4. May 2026

Cyber Security resilience a key component of M&A 

Cyber Security resilience a key component of M&A 

Cyber Security ensures business resilience

Due Diligence is required to ensure the successful sale of any business. The extent and focus of the work is determined by the buyer and typically be determined by an evaluation of risks versus the cost of the work. 

Routine areas for any diligence exercise include; financial performance, market opportunities, competitive landscape and legal matters generally including legal claims, contract reviews and employment terms.

But increasingly the importance of businesses Cyber Security resilience is a key component of any Due Diligence evaluation. Naturally as a business leader Cyber Security is essential for day-to-day business, it’s a cost of doing business.  But it’s an increasing focus for exit preparation if a sale is contemplated. 

Furthermore, importance is escalated in higher risk markets such as healthcare, financial services, legal, critical infrastructure and any market where customer sensitive data is held.

Authority Support & Penalty

In the UK the authorities are helpful through the National Cyber Security Centre where guidance, resources and training materials are available. Their website is easily accessed.

In 2025 there were well publicised hacks at JLR and Marks & Spencer. The consequences were financially dramatic for the businesses involved, highly stressful for the employees, consequential for the supply chain, and reputationally very damaging. Business valuations were also hit.  

Over recent years hacks of NHS systems have sadly felt all too frequent disrupting hospitals and putting patient data at risk. The healthcare sector is especially high risk.

Insurance can help alleviate some of cost but insurers increasingly will demand higher premiums as risk increases. A robust environment is therefore vital to satisfy insurers too. 

Appropriately the authorities have a regime to penalise businesses that transgress in this area. The requirements of UK GDPR rules and the Data Protection Act 2018 are wide ranging. There can be material fines where personal data is unsecured. 

Technology does not standstill 

We live in a world where technology advances are inspiring driven with the evolution of Ai. But also, Ai is being used by bad actors that utilise its capabilities to circumvent weaknesses in Cyber Security resilience. Thus, what might have been fit yesterday is not today.

This is an evolving field and being aware of the developments is critical for all businesses today. Regular reviews of Cyber Security resilience are essential. Increasingly this is a standing agenda item for all boards and shareholders. 

Expertise & Accountability are not options

I am finding that having expertise in this space is a growing requirement. Access to Chief Technology Officer capability is not an option, it’s being demanded by Business Leaders, Founders, Boards & Shareholders to protect their businesses.