The Breach You Buy: Cyber Risk is a Valuation Item, Not a Security Score

November 6, 2026 - by Miguel Sanchez

Cyber risk is a valuation and underwriting input, not a security score. Acquirers buy more than a company’s revenue and assets. They also inherit its security posture and any undiscovered vulnerabilities, and a red, yellow, and green rating cannot tell a CFO what that condition is worth. Quantifying exposure in dollars before the price is set changes the bid, the insurance conversation, and the escrow at exit.

A few years ago, Marriott closed its $13.6 billion acquisition of Starwood. Two years later, it disclosed a breach of Starwood’s guest reservation database. The intruder had been inside that system since 2014, a year before Marriott made its offer.

Marriott initially estimated that up to 500 million guest records were affected. It later revised the figure to no more than 383 million.

I raised this case in Synoptek’s recent session, hosted by ACG, because it highlights a critical blind spot in acquisitions: buyers can inherit risks they have not yet identified. Without a clear understanding of those exposures and their potential financial impact, buyers may underestimate the liabilities they are taking on.

What Acquirers Actually Inherit

The compromise was not a post-close event. It predated the deal, and it went undetected through the first two years of ownership.

Marriott had not yet retired Starwood’s reservation system when the breach came to light, so the affected environment was still operating within Marriott’s environment. At a Senate hearing months later, one senator asked whether cybersecurity concerns do and should play a role in merger and acquisition decisions, and noted that Marriott had initially left Starwood’s security system in place.

The lesson is not about one company’s process. It is that cyber risk does not show up where deal teams usually look. It is not in the financials. It does not announce itself in a standard review. It sits in the target’s condition until something surfaces it.

A Score Cannot Be Priced

A typical cyber assessment hands the CFO a score, or a dashboard of red, yellow, and green. It looks precise. But it does not say what the exposure means in dollars, so it cannot be priced into a bid, negotiated in a purchase agreement, or defended to a board.

My colleague Manan Thakkar walked through the alternative in the session: factor analysis of information risk, known as FAIR. Instead of reporting that ransomware risk is high, FAIR expresses the exposure as a dollar figure for that specific company, along with the reason behind it. Frequently the reason is concrete, such as the backup architecture.

What a Quantified View Gives an Acquirer

Manan described three things a score cannot provide:

1. Dollar exposure on the top loss scenarios. The figures are calibrated to the target, so they can inform the price instead of sitting in an appendix.
2. Return on each control. The model shows what each remediation dollar takes off the exposure. That tells a buyer what to fix, what to ask the seller to address, and what to price.
3. A stronger insurance conversation. The company can show a carrier its residual exposure, what has been mitigated, and what it still wants covered.

The work runs in two passes: a baseline, then the expected exposure after the proposed investment. The CFO leaves with a financial decision, not a score.

Assess Before You Connect

Strategic acquirers face a version of this problem that financial sponsors often do not: the instinct to absorb.

In the session, I noted that the automatic assumption in many acquisitions is that the target folds into the acquirer’s technology stack. That should not always be the case. An assessment of what you are acquiring comes first, and sometimes the acquired company has the better environment.

The security corollary is straightforward. Connecting an acquired environment to your own is an integration decision, and it should follow an assessment of that environment, not precede it. Until you know the target’s exposure in dollars, you do not know what you are plugging in.

How Cyber Risk Affects Exit Valuation

Cyber risk moves  the price at exit too. A 2026 Kroll survey of 325 PE executives, shown in the session, found that 26 percent of portfolio company cyber incidents directly reduced valuation or exit price. The reported impact per incident reached $10 million, and those figures exclude reputational damage, which can linger for years.

For a seller, the practical consequence is the escrow conversation. An unquantified exposure or a recent incident becomes a holdback, and as I noted in the session, escrow funds may not be fully released to the seller.

The seller who arrives with a current, quantified view of exposure is negotiating from evidence. The seller who does not is negotiating against whatever the buyer’s team finds.

Cyber Risk Assessment: 3 Questions to Ask Before Signing

Before the next signing, a corporate development or deal team can test its own position with three questions:

1. Do we have a dollar range for the target’s top loss scenarios, or only a color-coded score? If it is only a score, the risk has not been priced.
2. Have we decided what connects to our environment and when, based on an assessment of the target? If integration is planned before assessment, the sequence is backward.
3. After proposed remediation, what exposure remains, and who carries it: the price, the seller, or an escrow? If nobody can answer, someone will answer it for you after close.

Cyber Risk in M&A: Price It Before It Costs You

Cyber risk is a valuation item because someone always pays for it. Either it is priced in before close, or it arrives afterward as a cost, a disclosure, or a discount. The key decision is whether to address that risk before closing or face its financial consequences later.

Watch the full session on demand, including the discussion of quantified cyber risk: Managing IT Value, Risk, and Spend Across the Deal Lifecycle

---

About the Author

Miguel Sanchez is the Senior Vice President of Client Advisory. He has expertise in serving clients in the financial services, healthcare, entertainment, and consumer product industries. In his role, Miguel is responsible for strategy development, business growth, and client relationship management for Synoptek’s client advisory practice.