The Diligence
Gap Report
An annual account of what cyber risk actually does to mergers, acquisitions and private equity deals — who raised it, what moved the price, and what buyers are still not checking.
You’re on the list. The full report arrives on release; future issues too.
The executive summary and headline findings publish on this page on release day. Leave a company email to get the full report — all 22 findings, the venture appendix, methodology — delivered when it drops, plus future issues as they ship.
Cover: 100 deals below $25B AUM. 29 assessed. Three of the twenty-two
A previewis what the average private equity firm spends assessing cyber risk on a deal — against a $2.1M average impact when it goes wrong. An 82× asymmetry.
Finding 06 · Kroll, 2025Cyber diligence is standard practice in 81% of deals above $25B AUM. Below that line it is 29% — and the reason is arithmetic, not awareness.
Finding 11 · S-RM, 2025of private equity firms have already watched a cyber incident reduce a valuation or an exit price. None of those adjustments appear in a public filing.
Finding 03 · Kroll, 2025
If you've ever left cyber diligence out of a deal, we'd like to know why
Not the policy answer — the reason on an actual deal. Public research covers reach and spend, not the calls dealmakers make: what got cyber cut from the workstream, what changed a price, what killed a term. That’s the gap this report closes — with Q4 responses from dealmakers, gathered before we go to print in January.
Who we're looking for
A private equity firm below $25B AUM — the lower middle market especially
At least one closed transaction in the last 24 months
You commission diligence or approve its budget — partner, principal, VP, operating partner, CFO
Corp dev, bankers and deal counsel welcome — segmented separately
The dataset and the findings before they go public. Confidential and unattributed — nothing that could identify a deal is published.