Definitions
Terms used in this paper
These definitions establish how the paper uses its core terms before the argument begins.
- Cyber diligence
- Structured investigation of cybersecurity conditions, dependencies, unknowns, and evidence that may matter to an investment decision or post-close plan.
- Day 0 baseline
- The first ownership-period operating snapshot used to distinguish inherited conditions from later changes.
- 100-day plan
- The early post-close operating plan used as a practical interval for prioritizing and measuring cybersecurity interventions.
- Evidence confidence
- The degree to which a diligence conclusion is supported by current attributable observations rather than assertion alone.
1. Pre-close diligence should separate facts from claims and unknowns
Deal teams rarely have unlimited technical access before close. Diligence therefore combines management interviews, documents, architecture information, incident history, external observations, and whatever direct technical evidence the target can authorize.
Those sources do not deserve the same confidence. The diligence record should say what was directly observed, what management represented, what could not be tested, and what remains unknown. An investment committee can price uncertainty more intelligently when the uncertainty is visible.
2. The investment committee needs material questions, not a product inventory
The committee does not need the model number of every firewall. It needs to know which cyber conditions could affect interruption, customer obligations, regulatory exposure, integration cost, insurance, or the value-creation plan.
That usually means elevating material dependencies, recovery weakness, privileged-access problems, unsupported technology, unresolved high-impact exposure, known incidents, and evidence gaps that could hide a larger condition.
3. Day 0 creates the inherited baseline
After close, the new owner can usually establish a deeper observed baseline. Day 0 is the line between inherited state and what happens during the ownership period.
The baseline should preserve the control state, material exposure, evidence freshness, recovery readiness, known exceptions, and important dependencies that management will use to judge later improvement.
- Before close
Preserve material findings and the limits of authorized diligence access.
- Investment decision
Explain the conditions that could affect interruption, obligations, cost, or value.
- Day 0 baseline
Record the inherited state once deeper observation becomes possible.
- First 100 days
Tie prioritized interventions to observed change and follow-up evidence.
Keep observed facts, management representations, and unknowns distinct through the transition.
4. The first 100 days should change the environment
A 100-day plan may include identity work, endpoint coverage, vulnerability remediation, recovery testing, segmentation, or changes to managed services. Project completion is useful, but it is not the final measure.
For each material intervention, record the starting condition, the work performed, the follow-up check, and what the environment showed afterward. That lets the sponsor distinguish real improvement from a list of completed projects.
5. Diligence should survive the deal
The pre-close record should not disappear into a data room after approval. Open questions should become Day 0 validation tasks, and Day 0 should become the reference point for operating partners and management.
That continuity keeps the deal team, operating team, management, and later insurance or exit diligence from rebuilding the same cyber history from scratch.
Evidence base
Sources and notes
External foundations are kept distinct from VitalSec implementation notes so readers can see what supports the argument independently and what documents the platform implementation.
External foundations and sources
VitalSec implementation notes
These links document how the argument is implemented or described inside VitalSec. They are not offered as independent validation of the paper's thesis.