What cyber risk is being inherited?
Examine the relevance of unsupported systems, vulnerability exposure, endpoint coverage, privileged access and existing security control gaps.
TRANSACTIONS & BUSINESS SEPARATION
M&A cyber due diligence.
Business risk made clearer.
Acquisitions and carve-outs create security questions that cannot be answered by a vulnerability list alone. I help buyers, leadership teams and advisers understand inherited exposure, business dependencies and the practical work needed for separation and post-close stability.
Independent UK-based advisory · Remote and on-site by arrangement
THE BUSINESS CASE
Due diligence connected to the transaction
A useful cyber due diligence assessment distinguishes a genuine transaction risk from a routine improvement item. It considers the target's business model, the quality of available evidence and which systems or services are essential to operate safely after completion.
In a carve-out, the work extends beyond assessing the existing estate. Buyers and management need to know which security controls, identities, networks and providers are shared; who will own them on Day 1; and what needs to change as transitional arrangements end.
HOW I HELP
The practical questions
What is shared or supplied by others?
Map material service providers, directory and identity dependencies, remote access, managed security services and transitional controls.
Will the business be secure enough on Day 1?
Focus on monitoring, incident response, backups, recovery assumptions, supplier hand-offs and critical IT/OT operational continuity.
What needs attention after close?
Separate urgent control decisions from longer-term remediation, with ownership, evidence needs and a practical sequence of work.
PRACTICAL APPLICATION
Particular considerations in manufacturing and IT/OT environments
Industrial businesses often depend on long-lived platforms, specialist application stacks, connected production systems and third-party access. Standard office-IT assumptions may not reflect operational constraints or the consequences of downtime.
Security decisions therefore need to consider plant operations, unsupported operating systems, endpoint visibility, network boundaries, vendor access and the feasibility of changing controls without disrupting production.
INDEPENDENT PERSPECTIVE
Relevant experience without disclosing client detail
My experience includes cyber security assessment and remediation planning in a European automotive manufacturing business separation, examining legacy technology, endpoint coverage, access controls and operational dependencies across the environment.
I also bring the perspective of having founded and led a specialist security consultancy. The work is framed around the evidence available, material uncertainties and actions that leadership can realistically approve and deliver.
Illustrative experience is deliberately anonymised. Client identities, confidential findings and transaction outcomes are not disclosed.
Read more about my background and approach, or explore Fractional and interim CISO leadership.
DECISION-READY OUTPUTS
What would a buyer or leadership team receive?
The work should produce useful decisions, not just a catalogue of vulnerabilities. Depending on transaction stage, access to evidence and agreed scope, outputs may include:
- A concise view of material cyber risks, supporting evidence and important unanswered questions.
- Identification of shared IT, security-provider and operational dependencies affecting Day-1 readiness.
- Prioritised actions for separation, transitional arrangements and post-close remediation.
- An executive briefing linking findings to business impact, ownership and decisions still required.
Evidence-based findings, limitations and recommendations are distinguished clearly. Technical testing or detailed cost estimates are included only where specifically scoped and feasible.
TRANSACTION QUESTIONS
When should cyber be considered in a deal?
When is the right time to involve cyber due diligence?
Early enough to influence the risk assessment and transaction planning. Even where the deal timetable is compressed, the review can identify the questions that matter most before completion and the controls that need attention afterwards.
What if information from the target is incomplete?
A useful review separates confirmed risks from unresolved uncertainties. It documents what evidence was available, what could not be verified and which assumptions require an owner or a later check.
How is a carve-out different from a standard acquisition?
A separation often depends on systems, service providers and security controls shared with the seller. The priorities include continuity of critical business operations, ownership of those controls on Day 1 and a credible path away from transitional dependencies.
START A CONVERSATION
A complex decision?
Let's make it clearer.
Tell me a little about the organisation, the decision you need to make and the timescale. We can discuss the right scope for independent advisory support.
Discuss a transaction or separation
af@andrewfruish.com UK-based · Remote-first and on-site by arrangement