration test to the confirmatory window, report in deal terms for the investment committee and in detail for the engineers, and include the retest before closing. Talk to an expert.

Scope a due diligence penetration test Talk to an expert