Someone Else's Debt

Cyber risk in M&A gets treated as a compliance check, a heat-map of red and yellow boxes, or a problem to deal with after close. By then it is too late.

Quantitative Cyber Diligence (QCD) replaces qualitative cyber diligence with a five-pillar framework that produces a single dollar-denominated figure the investment committee can argue about — calibrated, defensible, and reproducible. Each pillar maps to a measurable exposure: external attack surface, vendor concentration, data sensitivity, security program maturity, and integration risk. The framework aggregates per-pillar exposures with explicit correlation discount, surfaces tail-driver scenarios that conventional analysis misses, and translates the aggregate figure into deal-architecture recommendations: reps and warranties, escrow, price adjustment, or walk-away.

This book documents how QCD engagements actually run. Two worked examples (healthcare-IT and industrial-IT). Practitioner templates. Per-pillar pseudocode. Industry loss benchmarks. The complete framework, calibrated to the post-Change-Healthcare era.