Request demo

Mergers and Acquisitions Due Diligence

Diligence on the Surface the Target Runs.

Cyber due diligence usually rests on the target’s own answers and one scan inside the deal window, and neither shows what the target doesn’t know it runs. Start from its primary domain and map what it exposes, how that has changed, and what it brings in on the day the deal closes.

Request demo

target.example

  1. from the index

  2. registered

    WHOIS history

  3. A value

    DNS history · A

  4. registration details changed

    WHOIS history

  5. infrastructure moved

    DNS history · A

  6. added as portfolio

  7. High end-of-life software

    Findings

  8. Critical CVE in CISA KEV

    for the deal memo · Findings

  9. Deal closes

  10. inventory ready for day one

What the Data Room Doesn’t List.

Inventory

Assets the Target Lost Track Of

Old campaign domains, regional sites, staging servers and the infrastructure of the target’s own past acquisitions.

Exposure

Issues Nobody Disclosed

Exposed services, expiring certificates, end-of-life technology and CVEs already listed as exploited.

History

What Happened Before the Deal

One scan shows a moment. The deal team also needs to know when domains were registered, when their records changed and when infrastructure moved.

What the Target Owns Before You Do.

Discovery follows every relationship the index can see: subdomains, the IPs they resolve to, the other domains on those IPs, and domains that share a registrant, name servers or mail servers. The target’s real inventory is the result.

  1. Root domain

    target.example

    IP address

  2. www.

    443/tcp · TLS 1.3

    203.0.113.50

  3. mail.

    MX · SPF record

    203.0.113.51

  4. Asset discovery

    not in inventory · found from the root

  5. old-campaign.

    Certificate expiring Medium

    198.51.100.64

  6. eu.

    PHP 7.4 · end of life High

    198.51.100.81

  7. staging.

    Apache httpd 2.4.49 High

    CVE-2021-41773 Critical KEV

    203.0.113.57

From Mapping the Target to Integration.

  1. 01

    Map

    Add the target’s primary domain as a portfolio and review what Asset Discovery proposes. Pivots on registrant, name servers and mail servers find group companies and inherited domains.

  2. 02

    Assess

    Each approved asset is scanned across all data layers. Risk Detection raises findings with evidence, classified against OWASP Top 10 2021, PCI DSS, HIPAA, CWE, CAPEC and WASC.

  3. 03

    Weigh

    Risk Scoring ranks CVEs by CVSS, EPSS and CISA KEV and scores each asset and domain. The KEV-listed findings belong in the deal memo.

  4. 04

    Integrate

    At close, the inventory built during diligence becomes the starting point for monitoring the acquired company as part of your surface.

What Changed Before You Looked.

Monitoring history starts when monitoring starts. For the time before that, Deep Search & Insights has what the index observed: each WHOIS record and DNS value a domain has had, with its dates.

That tells a deal team when a domain was registered, when its registration details changed where the registry publishes them, and when its infrastructure moved.

WHOIS History APIDNS History API

Request

# Every A record value observed, with observation times
curl "https://api.deepinfo.com/v1/analyze/dns-history?domain=target.example&type=A" \
  -H "apikey: YOUR_API_KEY"

Response

200 OK · application/json 
{
  "fqdn": "target.example",
  "dn": "target.example",
  "subdomain": null,
  "records": [
    {
      "type": "a",
      "values": [
        { "value": "203.0.113.50",
          "time": ["2026-09-18T05:41:26Z", "2025-11-02T08:10:44Z"] },
        { "value": "198.51.100.23",
          "time": ["2025-10-27T16:37:59Z", "2023-04-11T09:02:13Z"] }
      ]
    }
  ]
}

More Checks for the File.

Lookalike Domains

Names close to the target’s brand, registered by someone else, with mail servers or a live page. Domain Search finds them with a fuzzy name filter.

Domain Search

The Dark Web

Search the dark web index for the target’s email domain and brand names, and read what is listed or discussed.

Dark Web Search

Other TLDs

The same name under other TLDs, held by the target or by someone else, in one call.

All TLDs

Where Discovery Found Inherited Infrastructure.

Customer story An industrial conglomerate Discovery surfaced infrastructure inherited through acquisitions across 30+ subsidiary brands. Read Customer story An academic publisher Discovery surfaced journal infrastructure that came with acquired titles. Read Use case Subsidiary Oversight What happens after close: the acquired company as one more monitored entity. Read

Questions About Mergers and Acquisitions Due Diligence

Does the target have to know?

The work reads the target’s internet-facing side and needs nothing from the target. How and when to involve the target is a decision for your deal team and its advisers.

Is the scanning intrusive?

No. Standard monitoring runs no authenticated scans, no exploit attempts and no load tests, and port scans and web requests reach only what a host already exposes to the internet.

How far back does the history go?

As far as the index observed each domain. WHOIS and DNS history come from Deepinfo’s collection and don’t depend on when you started monitoring. Scores and per-asset history start when the target is added.

Can we compare the target with our own surface?

Yes. The target runs as a portfolio on the engine that scores your surface, so its scores and yours share one scale.

What does an outside-in assessment miss?

Anything that can’t be seen from the internet: internal networks, endpoint controls, policies and people. The data room and the target’s answers still cover those.

What happens after the deal closes?

The inventory built during diligence becomes the starting point for monitoring the acquired company, as part of your own surface or as a portfolio of its own. See Subsidiary Oversight.

See the Target’s Surface Before You Sign.

Bring a target domain to a demo and review the discovery, the findings and the history with our team.

Request demo