What is cyber due diligence in M&A?

Cyber due diligence assesses what security risk you are buying along with the business. It matters because liability transfers. An undisclosed breach, exposed credentials, unpatched internet-facing systems, or non-compliance with a regime the target is subject to all become your problem at close. Remediation and notification costs land on the acquirer, and in some cases so do regulatory penalties for conduct that predates the sale. On large transactions this is standard and specialist firms handle it. On lower-middle-market deals it is routinely skipped, because a traditional engagement costs in the region of $50,000 and takes weeks, which does not fit either the budget or the LOI timeline. That gap is the reason SERAPH exists.