Most founders only bring IT and cyber into the exit conversation once the data room is open and the buyer’s advisers have started asking questions. By then, most of the useful work is already too late to do properly.
IT due diligence rarely kills a deal outright. What it does, far more often, is quietly reduce the price, add conditions, or generate warranties the seller has to carry for years afterward. Research from West Monroe’s M&A cybersecurity study found that 40% of acquirers discovered cybersecurity problems only after the deal had already closed, and 80% now rate cybersecurity as highly important to due diligence, up from a smaller share just two years earlier.
Tellingly, most of those buyers said they rarely walk away over what they find. Instead, 47% use it to plan post-deal remediation, a third use it to decide whether to proceed at all, and a fifth use it purely to negotiate better terms. The issues do not stop deals. They cost sellers money and leverage.
None of this is exotic. It is the same territory a fractional IT director would already have under control if one had been in place. A buyer’s technical advisers will look at several things in sequence, and each has its own way of quietly eroding value:
Infrastructure age and resilience. Ageing servers, unsupported operating systems, no tested backup or disaster recovery plan. RSM’s private equity practice has documented cases where a decades-old, custom-built system was found, post-close, to be incapable of supporting integration with the acquirer’s platform, running remediation costs into the tens of millions. Most SME findings are smaller than that, but the pattern, a technology estate that has quietly aged past the point of being fit for purpose, is common.
Licence compliance. Under-licensed software, expired agreements, unclear ownership of custom-built systems. A software audit during diligence that turns up a compliance gap becomes a true-up cost the seller usually ends up funding, either through a reduced price or a specific warranty.
Cyber posture. Patch management, access control, whether Cyber Essentials or an equivalent is in place, and whether there has been an incident that was never formally logged. This is the category buyers now treat as standard rather than optional, and it is also the one most likely to surface a nasty surprise, since many SMEs simply do not know what they do not know here.
Supplier contracts and change of control. Key supplier and customer contracts often contain change of control clauses that trigger renegotiation, or worse, termination rights, the moment ownership changes. A contract that looks fine on day one of ownership can unravel on day one of new ownership.
GDPR and data handling. Where personal data actually lives, who can access it, and whether the paperwork matches the practice. Gaps here tend to be structural rather than dramatic: no data processing register, informal sharing arrangements with suppliers, retention that nobody has reviewed in years.
Key-person dependency. How much of the IT picture exists only in one person’s head. This is the finding that unsettles buyers most, because it cannot be fixed with a purchase order. It has to be documented and handed over, and that takes time the exclusivity period rarely allows.
The businesses that come through diligence cleanly are usually the ones where someone independent has been asking these questions for a year or two beforehand, not the ones scrambling to produce an asset register the week the data room opens.
Grant Thornton’s own exit readiness work lists IT explicitly as one of the enabling functions boards need to have in order well before a transaction starts, alongside financials and governance, precisely because issues in these areas “can surface late in the process when time is limited.” And when they do surface late, they surface as leverage against the seller, not the buyer. Roughly one in seven warranty and indemnity insurance policies ends up seeing a claim, and every claim is a reminder that whatever was not caught and fixed before signing gets carried as risk afterward, by someone.
If a sale is somewhere in your next two or three years, even as a loose ambition rather than a firm plan, the IT and cyber picture is worth an honest look now. Fixing a gap eighteen months out is a project. Fixing it during exclusivity is a negotiating point, and it will not be in your favour.
A short, independent review now costs far less than a renegotiated price later. Get in touch and I’ll give you a straight, no-obligation read on where you actually stand.