Every deal deserves forensic truth.
Undisclosed breaches, legacy debt, regulatory gaps — cyber risk is the hidden liability in every M&A transaction. DeepDiligence gives deal teams evidence-based clarity with AI-powered forensic analysis across 10 workstreams.
Quantified risk. Go/No-Go recommendations. Board-ready reporting. Built for Australian regulatory requirements.
Your due-diligence report — is it court-defensible, or a PDF that sounds confident?
Forensic due diligence across structured workstreams with a defensible evidence trail — the difference between a document and something that holds up when it's challenged.
The short answer
We’re acquiring a company — how do I check its cyber security before we sign?
Test the evidence, not the questionnaire answers. Cyber due diligence should verify the target’s actual controls, past incidents and breach notifications, privacy obligations, third-party dependencies and technical debt, then translate each finding into deal terms — price, warranties, indemnities or pre-completion remediation. Findings need a documented evidence trail, because a report that cannot be defended is of little use if the deal is later disputed.
What it depends on
- The target’s regulatory profile: an APRA-regulated, SOCI-covered or health-data-holding target carries inherited obligations you will own on completion.
- Its breach history: prior Notifiable Data Breaches, OAIC investigations or unreported incidents can become your liability.
- Deal structure and access: share versus asset sale, and how much technical access the vendor allows before exclusivity.
What a professional adds
- Judging which findings are deal-breakers, which are price adjustments and which are simply integration work.
- Working alongside your legal advisers to turn technical findings into warranty and indemnity language.
- Preserving a defensible evidence trail should the findings be challenged after completion.
Questions to ask your current provider
- Was your last cyber due diligence based on verified evidence — or on the vendor’s own questionnaire answers?
- Did the report translate findings into dollars and deal terms, or leave that to your lawyers to guess?
- Would its conclusions hold up if the vendor disputed them in twelve months’ time?
What this answer does not cover
- Due diligence reduces uncertainty; it cannot guarantee that no undiscovered incident or vulnerability exists.
- Scope is limited by the access and time the vendor allows.
- Legal, tax and financial due diligence are separate disciplines — this covers cyber and privacy risk only.
Cyber due diligence workstreams and deal levers
Curated by BCyber from Australian regulatory obligations and M&A practice. Illustrative structure, not legal advice. Reviewed .
| Workstream | What is verified | Primary reference | Typical deal lever |
|---|---|---|---|
| Control effectiveness | Evidence of implemented controls, not policy statements | ASD Essential Eight / ISO/IEC 27001:2022 | Price or pre-completion remediation |
| Incident and breach history | Prior incidents, NDB notifications, regulator contact | Privacy Act 1988 Part IIIC | Specific indemnity |
| Regulatory inheritance | APRA, SOCI and privacy obligations transferring on completion | CPS 234 / SOCI Act / Privacy Act | Warranties and conditions precedent |
| Third-party dependency | Critical suppliers, cloud concentration, contract terms | APRA CPS 230 (material service providers) | Integration plan and escrow |
See the workstreams on this page before you engage anyone.
Four stages. Ten workstreams. One verdict.
Every engagement follows a structured four-stage process — from scoping through to board-ready delivery. AI accelerates analysis; senior analysts validate every finding.
Scope & Commission
Define engagement boundaries, target profile, deal context, and critical focus areas. Commission the assessment with clear deliverables and timelines.
Evidence Collection
Structured questions across 10 workstreams delivered through our secure portal. Target uploads evidence, responds to questions, and the AI Collation Engine begins analysis in parallel.
AI Analysis & Human Review
The AI Collation Engine synthesises findings, identifies contradictions, and generates risk scores. Senior analysts review, validate, and add expert judgement. Findings are cross-referenced against regulatory requirements.
Report & Recommend
Board-ready report with quantified risk, Go/No-Go recommendation, remediation costs, and post-acquisition roadmap. Delivered via secure portal with watermarked, digitally signed documents.
Every angle. Every risk. Every workstream.
From governance and data protection through to legal liability — our 10-workstream methodology leaves no stone unturned. Each workstream produces a risk-rated finding with quantified exposure.
Cyber Governance
Board oversight, security strategy, risk appetite, organisational structure, and security investment adequacy.
Data Protection & Privacy
Data classification, privacy compliance (APPs, GDPR), consent management, cross-border transfers, and retention policies.
Incident History & Response
Breach history, incident response maturity, notification compliance, forensic capability, and insurance claims.
Third-Party Risk
Supplier security assessments, vendor contracts, SLA review, fourth-party exposure, and supply chain resilience.
IP & Source Code Security
Code review practices, secret management, repository access controls, open-source licensing, and IP protection.
Cloud & Infrastructure
Architecture review, configuration hygiene, vulnerability management, patch cadence, and disaster recovery.
Regulatory Compliance
Framework mapping (Essential Eight, CPS 234, SOC 2), evidence completeness, audit history, and remediation status.
HR & Insider Risk
Background checks, access provisioning/deprovisioning, privilege management, training completion, and behavioural indicators.
Financial Controls & Fraud
Payment system security, financial data integrity, fraud detection, audit trail completeness, and segregation of duties.
Legal & Contractual
Cyber insurance coverage, liability clauses, indemnities, regulatory obligations, and pending legal proceedings.
What goes wrong without due diligence
Every one of these scenarios has happened to Australian companies in the last 24 months. DeepDiligence is designed to catch them before settlement.
| The Hidden Risk | What It Costs | How DeepDiligence Catches It |
|---|---|---|
| Undisclosed data breach | Post-acquisition notification to OAIC, remediation costs, customer churn, potential class action. Under Privacy Act 2024: uncapped civil penalties. | Incident History workstream cross-references insurance claims, breach registers, and regulatory notifications. AI flags inconsistencies between self-reported history and evidence. |
| Legacy technical debt | Millions in unplanned remediation — unpatched servers, end-of-life systems, misconfigured cloud environments that become the acquirer's problem. | Cloud & Infrastructure workstream quantifies patch cadence, EOL exposure, and configuration drift. Remediation costs are estimated in AUD for deal negotiation. |
| Third-party supply chain exposure | Inherited vendor relationships with poor security — a single compromised supplier can breach your newly acquired company. | Third-Party Risk workstream assesses supplier security posture, contract terms, SLA adequacy, and fourth-party exposure. Identifies critical dependencies. |
| Non-compliant data handling | Cross-border data transfers without adequate safeguards, consent gaps, and retention violations. Regulatory enforcement by OAIC, APRA, or ASIC. | Data Protection workstream maps data flows, consent mechanisms, retention policies, and cross-border transfer safeguards against Privacy Act (APPs) and GDPR. |
| Privileged access sprawl | Former employees with active admin accounts, shared credentials, no MFA on critical systems — ready-made attack surface. | HR & Insider Risk workstream assesses provisioning/deprovisioning processes, privilege management, MFA coverage, and background check practices. |
Undisclosed data breach
What It Costs
Post-acquisition notification to OAIC, remediation costs, customer churn, potential class action. Under Privacy Act 2024: uncapped civil penalties.
How We Catch It
Incident History workstream cross-references insurance claims, breach registers, and regulatory notifications. AI flags inconsistencies.
Legacy technical debt
What It Costs
Millions in unplanned remediation — unpatched servers, end-of-life systems, misconfigured cloud environments.
How We Catch It
Cloud & Infrastructure workstream quantifies patch cadence, EOL exposure, and configuration drift with AUD cost estimates.
Third-party supply chain exposure
What It Costs
Inherited vendor relationships with poor security — a single compromised supplier can breach your new acquisition.
How We Catch It
Third-Party Risk workstream assesses supplier posture, contract terms, SLA adequacy, and fourth-party exposure.
Non-compliant data handling
What It Costs
Cross-border transfers without safeguards, consent gaps, retention violations. Regulatory enforcement ahead.
How We Catch It
Data Protection workstream maps data flows, consent mechanisms, and retention policies against Privacy Act and GDPR.
Privileged access sprawl
What It Costs
Former employees with active admin accounts, shared credentials, no MFA — ready-made attack surface.
How We Catch It
HR & Insider Risk workstream assesses provisioning, privilege management, MFA coverage, and background checks.
Forensic-grade tools for deal-critical decisions
From AI-powered analysis to tamper-proof audit trails — everything a deal team needs to make confident, defensible decisions.
AI Collation Engine
Synthesises evidence across 10 workstreams. Identifies contradictions, flags gaps, and generates risk quantification scores — all validated by senior analysts.
Risk Quantification
Every finding is scored 0–100 with quantified exposure in AUD. Deal teams get numbers, not opinions — remediation cost estimates that feed directly into price negotiations.
Evidence Chain of Custody
Every document, response, and artefact is tracked with forensic-grade chain of custody. Upload timestamps, access logs, and version control for regulatory and legal scrutiny.
Go/No-Go Recommendations
Clear, evidence-based verdict with supporting rationale. Not a subjective opinion — a documented, defensible recommendation backed by quantified risk analysis.
Watermarked Reports
Board-ready reports with unique watermarks per recipient. Track who viewed what, when. Secure sharing via portal with granular access controls.
Secure Target Portal
Dedicated portal for target company to upload evidence, respond to workstream questions, and track progress. No email attachments, no shared drives.
Audit Trail
Every action logged — who asked what, who responded, who reviewed, who approved. Immutable audit trail for legal defensibility and regulatory evidence.
Multi-Framework Mapping
Findings mapped against Essential Eight, APRA CPS 234, Privacy Act, ISO 27001, SOC 2, NIST CSF, PCI DSS, GDPR, and SOX — in a single assessment.
Built for Australian deal requirements
Every workstream maps findings against Australian regulatory obligations. Acquirers know exactly what they're inheriting.
Privacy Act 2024
Uncapped civil penalties for data breaches. Acquirers inherit the target's breach liabilities — due diligence must quantify exposure before settlement.
APRA CPS 234
Regulated entities must ensure third-party and acquisition targets meet information security standards. Non-compliance creates prudential risk for the acquirer.
Essential Eight
ACSC's baseline cyber mitigation strategies. Targets below Maturity Level 2 face significant remediation costs that must be factored into deal pricing.
SOCI Act 2018
Acquisitions involving critical infrastructure assets trigger mandatory Risk Management Program obligations and director accountability.
ASX Governance Principles
Principle 7 requires boards to recognise and manage risk. Cyber due diligence is now a board-level obligation for listed entity acquisitions.
How DeepDiligence works
DeepDiligence is BCyber's forensic cyber due diligence platform, purpose-built for Australian M&A transactions, vendor assessments, and compliance reviews. It covers 10 forensic workstreams — from cyber governance and data protection through to financial controls and legal/contractual analysis — providing deal teams with a comprehensive, quantified view of cyber risk.
AI-Powered Forensic Analysis
The AI Collation Engine ingests evidence and responses across all 10 workstreams and synthesises findings using pattern recognition, cross-referencing, and risk correlation. It identifies contradictions between self-reported responses and uploaded evidence, flags areas requiring deeper investigation, and generates risk quantification scores. Every AI output is reviewed and validated by senior analysts before entering the final report.
Quantified Risk, Not Qualitative Opinion
Every finding is scored with a quantified exposure figure in AUD. Deal teams get remediation cost estimates they can use directly in price negotiations — not vague risk ratings. The Go/No-Go recommendation is a documented, defensible verdict backed by evidence, not subjective opinion.
Forensic-Grade Evidence Management
Every document, response, and artefact carries chain-of-custody tracking from the moment it enters the platform. Upload timestamps, access logs, version control, and immutable audit trails ensure findings stand up to legal scrutiny. Reports are watermarked per recipient and delivered through a secure portal — no email attachments, no shared drives.
Post-Acquisition Value
DeepDiligence doesn't end at settlement. Every engagement includes a post-acquisition security roadmap covering Day 1 priorities, a 90-day integration plan, and a long-term harmonisation strategy. Remediation projects can be tracked as GRACE projects within BCyber's platform, with milestone reporting and compliance evidence generation.
Part of BCyber's GRACE ecosystem
DeepDiligence findings feed across every pillar — turning a point-in-time assessment into a continuous improvement engine.
Policy gaps and governance maturity findings feed directly into remediation plans
Incident history analysis informs response preparedness and crisis simulation
DeepDiligence lives here — forensic validation of security claims and controls
Regulatory gap analysis mapped to frameworks with evidence-linked findings
Awareness gaps identified in HR workstream drive targeted training programs
Proof, not promises
One anonymised result, the trail behind it, and — just as important — what it does not do. In a market full of confident claims, the sources and the limits are the point.
in a due-diligence report carries its source; where evidence is missing, the system writes TBD instead of guessing.
- 1Each finding links to the underlying artefact or interview note.
- 2Assessed against ISO/IEC 27001 and the ACSC Essential Eight, with gaps stated plainly.
- 3Structured to be court-defensible — reviewed by a human before release.
Anonymised and illustrative of typical engagements.
- It does not manufacture confidence — an unknown is labelled, not smoothed over.
- It does not replace legal due diligence; it makes the cyber position evidence-based.
- It does not certify the target as secure — it shows what is known and what is not.
- Expanding coverage of niche third-party and supply-chain data sources.
- Refining how confidence levels are communicated to non-technical readers.
We publish our limits on purpose. Evidence-based, mapped to recognised authorities — never a guarantee.
Executive cyber leadership — on demand
BCyber gives Australian businesses the strategic cyber leadership of a seasoned CISO — sharpened by AI, sized to your budget — without the full-time cost. We turn governance, compliance and risk into board-ready decisions and measurable outcomes, with the evidence to back them — so you move faster, prove assurance, and stay ahead of regulators.
Investor-grade cyber leadership that de-risks deals and accelerates due diligence — so transactions close with confidence, not surprises.
Executive expertise, on demand
The strategic guidance of a seasoned CISO — sized to your business and budget, without a full-time hire.
Board & regulator confidence
Decisions and evidence your directors and auditors trust — assurance you can stand behind.
AI that compounds your advantage
Leadership that harnesses AI to spot risk earlier and act faster, so you stay a step ahead.
One team, always on
Continuity and institutional memory across your whole cyber programme — nothing falls through the cracks.
Due diligence that never sleeps
The tide is rising — and with BCyber’s Virtual Agent Team and Virtual Mentor behind your deal desk, your boat rises faster. Intelligence that works across every workstream, around the clock.
Agents embedded in every deal
Three specialist agents woven into DeepDiligence — gathering forensic intelligence, quantifying board-level risk, and mapping compliance gaps. They don’t replace your analysts; they make every analyst ten times sharper.
Deep-dive intelligence across all 10 workstreams. Scout identifies hidden risks, cross-references threat feeds, and surfaces findings human analysts might miss — before the LOI is signed.
Translates technical findings into deal-impact language. Board-level risk quantification, investment committee briefings, and strategic mitigation plans — in hours, not weeks.
Designs post-acquisition integration roadmaps. Compass balances remediation urgency against deal timelines and resource constraints — so nothing derails after close.
Plus 4 more specialist agents — 7 total, psychometrically calibrated to your team.
Meet the full Virtual Agent TeamYour M&A risk coach — on call 24/7
Virtual Mentor brings forensic instinct to every deal. Trained on global M&A cyber risk frameworks, it teaches your team to spot what questionnaires can’t.
M&A risk framework walkthroughs — from target scoping to Day-1 integration
Red-flag pattern recognition trained on real-world deal failures
Regulatory obligation mapping across Australian and international jurisdictions