The target was a mid-market SaaS. $80M enterprise value, 120 employees, healthcare-adjacent customer base. The deal partner wanted one slide for IC. Here's the math behind that one slide.
The Cyber Cost of Deal (CCOD) is a single number: the dollar-denominated risk the acquirer is taking on when they close. Not a risk rating. Not a heat map. One defensible number, built from five pillars, that survives cross-examination from the financial and legal workstreams at the IC table.
This is a worked example. The company, deal terms, and findings are representative — built from patterns across real diligence engagements. The math is real.
The target: what we're working with
Call it Meridian Health Analytics. $80M enterprise value. 120 employees across engineering, sales, and customer success. The platform ingests patient-adjacent data from hospital systems — not a covered entity itself, but close enough that every enterprise customer has a BAA on the table and HIPAA is a real exposure vector.
Revenue: $9.2M ARR. Net revenue retention: 118%. The deal economics are solid. The cyber picture is messier.
A company that isn't a HIPAA covered entity or business associate can still carry HIPAA exposure if it handles data that flows from covered entities. The liability attaches not at the regulatory level but at the contract level — BAA indemnification clauses, breach notification obligations, and termination rights baked into every enterprise contract. Meridian's top three customers represent 67% of ARR. All three have BAAs. All three have termination-for-breach-notification clauses.
The five pillars and the math
The CCOD model runs five independent risk pillars. Each produces an annual loss expectancy (ALE). The total is the CCOD. The remediation estimate is what closes the gap. The difference is the residual risk — the number that determines whether you take a price adjustment, set up an escrow, or pass to R&W.
Pillar 1: Identity and access management
What we found: shared administrative credentials on the production database. No MFA enforced on production systems. 47 dormant employee accounts — people who left in the last 18 months — still active in the identity provider. Three former contractors with live SSH key access to production infrastructure.
The risk: credential-based attacks are the entry point for 61% of breaches. With shared admin credentials and no MFA, an attacker who obtains them — through phishing, password spray, or dark web purchase — has direct production access with no second factor to stop them.
Threat probability: 35% annual likelihood of credential compromise given current IAM posture (industry benchmark for equivalent control gaps). Asset at risk: production database containing 2.1M patient-adjacent records. Impact: $450,000 (notification costs at $1.80/record × 2.1M × 11% likely-affected, plus $85K incident response retainer). ALE = 35% × $450,000 = $157,500
Remediation cost: $28,000. MFA rollout, IAM audit, dormant account cleanup, SSH key rotation, privileged access management tooling. Eight weeks elapsed time.
Pillar 2: Endpoint and infrastructure
What we found: no endpoint detection and response (EDR) deployed on 38 of 120 machines — primarily remote employee laptops onboarded during a hiring surge in 2023. Patch cadence: 74-day average for critical patches against a 30-day industry benchmark. Two servers running end-of-life OS versions with no vendor support or patch availability.
The risk: unmanaged endpoints are ransomware's preferred entry point. Without EDR telemetry, dwell time — the gap between compromise and detection — stretches from days to months. Every other control in the environment becomes less effective when you can't see what's happening on 30% of your endpoints.
Ransomware probability given EDR gap: 22% annual (healthcare sector benchmark with incomplete endpoint coverage). Incident cost: $115,000 median ransom payment (Verizon DBIR, 2024) + $185,000 operational downtime (8 days × $23,125/day revenue impact). ALE = 22% × $300,000 = $66,000
Remediation cost: $42,000. EDR deployment across all endpoints, patch management tooling, OS upgrade for end-of-life servers. Twelve weeks elapsed time.
Pillar 3: Compliance and regulatory exposure
What we found: three enterprise customers with active BAAs. No formal HIPAA training program for employees who handle customer data. Incident response plan last updated in 2022 and never tested in a tabletop exercise. No breach notification SOP mapped to the 60-day HIPAA clock. Security review of BAA obligations: never conducted.
The risk: even without being a covered entity, Meridian's BAAs create contractual HIPAA obligations. A breach that triggers the 60-day notification clock — and misses it — creates material contract exposure with the three customers who represent 67% of ARR. This is where compliance risk becomes revenue risk.
Probability of triggering BAA breach notification in the next 12 months given current IR posture: 18%. Customer termination exposure if notification is late or mishandled: $6.2M (67% of ARR, worst-case churn). Regulatory and legal exposure: $120,000 (legal defense; Meridian is not a covered entity so direct HIPAA fines are low probability). ALE = 18% × ($6.2M × 25% churn probability + $120,000 legal) = 18% × $1,670,000 = $300,600
Remediation cost: $85,000. HIPAA training program, IR plan update and tabletop exercise, breach notification SOP, BAA legal review and gap remediation. Sixteen weeks elapsed time.
Pillar 4: Third-party and vendor risk
What we found: two critical vendors with no SOC 2 report and no security assessment on file. The first is a data processing subcontractor that processes 340,000 records per month. The second is a cloud infrastructure provider handling data storage. Both vendor contracts lack security SLAs, right-to-audit clauses, and breach notification obligations to Meridian.
The risk: third-party breaches are increasingly the attack vector of choice precisely because they bypass the target's own security monitoring. A breach at the subcontractor can become Meridian's breach notification obligation — and Meridian would have no early warning, no right to investigate, and no contractual lever to compel cooperation.
Annual probability of a material third-party security incident propagating to Meridian: 15% (Ponemon Third-Party Risk Management Study, 2024). Cost if subcontractor breach triggers Meridian notification: $280,000 (notification, legal, customer communication, reputational management). ALE = 15% × $280,000 = $42,000
Remediation cost: $18,000. Vendor security assessments, contract addenda with security SLAs and right-to-audit provisions, ongoing vendor monitoring subscription. Ten weeks elapsed time.
Pillar 5: Incident response readiness
What we found: IR plan exists but is 18 months out of date. No IR retainer with a forensics firm. Security function is one person — a sysadmin who also manages compliance. No SIEM or centralized log aggregation; forensic reconstruction of an incident would require manual log review across 12 disparate systems. Tabletop exercise: never conducted.
The risk: slow detection and slow response multiply the cost of every other finding. IBM's research quantifies the premium: the mean cost difference between organizations with tested IR capability and those without is $1.49M per incident. Weak IR readiness is a force multiplier on every pillar above — it doesn't create new risk categories, but it makes every existing risk significantly more expensive when it materializes.
IR readiness premium: each of the four pillar ALEs above assumes baseline response capability. Without that capability, the aggregate ALE increases by approximately 30% (IBM Cost of a Data Breach, adjusted for company size and sector). Premium on aggregate of Pillars 1–4: ($157,500 + $66,000 + $300,600 + $42,000) × 30% = $566,100 × 30% = $169,830
Remediation cost: $65,000. IR retainer with forensics firm, SIEM implementation, log aggregation, tabletop exercise, IR plan update. Six weeks to initial readiness; ongoing quarterly review thereafter.
The CCOD number
Total Cyber Cost of Deal: $736,000 in annualized risk. Total remediation cost to close critical gaps: $238,000. Post-remediation residual risk: approximately $180,000 per year — the baseline ALE that persists after controls are implemented, representing normal cyber risk for a company of this size and sector.
The one-page IC slide
The IC doesn't want five pillars. They want one number and a recommendation. Here's how the slide reads:
Cyber Cost of Deal — Meridian Health Analytics
Annualized cyber risk at close: $736K
Cost to remediate critical gaps: $238K
Residual risk post-remediation: $180K/year
Primary exposure: HIPAA-adjacent compliance risk tied to top-3 customer BAAs representing 67% of ARR. Secondary exposure: IAM gaps enabling credential-based production access.
Recommendation: $238K remediation escrow released at 90-day post-close milestone when critical controls are independently verified. Alternatively: $200K purchase price adjustment with 24-month R&W indemnification, with known findings explicitly excluded from the carve-out.
The slide survives IC because every number is defended. The legal workstream can stress-test the compliance ALE. The financial workstream can validate the remediation estimate against vendor quotes. The recommendation gives the IC two clean commercial options rather than a vague ask to "address the cyber issues before close."
What makes a CCOD number defensible at IC
Source every probability
Threat probabilities must reference published benchmarks — IBM CODB, Verizon DBIR, Ponemon — adjusted for industry and company size. "We estimated" doesn't survive IC cross-examination. "Per IBM Cost of a Data Breach, healthcare sector, companies with 100–249 employees" does.
Scope asset values precisely
Don't use a round number for the database. Use actual record count × actual cost-per-record from breach notification vendors. Don't estimate ARR exposure — use the actual contract values and review the termination clause language.
Separate annualized risk from incident cost
The CCOD is an annual loss expectancy — a probability-weighted average, not a worst-case scenario. The IC needs to understand this or they'll read $736K as a guaranteed loss. Explain the distinction explicitly in the appendix slides.
Build the remediation estimate from quotes
Get at least two vendor quotes for each remediation line item before the IC. The $238K remediation number is what drives the commercial negotiation — it needs to be as defensible as the risk number itself.
Show residual risk separately
Perfect remediation doesn't exist. The residual risk number — what survives after the escrow spend — tells the IC what they're accepting as the normal cost of running this business. Hiding it creates problems at the 90-day review.
How the CCOD connects to the commercial negotiation
The CCOD number is an input to three possible commercial outcomes: a purchase price adjustment, a remediation escrow, or reliance on R&W insurance. Each transfers risk differently, and each has different mechanics — but all three require a quantified number to be actionable. Without the CCOD, you're asking the seller to accept an unspecified haircut for unspecified cyber risk. That conversation doesn't go anywhere.
For a detailed look at which commercial option works in which situation, see R&W Insurance or Price Reduction: How to Use a Quantified Cyber Number at the Negotiating Table — including why R&W isn't the default it appears to be once you understand the known-findings carve-out.
For the deal-team process that gets you to a CCOD before the IC meeting, the PE Buyer's Playbook for Cyber Due Diligence walks the LOI-to-IC sequence in detail, including what to scope at each stage and how to run the technical assessment in parallel with the legal and financial workstreams.
The five-pillar ALE methodology used here is also the framework that makes individual cyber findings legible to non-technical boards and CFOs. If you're translating cyber risk for a board audience outside of M&A context, the same underlying approach applies — see how to quantify cybersecurity risk in dollars for the board-facing version of the same math.
When the target company handles PHI — a common pattern in healthtech, digital health, and payer/provider software acquisitions — the diligence work overlaps with the HIPAA readiness assessment the acquirer will inherit from day one. See HIPAA Compliance Software: 2026 Buyer's Guide for the six platforms that manage that program post-close, and how each handles the BAA chain the acquirer takes on.
Run this methodology on your next deal
The five-pillar CCOD framework in this article is the methodology behind vCISO Lite's Quantitative Cyber Diligence platform — purpose-built for PE deal teams who need a defensible dollar number before IC, not a 40-page report that lands two days before the meeting.
If you're a deal team, operating partner, or M&A advisor running cyber diligence today — or trying to build a repeatable process across your fund — visit diligence.vcisolite.com to learn more and get started. The platform handles the data room, the five-pillar scoring, the ALE calculations, and the IC-ready CCOD output. You bring the deal.