![int[cube] Logo](../../assets/media/68aade45427e121494873a4c_int-cube-Wortmarke.svg)
Cyber Due Diligence vs IT Due Diligence vs Tech Due Diligence
What each one answers, where the gaps between them are, and which deal needs which.
Read onWhat each one answers, where the gaps between them are, and which deal needs which.
Read onShort answer: they answer different questions. Tech due diligence asks whether the product and the engineering can carry the investment case. IT due diligence asks whether the internal IT can run and scale the business at a known cost. Cyber due diligence asks how exposed the company is to attacks and breaches today, what that could cost and what it takes to fix. They overlap at the edges, and for a software or tech-enabled target most private equity buyers need tech and cyber due diligence side by side.
| Tech due diligence | IT due diligence | Cyber due diligence | |
|---|---|---|---|
| Core question | Can product and engineering deliver the business plan? | Can the internal IT run and scale the business, at what cost? | How exposed is the company to attacks and breaches, and what does fixing it cost? |
| Looks at | Architecture, code quality, technical debt, scalability, engineering team and processes, roadmap, open source and IP | Infrastructure, business applications such as ERP, IT organisation, outsourcing contracts, licences, IT costs, separation or integration effort | Security ownership, identities and access, external attack surface, vulnerability handling, product security, backup and recovery, incident history, regulation such as NIS2 and the CRA |
| Typical red flags | A platform that does not scale, key-person dependency, unmanageable technical debt | End-of-life systems, unclear contracts, IT costs far above plan, hard-to-separate shared systems | Nobody owns cyber risk, no MFA on remote access, backups that would not survive ransomware, an incident handled quietly |
| Output for the deal team | Technology risks and investment needs for the business plan | IT cost baseline, one-off costs, separation or integration plan | Red flags, remediation cost and timing, input for the purchase agreement and insurance, a post-close security plan |
Tech due diligence assesses the technology a company sells or depends on to grow: whether the architecture scales, how much technical debt sits in the code, how the engineering team works and whether the roadmap is realistic. It is the core diligence for software, SaaS and tech-enabled businesses, and it often includes a chapter on security, whose depth varies by provider.
IT due diligence assesses the IT that runs the company itself: infrastructure, end-user IT, ERP and other business applications, the IT organisation and its providers, contracts and licences. It answers what the IT costs today, what it will cost to fix, separate or integrate, and whether it can carry the planned growth. It is central in carve-outs and in buy-and-build strategies.
Cyber due diligence assesses how well the company and its products are protected, and how they would hold up in an attack. The questions are about operating reality, not documents:
The result is not a traffic light but a decision basis: which risks are material, what it costs to fix them and what belongs in the purchase agreement and the first 100 days. Our cyber due diligence checklist lists the questions in detail.
Each workstream can be done well and still leave cyber risk unassessed:
Agree the scope of all workstreams before kick-off, so that nobody assumes another team covers security.
int[cube] runs cyber and product security due diligence for investors and has done so in 50 due diligence projects. For private equity clients we often work with our strategic partner Code & Co.: Code & Co. covers technology and product due diligence, int[cube] covers cybersecurity, and the deal team gets one integrated result.
Talk to int[cube] about cyber due diligence for your next deal.
IT due diligence assesses whether the internal IT can run and scale the business at a known cost: infrastructure, business applications, IT organisation, contracts and separation or integration effort. Cyber due diligence assesses how exposed the company is to attacks and breaches: security ownership, identities and access, the external attack surface, vulnerability handling, product security, backup and recovery, past incidents and regulatory exposure such as NIS2 or the Cyber Resilience Act, together with what it costs to fix.
Partly, and it depends on the provider and the scope. Tech due diligence looks at architecture, code quality, scalability, the engineering team and the product roadmap; security often appears as one chapter. For a software or tech-enabled target, cybersecurity deserves its own workstream, because the questions and the evidence are different: who owns cyber risk, whether controls actually work, and whether the company has already been compromised.
No. A penetration test shows how selected systems held up at one point in time. It does not show who owns cyber risk, whether findings were fixed, how identities and suppliers are managed, whether backups survive ransomware or what an incident would cost. Cyber due diligence uses the report as one piece of evidence among many.
For a software or SaaS buyout, usually tech and cyber due diligence, with IT kept light. For a traditional Mittelstand company, IT and cyber due diligence. For a carve-out, IT due diligence is central and cyber covers the standalone security set-up. For a minority stake with limited access, an outside-in cyber read. For an add-on, cyber and integration-focused IT, because the platform inherits the risk.
As early as access allows. An outside-in read of the external attack surface needs no access and fits early phases or minority deals; the full assessment runs in confirmatory due diligence, early enough for findings to reach the valuation, the purchase agreement, warranty and insurance terms and the 100-day plan.