You Bought the Business. You Also Bought Its Security Debt.
You checked the receivables, the lease, the equipment list and the customer roster. But did anyone check the network, business accounts or security practices behind them?
When ownership changes, the new owner takes responsibility for keeping the business running, including its technology. That may mean aging computers, shared passwords, accounts still controlled by the seller, untested backups or a security incident no one has yet detected. These problems rarely appear on a disclosure statement, but they can affect customers and operations from the first day after closing.
The legal liabilities that transfer depend on the deal structure and the terms of the purchase. Your attorney can advise on that. But whatever the structure, the business’s technology and access need careful attention before they become your operational problem.
Even well-resourced deal teams miss cyber risk
Cybersecurity problems during acquisitions are not hypothetical. In FTI Consulting’s 2026 study, nearly one in four executives said their organization had experienced a cyber incident during or shortly after a transaction. Among respondents, 42% reported a significant reduction in deal value, 58% said financial targets were impaired, and 20% said a deal was delayed or paused because of a cyber incident.
FTI surveyed 100 CISOs, 78 heads of M&A and 100 general counsel at U.S. organizations with at least 500 employees. The survey was conducted online in August 2025, and most represented organizations had a market capitalization of $5 billion or more. The findings also show how easy it is for security to fall behind deal momentum: one in four CISOs said leaders pushed to close quickly rather than conduct thorough cyber due diligence. Only 23% of executives said they managed cybersecurity risks proactively after closing.
A separate Kroll survey of 325 private equity portfolio leaders, reported by Help Net Security, found that 80% of firms experienced some form of cybersecurity-related disruption during the portfolio hold period. Forty-four percent incurred unplanned costs to fix inherited cyber or IT issues. The reported average financial impact was $2.1 million. In firms with under $500 million in assets under management, 44% said cyber risk reduced valuation or exit price, compared with 17% of firms with more than $25 billion in assets.
These are surveys of large organizations and private equity firms, not measurements of small businesses in Berks and Lancaster, and not a local forecast. The relevance is the pattern: even organizations with legal teams, investment committees and security leaders can miss problems. A small-business buyer may have fewer people and processes available to find them.
Your attorney and accountant are essential to a transaction. Their diligence is focused on their areas of expertise; inspecting a network, account access and backup recovery usually calls for an IT or security review as well.
IDENTIFY: Find out what you will actually control
A seller’s assurance that “the IT works” does not answer who owns the accounts, who can sign in or whether the systems can recover after a failure. Ask for specific answers, and document what you find.
Start with the accounts that keep the business operating: email, banking, payroll, accounting, domain registration, social media, cloud storage and line-of-business software. Are they registered to the business, or tied to the seller’s personal email or phone? Who has administrator access? Will the current IT provider continue supporting the new owner, and are its service agreements transferable?
Then check the devices and data. Get an inventory of computers, servers, networking equipment and key software. Ask whether machines are being updated and supported. Find out where customer and employee information is stored, whether it is kept longer than needed, and which vendors or former employees can access it.
Backups deserve more than a “yes.” Ask what is backed up, how often, who can access the copies and when the business last tested a restore. A backup that has never been tested may not be a reliable recovery plan.
Ask the seller directly, in writing, about past security incidents, suspicious account activity, outages, data loss and insurance claims. Also ask which software licenses transfer with the business and which require new agreements. If an answer is unclear, treat it as an open diligence item, not proof that the issue does not exist.
QUANTIFY: Turn findings into deal terms
A technology issue matters to the transaction when it can create expense, delay or lost business. Estimate what a week of downtime would mean for payroll, revenue, customer commitments and the handover period, when customers may be least patient with disruption.
Then compare the likely cost of addressing the gaps before closing with the cost of discovering them later. A system that appears to work may need a major upgrade or rebuild before it can be safely integrated with your own operations. Kroll’s finding that 44% of surveyed firms faced unplanned costs to fix inherited cyber or IT issues illustrates why those costs belong in the diligence discussion.
If the review identifies significant gaps, discuss the findings with your deal team before signing. Depending on the situation, they may affect price, an escrow or holdback, seller-funded remediation, or a seller-responsibility provision. Ask your attorney what representations, warranties or other agreement terms are appropriate. The aim is to make risks visible in the deal, not silently absorb them after closing.
MITIGATE: Make the handover a security checkpoint
A smaller buyer may not have a deal-team CISO. That does not mean the review has to be skipped. Consider bringing in an independent IT or security advisor for a pre-close walkthrough. The scope can be practical and limited: confirm who controls the systems, identify urgent issues, and outline what should happen on day one. Compared with a six-figure purchase, it is a modest step toward making an informed decision.
Before closing, agree with the seller on a controlled handover. At closing, reset shared or known credentials and transfer administrative control of email, banking, domains and business software. Remove access for the seller and departed employees where it is no longer needed, and enable multi-factor authentication on important accounts.
Do not automatically connect the acquired business’s network to your existing network on day one. Assess it first, or keep the environments separate until you understand what is there. Take an inventory of devices and updates, and identify any equipment that needs attention. Confirm that the backup can be restored while the seller or the existing IT provider is still available to explain how the systems work.
Get written responses about incident history and keep the records with the transaction documents. If you want cybersecurity representations or other protections in the purchase agreement, raise that with your lawyer; contract language is a legal matter, not an IT recommendation.
MONITOR: Give the first 90 days a plan
Treat the acquired environment as unfamiliar until you have observed it and confirmed how it operates. Pay attention to unusual account sign-ins, new devices, unexpected changes to email forwarding and access that remains active after staff leave.
Keep a running inventory of devices, accounts, software licenses and vendors as you discover them. Put a 90-day review on the calendar to revisit access, updates, backups and unresolved issues. This is not just an acquisition checklist: maintaining the inventory and reviewing it regularly helps the business manage technology risk after the transaction, too.
A thoughtful first 90 days also gives you time to prioritize. Address issues that could interrupt operations or expose sensitive information first. Then work through longer-term improvements in a deliberate order, rather than changing every system at once.
Find the problems while there is still time to act
Kroll found that 44% of surveyed private equity firms incurred unplanned costs to fix inherited cyber or IT issues. Its data does not say that 44% of smaller businesses in Berks and Lancaster will face those costs. It does show how often inherited issues can become a budget problem for organizations involved in acquisitions.
For a buyer, the difference between finding a gap during diligence and discovering it in month two may begin with a few direct questions: Who controls the accounts? Are backups recoverable? What security issues are already known? The answers can help you plan, negotiate and protect continuity for customers and employees.
For more practical guidance, visit B&R Computers’ business resources or join the Thursday General Cyber Briefing. If you are planning a purchase, sale or ownership transition, schedule a Business Review or Strategy Session to discuss the technology risks and next steps for your business.