M&A Due Diligence Data and Classification Gaps

A deal closes, and with it, the buyer inherits every data risk the target carried into the transaction, whether or not anyone saw it coming. It was built to catch financial exposure, contract liabilities, and operational red flags. It was not built to catch data classification gaps, so those gaps pass through the deal untouched and transfer directly to the buyer. Praetorian's due diligence framework puts the inheritance mechanism in blunt terms: when a company acquires another company, it acquires that company's cybersecurity problems along with it. Privacy regulations do not ask when a liability originated. GDPR fines, state privacy law violations, and contractual obligations all transfer with the acquisition, and the acquiring company takes on the target's compliance posture in full, gaps included.

Marriott's acquisition of Starwood remains the clearest demonstration of what this looks like in practice. Attackers had already set up residence inside Starwood's systems well before Marriott closed the deal, and the breach was not discovered until roughly two years later, between September 2016 and September 2018. Litigation and government settlements followed Marriott for years after the deal was done. Centri Consulting's analysis of the case notes that the lesson here is written in headlines and enforcement actions, not in a theoretical risk model, and the data risk in the Starwood systems existed before Marriott ever signed anything. It simply was not visible during the diligence window, and that invisibility, not any failure of financial analysis, is where the real damage started.

Why target companies cannot accurately describe what data they own

Target companies do not hide what they know about their data exposure. Most cannot produce an accurate inventory or classification of what they own in the first place, so the information handed over during diligence is incomplete from the start, not because anyone withheld it. When diligence asks for a data inventory, it asks a company to answer a question it has likely never fully answered for itself.

Praetorian's framework treats the data inventory as a core Phase 2 document-review item: what sensitive data the target holds, where it sits, what protections surround it, and which privacy regulations apply to it. The framework also draws a sharp line between what that review can actually confirm: document reviews show what the target claims about itself, while only technical validation shows what is actually true. That gap between claim and reality is the classification gap, playing out in real time inside every diligence process.

The Infosys whitepaper names "lack of transparency" as a central challenge in cybersecurity due diligence, and it frames the problem carefully: many target companies may not fully disclose their cybersecurity posture, which leaves the acquirer unaware of critical vulnerabilities and risks. The same paper identifies a related driver it calls "limited assurance": the documentation and supporting evidence available on the target's cyber landscape is often too thin for the acquiring company to rely on with confidence. A survey cited in that same paper found that companies report one challenge as the biggest in cybersecurity due diligence: vetting the information they're given accurately.

Shadow IT makes this concrete. Every organization accumulates systems, accounts, and tools that exist outside its official records, and those assets are invisible to whoever fills out the diligence questionnaire on the target's behalf. The target is not lying when it leaves those systems off the list. Those accounts were never part of its own governance process, so an inventory built from that process omits them.

The data most worth protecting often carries no label. Proprietary algorithms, unreleased product designs, customer models, and trade secrets become sensitive because of what they mean to the business. A target's data loss prevention system can be fully configured and still miss its own crown jewels, because it was never built to find that kind of asset. When diligence asks what sensitive data a target holds, the answer only reflects whatever classification scheme that company happened to build. That scheme might cover personal data and regulatory records in full detail, but leave the company's core intellectual property completely uncategorized.

How deal pressure actively widens classification gaps during the diligence window

The classification gap does not hold still while diligence runs its course. The conditions created by an active deal, namely speed, distraction, data movement, and staff anxiety, actively widen that gap at the exact moment the acquirer is relying on it most heavily.

Speed does the most damage. Done properly, this kind of assessment takes months even under normal conditions, but the pressure to close compresses the time you have for it. The Infosys whitepaper describes this directly: organizations driven by business pressure, operating without a cybersecurity roadmap, will see M&A timelines outpace whatever target operating model security teams are working from. The paper calls this "running against time," and treats it as a structural pattern in how deals get executed, not an occasional misstep. The same document lists "all is top priority" as a common anti-pattern in M&A, appearing alongside running against time in its list of recurring failure modes.

IT and security staff, meanwhile, are pulled toward integration planning at the exact moment governance needs tightening, not loosening. Centri Consulting identifies this as a structural vulnerability in its own right: the transition period becomes a prime opportunity for attackers because the people responsible for defense are busy with integration tasks instead. Separate threat-intelligence reporting that Centri cites finds that logging baselines shift and systems converge during this period, and that shift produces measurable spikes in phishing attempts and supply-chain compromise attempts. Howden Group's analysis of law firm mergers names "overburdened IT teams" as a distinct merger vulnerability: teams consumed by data movement and systems integration simply have less attention left for proactive security monitoring.

Employee anxiety adds another layer of distortion. Mergers raise real fears about job security, so those fears drive a spike in insider-driven data movement that muddies whatever inventory the acquirer is trying to build. Howden Group calls out insider threats specifically as a merger vulnerability: fear and distraction during a merger raise the odds of employees falling for social engineering attacks, and they also raise the odds of employees deliberately moving sensitive information out the door. When staff start copying files, exporting records, or shifting work to personal accounts ahead of an anticipated restructuring, the real location and state of sensitive data drifts away from what the target documented when diligence began.

The diligence process itself adds to the exposure it's meant to manage. Howden Group states that mergers require moving or sharing large volumes of highly confidential client and firm data across systems, and that movement expands the landscape available to an attacker. The diligence window functions as a threat window in its own right, not merely a review period. Adversaries appear to time their activity accordingly. Centri Consulting reports that threat-intelligence data shows adversaries actively targeting organizations during M&A, precisely when staff attention is divided, logging baselines are shifting, and systems are converging, producing the spikes in phishing and supply-chain compromise attempts that cluster around deal announcements. A buyer who trusted the target's documentation on day one of diligence is, by the time the deal closes, working from a picture that has already gone stale.

What Document Review Misses

A document review, no matter how thorough, produces a picture of what the target believes about its own data. The classification gap guarantees that belief is incomplete in ways the documents themselves cannot reveal, since a target cannot document what it doesn't know it has.

The review asks the right questions. It cannot confirm the answers. Praetorian's framework draws this distinction without softening it: document reviews show what the target claims, and only technical validation shows what is actually true. That's the basis for the framework's conclusion that penetration testing stands as the single highest-value activity available in diligence, because it reveals the security posture that actually exists rather than the one written down in a policy binder. Security policies, incident response plans, and compliance certificates all describe intended behavior. None of them show you the actual state of data scattered across the company's real environment.

Operational metrics tell a more honest story than policy language does. Praetorian recommends that acquirers request specific figures: mean time to remediate critical findings, the size of the vulnerability backlog, how much of the attack surface has actual coverage, and how often testing happens. These numbers reveal the maturity of a security program far more reliably than any written policy can. A target with elegant, well-written security policies and a vulnerability backlog that's years old is telling two different stories at once, and the gap between them is the one that matters.

Even the manner of a target's response carries information. Praetorian's framework treats how a target answers the incident history request, openly or evasively, as a signal in itself, and it recommends you ask for every security incident from the past three to five years, whether or not any of them were ever disclosed publicly. Configuration assessments and architecture reviews reveal a gap between what a company says about its data protection and what its systems actually do. Misconfigurations remain among the most common sources of exploitable vulnerability, and cloud misconfigurations in particular can leave data exposed in ways no policy document would ever capture. The Infosys whitepaper names "missing data protection practices at the cloud" as its own distinct liability source, separate from on-premise governance gaps, and ties it directly to regulatory penalties and reputational damage.

External assessment gives you a way around depending on the target's own account of itself. Praetorian's phased framework starts with an external attack surface analysis before the letter of intent is even signed, mapping public-facing infrastructure, domains, cloud services, and web applications, and checking for disclosed breaches, regulatory actions, and exposure on the dark web. That work happens independent of whatever the target chooses to volunteer, giving the acquirer a baseline that rests on its own findings rather than the target's self-reporting.

How undetected breaches and long dwell times compound the classification problem post-close

The riskiest scenario in M&A data exposure is the one no one can see yet: a target's data already compromised at the time of acquisition, with the compromise still undetected. In that situation, the acquiring organization inherits more than a classification gap. It inherits an active breach it has no reason yet to look for.

Breaches in target environments often sit undetected for long stretches, so they can sit there through the entire diligence period without the buyer ever seeing them. The Infosys whitepaper cites the IBM 2024 Cost of a Data Breach Report, which found that the average time to identify and contain a breach spans many months. If a breach is already active at signing, it may remain undetected until long after the deal has closed. The Marriott and Starwood case shows what this looks like at full scale: attackers present before the deal closed, discovery arriving roughly two years later, and consequences that stretched through years of litigation and government settlements well past the transaction itself.

Buyers tend to treat a disclosed, undisclosed breach as a deal-breaker, and that instinct makes sense on its face. The greater danger is the breach nobody has disclosed because nobody involved, on either side of the table, has discovered it yet. That is the scenario standard due diligence is least equipped to catch, and it is the one that turns a classification gap from a documentation problem into a liability that compounds for years after the ink dries.