Security Due Diligence for Private Equity Acquisitions
When a private equity firm acquires a company, the due diligence checklist covers financials, legal, operations, and technology. Security is usually an afterthought — until something goes wrong post-close and the new owners discover they inherited a liability instead of an asset.
What Security Due Diligence Covers
Security due diligence evaluates the target company’s protective posture across four domains:
- Physical security — access controls, surveillance, visitor management, facility hardening
- Personnel security — background check standards, termination procedures, insider threat awareness
- Executive protection — threat assessment history, protective measures for leadership, travel security protocols
- Workplace violence prevention — written plans, training records, incident history, threat assessment team structure
The assessment identifies gaps, quantifies remediation costs, and flags risks that could affect deal terms or post-acquisition integration timelines.
Why PE Firms Need This
Three scenarios make security due diligence essential:
The hidden liability. The target company had a workplace violence incident two years ago and settled quietly. No program improvements followed. The next incident happens under new ownership, and the PE firm’s portfolio company faces a negligent security lawsuit with a documented history of inaction.
The integration risk. Two companies merge. One has a mature security program with credentialed staff and documented procedures. The other has a part-time facilities manager who also handles “security.” Harmonizing these programs costs money and time that was not in the integration budget.
The executive retention factor. A CEO with a credible threat profile joins the portfolio company. Without an existing EP infrastructure, building one from scratch takes months. The executive’s risk window during that gap is real.
What the Report Looks Like
A security due diligence report for a PE acquisition typically includes:
- Current security program maturity assessment (scored against ASIS standards)
- Gap analysis with estimated remediation costs
- Risk register of identified vulnerabilities
- Recommendations prioritized by severity and cost
- Integration timeline for merging security programs post-close
The report becomes a line item in the deal model. Security remediation costs that surface after closing reduce returns. Costs identified during diligence can be negotiated into the purchase price.
The Right Time
Security due diligence belongs in the same phase as IT and legal review — before the letter of intent becomes a binding commitment. Discovering a $500,000 security remediation need after closing is a problem. Discovering it during diligence is a negotiation point.