Key takeaways
- Buyers routinely engage a third-party cybersecurity firm during diligence, your security posture will be assessed, not self-reported.
- SOC 2 Type I takes 2–3 months and costs $15K–$40K; SOC 2 Type II takes 6–12 months and costs $30K–$80K, start before the process starts.
- Basic cyber hygiene for a $15M–$75M business means MFA everywhere, documented incident response, endpoint protection, and an access review, not enterprise security infrastructure.
In this article
- Why cybersecurity diligence is now standard
- What buyers assess: the seven cybersecurity diligence areas
- Incident history: what buyers want to know
- Basic cyber hygiene for a $15M–$75M business
- SOC 2: timeline, cost, and when it matters
- The insurance angle: buyers increasingly require cyber coverage
- Regulatory gap checklist: what applies to your business
- Remediation cost estimation: what pre-sale cybersecurity readiness costs
- What buyers test in cybersecurity diligence, and how to prepare
- Common cybersecurity diligence mistakes
Why cybersecurity diligence is now standard
Cybersecurity was once a diligence category reserved for technology companies and regulated industries. That is no longer true. Buyers across every sector now conduct at least a basic cybersecurity assessment in transactions above $10M, and in many transactions above $5M. The reason is cost: a post-close breach that traces to pre-close security posture is expensive to remediate and creates significant post-close liability.
The cybersecurity diligence workstream typically involves a third-party security firm engaged by the buyer, not the seller. That firm is not working from your self-assessment. They are reviewing your actual environment: access logs, MFA enrollment data, endpoint protection coverage, vendor questionnaire responses, and any prior audit findings.
The average cost of a data breach for companies under $1B in revenue is $3.31M. For companies in the lower middle market ($10M–$75M revenue), the average breach cost represents 8–15% of annual revenue, a figure that buyers price into their risk model.
Buyers are not asking whether you have been breached. They are asking whether you have the controls in place to detect, contain, and respond to a breach. "We've never been hacked" answers the first question, not the second. The absence of a known breach does not indicate a strong security posture. It may indicate that a breach occurred and was not detected.
What buyers assess: the seven cybersecurity diligence areas
A cybersecurity diligence review in the middle market covers seven areas. The depth of review depends on the buyer's risk appetite, the industry, and the transaction size.
Cybersecurity Diligence Coverage Framework
$3.31M
average cost of a data breach for companies under $1B in revenue (IBM 2024)
8–15%
typical breach cost as a percentage of annual revenue for lower middle market companies
52%
of middle market businesses do not have a documented incident response plan (Ponemon Institute)
Incident history: what buyers want to know
Every buyer's security questionnaire will ask about incident history. The question is not just "have you been breached?", and it is "how did you find out, what did you do, and what did you change as a result?"
The worst answer is a denial followed by the discovery of an undisclosed incident. Buyers engage security firms who can often find evidence of past incidents through log analysis, dark web monitoring, and breach database checks. If a breach is discoverable and was not disclosed, the seller has a much larger problem than a security gap.
The right approach: before the process starts, conduct an internal incident history review. Identify any security events, ransomware, phishing compromises, unauthorized access, data exfiltration, regardless of whether they were reported externally. Document how each was handled. If incidents were not documented at the time, reconstruct the record from email and system logs.
Illustrative example, a $28M professional services firm disclosed two prior phishing incidents that had been resolved internally. The buyer's security firm reviewed the remediation steps and concluded they were adequate. The incidents were noted but did not affect purchase price. A third firm in the same process disclosed nothing, and the buyer's security firm identified a prior ransomware event through log analysis, the deal restructured with a $500K security remediation escrow.
Companies with a documented incident response plan contain breaches 74 days faster on average than companies without one, and the average cost difference is $1.49M per incident. Buyers know this data and price the absence of an IR plan accordingly.
Working through this yourself?
Kolton works directly with founders on M&A readiness, deal structure, and AI implementation — one advisor, not a team of generalists.
Schedule a conversation →Basic cyber hygiene for a $15M–$75M business
A $15M–$75M business does not need enterprise security infrastructure. It needs the foundational controls that prevent the most common attack vectors and demonstrate a minimum standard of care to diligence reviewers.
Step 1: MFA everywhere, enforce multi-factor authentication on email (Microsoft 365, Google Workspace), cloud systems (ERP, CRM, banking), VPN, and any system accessible from the internet
Step 2: Endpoint protection, deploy an EDR tool (CrowdStrike Falcon Go, SentinelOne, or Microsoft Defender for Business) on every company-owned device; document coverage rate
Step 3: Access review, quarterly review of who has access to what; immediately revoke access for terminated employees; eliminate shared credentials on critical systems
Step 4: Documented incident response plan, a 2-page document covering: who to call, what to do in the first 24 hours, when to notify customers and regulators, and how to preserve evidence
Step 5: Backup and recovery, documented backup schedule; tested recovery process (test at least annually); off-site or cloud backup for critical systems
Step 6: Vendor security review, simple questionnaire for vendors with access to company data; retain responses on file
The cost of implementing these controls for a company that has not done so: typically $15,000–$40,000 in tools, services, and internal time. The cost of a breach that exploits gaps in any one of these areas: typically $500,000–$3,000,000. The cost of a purchase price adjustment for documented cybersecurity gaps: typically $150,000–$750,000.
MFA enforcement is the single highest-leverage security control for a middle market business. It prevents an estimated 99% of automated credential attacks and significantly reduces the blast radius of phishing compromises. If you implement nothing else before a sale process, enforce MFA on every system with internet access. The cost is effectively zero if you are already using Microsoft 365 or Google Workspace, and it is a configuration change, not a purchase.
SOC 2: timeline, cost, and when it matters
SOC 2 is a security certification framework developed by the AICPA. It audits a company's controls across five trust service categories: security, availability, processing integrity, confidentiality, and privacy. In the middle market, the security category is the primary focus for most companies.
SOC 2 has two types: Type I is a point-in-time assessment, an auditor reviews whether your controls are designed correctly. Type II is a period-of-time assessment, an auditor reviews whether your controls operated effectively over a 6–12 month period.
SOC 2 Type I vs. Type II Comparison
SOC 2 matters in a sale process for three reasons: some buyers require it as a condition of close; some customers require it before signing contracts (which means your growth pipeline depends on it); and the presence of a SOC 2 report demonstrates that security governance is systematic rather than ad hoc.
The insurance angle: buyers increasingly require cyber coverage
Cyber insurance is increasingly a closing condition or a representation and warranty in middle market transactions. Buyers want assurance that the seller maintained cyber coverage through close, and that the policy is transferable or replaceable post-close.
What buyers look for in a cyber policy: minimum coverage limits (typically $1M–$5M for a $15M–$75M business), coverage for both first-party costs (breach response, forensics, notification) and third-party liability (customer claims, regulatory fines), and no material coverage gaps that the buyer would inherit as an uninsured risk.
The underwriting process for cyber insurance now includes a security questionnaire that covers MFA enforcement, backup practices, incident history, and endpoint protection. Companies that score poorly on the questionnaire face higher premiums or coverage limitations. Companies that have implemented the basic hygiene controls described above typically qualify for standard coverage at standard rates.
$8K–$25K
typical annual premium for a $2M–$5M cyber insurance policy for a $15M–$75M business
$1M–$5M
typical minimum cyber coverage limit expected by buyers in middle market transactions
6–8 weeks
typical underwriting timeline for cyber insurance, start before the process starts
Regulatory gap checklist: what applies to your business
Before you can address compliance gaps, you need to know which regulations apply. Many middle market businesses assume compliance is only relevant for regulated industries, and that assumption is frequently wrong.
Regulatory Compliance Applicability Checklist
Scroll to see more →
If you are unsure whether a regulation applies to your business, the answer is almost always: get a legal opinion before the process starts, not during it. A $2,000–$5,000 regulatory applicability review from a privacy attorney is the cheapest way to know what you are facing. Discovering a HIPAA gap or a CCPA non-compliance issue during buyer diligence is significantly more expensive.
Remediation cost estimation: what pre-sale cybersecurity readiness costs
Understanding the cost to remediate specific gaps before a sale process is critical for two reasons: it lets you prioritize which gaps are worth fixing before process (high buyer impact, low remediation cost) versus disclosing and pricing into the deal (low buyer impact or high remediation cost), and it informs how you present cybersecurity status in the data room.
Pre-Sale Cybersecurity Remediation Cost Estimates
Scroll to see more →
$50K–$175K
typical total pre-sale cybersecurity readiness investment for a mid-market business addressing all major gaps
$150K–$500K
typical purchase price adjustment when gaps are discovered by buyer during diligence rather than remediated pre-process
5x–15x
typical return on pre-sale cybersecurity investment in prevented purchase price adjustments
What buyers test in cybersecurity diligence, and how to prepare
Knowing exactly what the buyer's security firm will look for allows you to prepare specifically, rather than generically. The following are the most commonly tested items in middle market cybersecurity diligence.
What Buyers Test in Cybersecurity Diligence
Prepare a one-page cybersecurity posture summary for the data room. It should cover: (1) MFA enforcement rate across all systems; (2) endpoint protection coverage rate; (3) last pen test date and critical finding remediation status; (4) incident history (if clean, state explicitly — "no material security incidents in the past 3 years"); (5) SOC 2 status or planned timeline; (6) cyber insurance coverage limits and renewal date. This converts a potentially open-ended diligence workstream into a documented, answerable set of questions.
Common cybersecurity diligence mistakes
"We've never been hacked" as a security posture. Absence of a known breach does not indicate a strong security posture, and it indicates no known breach. Buyers assume the difference and price accordingly.
No MFA on email. Email compromise is the #1 attack vector for middle market businesses. No MFA on Microsoft 365 or Google Workspace is the single most frequently flagged gap in middle market cybersecurity diligence. It is also the easiest to fix, a 30-minute configuration change.
Shared admin credentials. Multiple people sharing a single admin password on critical systems creates attribution problems, access control gaps, and audit log failures. Each admin account should be individual, and admin access should be limited to those who need it.
No documented incident response plan. A 2-page IR plan is not bureaucracy, and it is a diligence deliverable. Its absence signals to buyers that security is reactive rather than governed.
Terminated employees with active accounts. Access review is not a one-time exercise. If your offboarding process does not include a same-day account deactivation step, you have active accounts belonging to people who no longer work for you. This is one of the first things a security reviewer will check.
74% of breaches involve a human element, phishing, use of stolen credentials, social engineering, or error. All four of these vectors are addressed by basic hygiene controls: MFA, access management, security awareness training, and endpoint protection. These are not advanced security measures, and they are the floor.
A cybersecurity readiness review 12 months before a sale process costs $15,000–$30,000. It identifies the specific gaps a buyer will find, prioritizes the fixes, and gives you time to implement controls and demonstrate they are operating. That $15,000–$30,000 investment routinely prevents $150,000–$500,000 in purchase price adjustments, a 5x–15x return on a single preparation step.
Frequently asked questions
What if we cannot get SOC 2 done before process?
A SOC 2 readiness assessment, a gap analysis against the SOC 2 framework, costs $10K–$20K and can be completed in 4–6 weeks. It tells buyers what controls are in place and what remains to be done. It is not equivalent to a certification, but it demonstrates seriousness and creates a roadmap.
What industries most commonly require SOC 2 in diligence?
SaaS and technology companies, healthcare services with digital data handling, financial services, and any company with enterprise customers who require vendor SOC 2 reports as part of their own compliance programs.
What is cyber insurance and do we need it before a sale?
Cyber insurance covers breach response costs, regulatory fines, and third-party liability. Buyers increasingly require cyber insurance as a condition of close or as a representation and warranty. A $2M–$5M cyber policy for a $15M–$75M business typically costs $8,000–$25,000 annually.
How does SOC 2 affect valuation?
SOC 2 Type II does not directly affect EBITDA, but it affects risk-adjusted valuation. Buyers apply lower risk premiums to companies with documented security governance, which translates to tighter valuation multiples and fewer adjustments in the purchase agreement.
Research sources
Disclaimer: Financial figures and case studies in this article are illustrative, based on representative middle market assumptions, and are not guarantees of outcome. Statistical references are drawn from cited third-party research; individual transaction and operational results vary based on business characteristics, market conditions, and deal structure. This content is for informational purposes only and does not constitute legal, financial, or investment advice. Consult qualified advisors for guidance specific to your situation.
Explore adjacent topics
