A merger, acquisition deal or IPO is not where you build a security program, writes Matt Hillary, CISO of Drata. It’s where you defend years of effort put into what you’ve built. Leaders who come away with the deal intact built programs long before any transaction was on the table.
Whether you’re preparing an organization for an IPO or facing scrutiny during acquisition due diligence, the process goes much smoother when your security program is operating as expected. That doesn’t mean what’s documented in a policy or what your most recent auditor has attested to. It means what’s actually operating every day, protecting the company, defending the business and keeping deal conversations from getting knocked off track when an acquirer’s third-party firm starts looking for gaps.
Policies that exist on paper, controls that are documented but not enforced and risk registers that haven’t been actively managed don’t survive a motivated acquirer with a third-party security firm and 10 days in the data room.
With global M&A deal value rising to roughly $3 trillion in 2025, security and GRC leaders are taking on a new, more critical role at the go/no-go deal table.
Investors and acquirers are engaging these teams earlier and expecting them to both quantify risk and translate it into financial and legal impact in the context of a transaction. This shift is changing how security and GRC leaders contribute to deal decisions and what’s required of them when scrutiny is highest.
Security and GRC centers in decision-making
Until recently, security and GRC were not central to deal evaluation. Teams were often brought in too late into the process to validate controls, respond to diligence requests or produce documentation once a transaction was already moving forward. The role was reactive and largely focused on finding anything grossly negligent that might impact the overall risk of the acquiring company.
While some companies may still operate this way, rising breach costs and reputational risk mean this model no longer reflects how security, GRC and privacy show up in the deal evaluation process.
As organizations have become more dependent on digital infrastructure and third-party systems, the risk inherited through an acquisition can multiply. Previously unknown and exploitable vulnerabilities can directly affect revenue, disrupt operations and introduce regulatory exposure.
That shift in risk profile is driving a different level of scrutiny and engagement from security and GRC teams. Investors and acquirers are taking a closer look at how organizations manage risk, govern their control environments and make disclosure decisions. The focus has shifted to how actual risk is identified, assessed and managed in practice.
Gaps surface quickly at that level of scrutiny, potentially eroding deal valuations, delaying timelines and, in some cases, putting deals at risk.
The financial impact of security incidents reinforces that shift. With the average cost of a data breach reaching $4.4 million, according to IBM, a single gap can have material consequences. In a deal context, that risk can influence valuation and introduce additional conditions before closing.
How GRC and security leaders’ roles are shifting
Security and GRC leaders are increasingly involved earlier and more directly in the process, using more structured criteria in their assessments. They’re brought in to help assess and quantify risk as part of the transaction itself, not just respond to diligence requests. In some cases, their perspective can function as a genuine go/no-go input.
This changes the nature of the role. Security and GRC leaders now evaluate how controls operate in practice and use that understanding to inform decisions, rather than focusing solely on whether documentation exists.
5 Structural Barriers Breaking Your Cybersecurity Compliance Framework
Compliance challenges rarely stem from a lack of intent, but are often rooted in how systems and processes are designed.
Read moreDetailsDiligence compresses what would normally take weeks into a matter of days. Security and GRC leaders are pulled into sessions where they must answer detailed diligence questions in real time, often without the ability to step away and validate responses. Success depends on how quickly they can synthesize information and present a clear, defensible position to an audience evaluating risk from multiple angles.
That dynamic has shifted the role from managing a program to representing it under pressure.
Leaders are often required to translate complex findings into a view of risk that others can act on. That includes clarifying which issues matter, how they are being managed and what they could mean for the business. Those explanations can influence valuation, introduce conditions or change how a transaction moves forward.
There’s also an element of asymmetry. Acquirers may engage third-party firms to test systems and probe for weaknesses independently. They then compare those findings against what has been presented during diligence. Any gap between the two becomes a credibility issue.
These third-party firms may be tasked with breaching the target company to ascertain weaknesses in security defenses. A “breached” outcome could be used as evidence to quantify the cost of rectifying those gaps post-deal.
Lacking risk alignment is a critical pitfall
While the pace and intensity of diligence change how risk is evaluated, they also expose how differently risk is understood across the organization.
Security, finance and legal teams often look at the same issues through different lenses. Security focuses on security posture, configurations, vulnerabilities and control effectiveness. Finance is concerned with financially relevant, material impacts. Legal is focused on disclosure obligations, privacy, risk and exposure.
During a transaction, those perspectives converge quickly.
When that alignment isn’t already in place, friction shows up in high-stakes moments. Questions about whether a risk is material become harder to answer. Security, finance and legal teams may interpret the implications of a control gap differently depending on their perspective.
In those moments, decisions about how to classify risk, whether it needs to be disclosed and how it could affect the transaction are made without a shared framework, or even a shared vocabulary, for evaluating risk across functions.
This is where deal scrutiny changes how security and GRC leaders think about their roles. Identifying and managing risk within the function is not enough. Leaders are increasingly responsible for ensuring that risk is evaluated consistently and quickly across the business, especially when decisions cannot be deferred.
As organizations move toward IPO or face deeper diligence, attention shifts to systems that support financial reporting and material transactions. That includes enterprise platforms and the controls that govern access, change management and operations. These areas often sit outside the traditional focus of security teams, but they become central in a deal context and require closer coordination with finance and audit.
This also reinforces a broader shift in how the role is defined. Security and GRC leaders are responsible for ensuring that controls across the organization can stand up to scrutiny.
What effective security and GRC leadership looks like
Security and GRC leaders are increasingly operating as part of the decision-making process, working alongside finance and legal to assess how risk affects the outcome of a transaction. In practice, that means interpreting risk in context and communicating what it means for the business.
From what I’ve seen, even organizations that aren’t actively preparing for an IPO or transaction are already being held to these expectations. This is especially true in B2B SaaS companies, where a constant stream of customer inquiries requires ongoing proof of security posture and risk management. The way risk is understood, communicated and governed is tested when scrutiny increases, not when teams have time to prepare.
It runs the same on a quiet Tuesday as it does with an acquirer’s outside firm in the building. That’s the version that holds up under scrutiny. And it’s the only one that pays you back over time, in shorter diligence, steadier valuations and the kind of trust acquirers actually price into the deal.
Matt Hillary is senior vice president of security and chief information security officer (CISO) at Drata. He previously served in CISO roles at Lumio, Weave and Workfront. 
