Both situations put security questions on a deadline set by somebody else. A buyer wants to know what they are acquiring before the deal closes, and a customer wants evidence before awarding a contract. The work is similar in each case and the constraint is time, so knowing what can be assessed quickly and what genuinely needs weeks is the useful skill.
What can be assessed in a week
More than most people expect. External footprint discovery and testing gives you the internet-facing picture, including forgotten systems and exposed services. A cloud configuration review covers identity, network exposure and logging across the main platforms, which is where most modern estates now hold anything worth protecting. A review of policies, incident history and previous test reports fills in the process side. Together these produce a defensible picture of the state of an estate, and they need very little access beyond read-only credentials and a conversation with whoever runs the systems.
What takes longer and why
Application testing and internal network assessment need access, coordination and time. In a deal context that access is often unavailable until completion, which pushes the work into the first weeks of integration rather than the diligence period. That is workable provided the risk is priced into the deal and the integration plan holds back connectivity until the assessment is done. Where a target holds significant personal data, the ICO’s expectations around security of processing transfer with the business, so the buyer inherits the obligation along with the systems.
“On the sell side, having a current independent test report is the single thing that shortens a diligence process. Buyers stop asking whether anyone has looked and start reading what was found. A report with findings that were fixed reads far better than no report at all, which is the version most sellers seem to fear.”
William Fieldhouse, Director, Aardwolf Security Ltd
Preparing to be assessed
If you are the target or the bidder, assemble the evidence before it is requested. A current test report with remediation status, certifications, an asset and data flow description, your incident history and your patching policy will answer most of the questions in any diligence pack. Being able to hand that over on day one changes the tone of the conversation, and it avoids the situation where a buyer’s technical team is left to draw conclusions from silence. Assume they will search your domain and your breach history regardless of what you provide.
Getting the scope right under time pressure
Be explicit about what was and was not covered, because a partial assessment presented as complete is worse than an honest gap. State the systems in scope, the type of testing performed, the dates and the constraints you worked under, in a paragraph the reader cannot misinterpret. When you brief a penetration testing firm for this kind of work, tell them the deadline and the decision the report will support, since that shapes what they prioritise. Where the timetable is tight, arrange a due diligence assessment covering the external and cloud picture first, and schedule the deeper work for immediately after completion.
Frequently asked questions about diligence testing
These questions come up when a transaction or a major tender begins.
Can you test a company you are acquiring?
Only with their written authorisation, which is normally arranged through the transaction lawyers. Passive research using public sources needs no permission and is a reasonable starting point.
Does a clean report improve valuation?
It rarely raises the price and it removes reasons to lower it. Unknown security posture becomes a risk discount or a retention, so evidence tends to protect value rather than add to it.
