Originally published on LinkedIn · July 2024. Inaugural edition of the Ask McConnell M&A Security newsletter.
Approximately 21,000 mergers and acquisitions occurred in 2023. Of those, what percentage engaged a dedicated, qualified converged security professional at any point in the transaction? That question is the reason this newsletter exists.
Definitions
- Security: Prevention, detection, and response to a crime or violation
- Converged Security: Operational integration of physical security, cyber security, investigations, personnel security, and related security functions — working together, not in silos
- M&A categories: Mergers, acquisitions, asset-only acquisitions, sales, divestitures, and rebadge transactions — each carries different security implications and timelines
The Eight M&A Phases — Where Security Belongs
- Ideation — Security engagement rarely occurs here. It should, when red flags exist about a target.
- Due Diligence — The most critical phase. This is where you discover breach history, compliance gaps, ethical violations, and security debt. If security is not present in due diligence, you are buying risk you cannot price.
- Integration Cost Submission — Security capital costs and ongoing operational expenses must be built into the deal model — not discovered afterward.
- Press Release / Regulatory Approval — The threat landscape changes the moment a deal is public. Security readiness must match the new exposure.
- Integration Planning — Security must be embedded across workstreams, not managed as a silo. Every workstream has a security component.
- Close Day — Transition from planning to execution. The Project Integration Officer, Crisis Manager, and Incident Commander should all be identified and briefed before this day arrives.
- Day 2 (Payroll) — Access administration is critical in this window. Who has access to what? Under what system? Provisioned or deprovisioned correctly?
- Fully Integrated (6–24 months) — Integration is not a close-day event. It requires sustained security focus for an extended period.
The Questions Deal Teams Should Be Asking
- Who owns transaction security, and have they been identified by name — not just by function?
- Did the security team receive sufficient time and access to develop accurate integration cost estimates?
- What percentage of integration workstreams have a named security representative?
- Have you run a pre-close tabletop exercise against the most likely Day 1 security scenarios?
Ask McConnell, LLC provides M&A transaction security services: due diligence support, integration planning, cost development, pre-close tabletop exercises, and ongoing security metrics reporting — for PE firms, VC firms, investment bankers, BizDev professionals, and M&A consulting teams.