When you acquire a company, you inherit everything about its security — its architecture and its technical debt, its exposed credentials, and any breach it hasn't yet discovered or disclosed. Traditional financial and legal due diligence rarely surfaces that risk. A focused security assessment does.
Why it matters
In one widely reported acquisition, the discovery of undisclosed data breaches reduced the final purchase price by roughly $350 million. Cyber risk is deal risk — and it is far cheaper to find before the papers are signed than after.
Rarefied performs technical security due diligence on acquisition targets on behalf of the acquirer. We independently validate the target's security posture, quantify the risk you would be taking on, and translate what we find into terms both your deal team and your engineers can act on.
What we assess
Every engagement is scoped to the deal, but a typical assessment covers:
- External attack surface. Everything an attacker can reach without inside access — exposed services, forgotten infrastructure, and misconfigurations across the target's internet-facing footprint.
- Applications & APIs. The web applications, APIs, and mobile apps that carry the target's revenue and its customers' data.
- Cloud & infrastructure. Configuration of the cloud accounts and infrastructure the business runs on, including identity, access, and the exposure of sensitive data stores.
- Internal network. Where access is granted, how far an attacker who gains a foothold could move — lateral movement, privilege escalation, and domain compromise.
- Secrets & credential exposure. Leaked keys, tokens, and credentials in code, repositories, and public sources that could hand an attacker the keys directly.
- Security program maturity. Practical signals of how the target actually operates — patching cadence, MFA coverage, logging, and incident-response readiness.
Red flags that change a deal
What we look for
Evidence of prior or ongoing compromise, exposed secrets and credentials, unpatched critical vulnerabilities on internet-facing systems, and the absence of basic controls like MFA and logging. Any one of these can materially affect valuation, deal terms, or the decision to proceed at all.
How it works
We are used to working quietly and quickly, on a deal team's timeline. Early, non-intrusive external reconnaissance can often begin with little or no involvement from the target — useful before a deal is public or a letter of intent is signed. Once data-room or environment access is available, we go deeper. Every engagement runs under a strict NDA, and follows the same four-phase methodology we apply across all of our work.
The deliverable
You receive a due-diligence report written for two audiences at once: a concise, business-framed summary for the deal team — risk-rated, with estimated remediation effort — and the full technical detail your engineers need to act on. Where issues exist, we outline what it will take to fix them, so remediation cost can be weighed in the negotiation.
After the deal closes
Diligence is only the beginning. We help integration teams re-test the environment post-close, confirm that pre-close findings have been remediated, and fold the acquired systems into a single, consistent security standard.