A buyer can form a useful security view of a target in five days: inventory on day one, code and dependencies on day two, access on day three, data and vendors on day four, incidents and compliance on day five. The aim is a ranked risk list, not a perfect audit.
Day 1: inventory
Ask for a list of products, repositories, cloud accounts, domains and third party services. Compare it with what you can observe externally. Gaps between the two are findings. See asset discovery for merger and acquisition due diligence.
Day 2: code and dependencies
Request SBOMs from released builds and a license report. Run your own scan to compare. Look for copyleft in shipped code, known exploited vulnerabilities, unmaintained packages and secrets in history.
Day 3: access
Ask for admin lists for source control, cloud, identity provider and production databases. Check multi factor authentication coverage, offboarding practice and the last access review date. Contractors and shared accounts deserve a second look.
Day 4: data and vendors
Where is customer data stored and processed? Which vendors touch it? Request a data flow diagram and a vendor list with the data each receives. Check retention and deletion practice.
Day 5: incidents and compliance
Read the incident history and the follow up. Review compliance documents for dates and scope. Interview an engineer, not only the CISO or CTO, about how a critical fix actually ships.
Output: a ranked list
Sort findings into three groups:
- Deal level issues: licensing that blocks the product, undisclosed breach, no control over production.
- Price level issues: major upgrades, large remediation backlog.
- Integration items: tooling, policy and identity merges for after close.
Keep the target comfortable
Share your scan results with the seller. Surprises on both sides slow a deal. Sellers who see findings early often fix them before signing.
What to skip in week one
A first pass is not the time for a full code audit or a red team exercise. Skip line by line code review, deep configuration audits and anything that needs production access.
Also skip arguing about severity scores. Record findings, mark whether each is deal level, price level or integration level, and move on. Time spent debating a medium finding is time not spent on the access list.
If the target is large, sample. Pick the three products with the most revenue or data and review those thoroughly. A thin pass over everything finds less than a careful pass over what matters most.
Write the summary on day five while it is fresh, and send it to the deal team with a short list of follow up requests.
Quick check
Can one week be enough?
For a first pass, yes. It surfaces deal and price issues. A deeper review can follow for items that matter.
Last reviewed: 19 October 2026.
