When organizations consider mergers and acquisitions (M&A), the spotlight often falls on financials, brand synergy, and potential growth. Yet there’s another factor that increasingly demands attention: the digital frameworks connecting these companies to their customers, partners, and employees. Clark Sandlin, a cybersecurity consultant with over three decades of experience, points out that overlooking these underlying systems can lead to dire outcomes. Working closely with private equity firms and family offices, he has seen firsthand how gaps in cyber defenses can derail even the most promising deals.
Recently, he discussed how the human element shapes cybersecurity, what commonly goes wrong, and why carefully managed procedures can safeguard long-term success.
Moving Past Basic Checklists
Despite growing awareness, Clark observes that many M&A teams still treat cybersecurity as a formality. “They don’t really know all the deep dive aspects of cybersecurity,” he says. “It’s like they’re checking a box. They have a list—‘Do they have this in place?’—and the IT department or CIO simply says, ‘Yep, we do that.’ But the diligence needs to go further to verify those processes are actually being done.” Assigning these tasks to a financial analyst, rather than a true technical specialist, only compounds the problem. As Clark explains, “You have to have the actual hands-on experience to be able to find the actual issues within the network.”
Identifying Overlooked Vulnerabilities
Clark’s work often exposes serious vulnerabilities that surface too late. He recalls a private equity firm stepping back from an acquisition after discovering lingering issues that the target company had claimed were fixed years earlier. “The company had been attacked three years prior and claimed they had addressed all vulnerabilities,” he notes. “But when we went in, we found that not only were the remedies not being done, but some were being done improperly.”
He also points to a high-profile example: “They were ransomed because their backups weren’t being done. If they had been, they’d have been back up and running in no time.” Whether it’s outdated servers, sloppy patch management, or backups ignored because they’re “boring work,” these weak points can ultimately raise costs, demand new hardware, and complicate integration after a merger is finalized.
Understanding the Human Factor in Cybersecurity
Although sophisticated tools and cutting-edge software draw attention, Clark insists that people remain at the heart of cybersecurity. Even as AI technology advances, the challenges do not vanish. “AI makes it easier to hack,” he states. “You can use scripting tools to penetrate a network without doing the work yourself. Cybercriminals are always a step ahead of cybersecurity.” The human factor looms larger still when considering the common paths cybercriminals take. “Phishing and social engineering attacks are how most breaches happen,” he says.
Without active monitoring, updates, and training, no amount of automation can prevent these incidents. “Antivirus software and firewalls can be compromised because there’s always a person managing them. If they’re not being updated or watched, it’s pointless to have those tools in place.”
Culture, Training and Vigilance
For Clark, the key to effective cybersecurity during M&A isn’t found in a single product or a magic solution. “Don’t look for that one silver bullet that’s going to fix everything. There’s no single product out there that can solve your cybersecurity problems,” he advises. Instead, he encourages organizations to invest in people—employing competent, technologically astute staff and regularly testing their capabilities. Simulating phishing attacks and running social engineering exercises can sharpen awareness and improve response times. “You really need a trusted advisor to audit your processes and ensure they’re being followed. At the end of the day, it all comes down to a human process.”
Rethinking Risk Management
Clark’s perspective suggests that successful M&A involves far more than merging balance sheets. It requires examining the technology that underpins operations, understanding how human habits shape risk, and ensuring that basic tasks aren’t neglected. When companies create a culture of awareness, daily routines like confirming backups and monitoring network activity become second nature. “Technology is supposed to be for humans, not the other way around,” he reminds us. For firms navigating the delicate path of a merger or acquisition, acknowledging this interplay between technology and the people who manage it may well determine whether a deal thrives—or falls apart.
To learn more about Clark Sandlin and his approach, check out his LinkedIn profile or visit his website.
