What technology due diligence usually misses.

Every deal now has a technology dimension. Platform scalability, cybersecurity posture, AI capability, technical debt, team execution risk: in many transactions, these are the deal thesis rather than peripheral concerns.

The typical technology diligence report catalogues findings and classifies risks, leaving the translation into financial consequences to others who are rarely equipped to perform it. Material risks are missed, or noted but not quantified, until they surface post-acquisition when the investor’s options have narrowed considerably.

Technology risk surfaces in the hold period: when the business plan is not delivering, the platform is not scaling, or a cybersecurity incident exposes a liability that was visible in the data room. Technology due diligence exists to find these issues before capital is committed.

Commercial translation.

Cyber Partners assesses the full technology, AI, and cybersecurity landscape of a target business and translates every significant finding into its effect on valuation, deal structure, and investment thesis: technical debt quantified in dollar terms, cybersecurity gaps mapped to insurance and remediation costs, AI capability claims tested against the underlying architecture, and execution risks identified and costed against the business plan.

“The question a PE partner needs answered is never ‘what is wrong with the technology?’ It is always ‘what does this mean for the deal?’”

A rapid assessment over two to four weeks. Identifies material technology, AI, and cybersecurity risks to inform the go/no-go decision and scope of Phase 2.

Comprehensive assessment over three to six weeks, covering all technology and cybersecurity matters with potential impact on the transaction. Final report covers material risks, remediation costs, and their effect on valuation and deal structure.

Advisory support through the negotiation and finalisation of transaction documentation, including Q&A from lenders and co-investors. The same practitioner throughout.

What engaging Cyber Partners looks like.

Contact Cyber Partners to discuss the technology dimensions of your next deal. Initial conversations are confidential and without obligation.

Translating the recommendations in the due diligence report into a sequenced, costed remediation plan: what to address before Day One, what to address in the first 100 days, and what forms part of the broader transformation programme.

Where cybersecurity gaps were identified during diligence, advisory support covers governance, policy, architecture, and control framework development, as well as vendor selection where external implementation resources are required.

Advisory on technology strategy decisions arising during the hold period, including platform modernisation, cloud migration, system replacement, and the technology changes needed to support scaling.

Where diligence identified technology leadership risk, Cyber Partners can provide interim advisory support and assistance with leadership assessment and recruitment brief development.

On your terms.

Transformation advisory engagements are structured to the needs of the portfolio company and the timeline of the investment thesis. They can be scoped as a discrete advisory programme with defined deliverables, or as an ongoing retainer providing senior technology advice throughout the hold period.

The client for this service is the acquired business. Instruction typically comes from the incoming management team, the portfolio company board, or the PE firm’s operating partner, acting on the recommendations in the due diligence report.

The practitioner who found the issues is best placed to advise on how to fix them.

Technology strategy

Independent advisory on technology direction, architecture decisions, vendor strategy, and build-versus-buy choices for boards and leadership teams requiring an external perspective.

AI strategy

Independent assessment of how artificial intelligence can be applied effectively within a business, what genuine AI capability looks like versus marketing characterisation, and how to evaluate AI investment proposals critically.

Cyber strategy

Board-level advisory on cybersecurity strategy, governance, and investment decisions for boards and executive teams assessing their obligations, risk posture, and governance frameworks.

Boards, executives, and investors.

Technology and AI strategy advisory is most relevant to boards with limited technology representation; to investors assessing technology-intensive companies where a second opinion on the strategy is needed; and to executive teams at a point of significant technology investment requiring independent advisory support.

Engagements are structured to the specific requirement, from a single advisory session to an ongoing board-level advisory relationship.

Directors are now assessed on cyber oversight. Very few boards have been trained for it.

Since the Federal Court’s 2022 decision in ASIC v RI Advice Group, cyber risk sits squarely inside a director’s duty of care under section 180 of the Corporations Act. The AICD and Cyber Security Cooperative Research Centre’s Cyber Security Governance Principles, now in their second version, have become the benchmark against which that duty is assessed.

Training closes the gap between that standard and what directors are actually equipped to do in the room: what to ask, what a credible answer sounds like, and where the red flags sit.

The Federal Court found that reliance on digital systems means cybersecurity risk forms a significant risk connected with the conduct of a business, placing it firmly within the board’s duty of oversight.

Board & Director Training

One-off or programmed sessions, in person or remote, that build director fluency in cyber, technology and AI risk. Built for the board table rather than the server room: what to ask, what a credible answer sounds like, and where the red flags sit.

Cyber Crisis Simulation for Boards

Board-level crisis simulations, including ransomware scenarios, that test the decisions directors actually have to make: whether to pay, when to notify, and what to tell the market, not only whether a technical playbook was followed.

Cyber & AI Maturity Advisory

Independent review of maturity against the NIST Cybersecurity Framework, the ASD Essential Eight, ISO 27001 and the ISM, translated out of technical language and into a position the board can state with confidence.

Director Training Services

A three-page overview of the training and advisory practice, including track record, engagement models and practitioner background. Suitable for circulating to a board or nominations committee ahead of a conversation.

A director’s duty now includes cyber. Discharging it requires independent expertise.

Since the Federal Court’s 2022 decision in ASIC v RI Advice Group, cyber risk sits squarely inside a director’s duty of care under section 180 of the Corporations Act. The AICD and Cyber Security Cooperative Research Centre’s Cyber Security Governance Principles, now in their second version, have become the benchmark against which that duty is assessed.

Most cyber advice that reaches a board arrives either from a technical vendor running a programme built for an IT audience, or filtered upward through the same management the board is meant to be overseeing. Neither is independent, and neither is built for the boardroom.

The Federal Court found that reliance on digital systems means cybersecurity risk forms a significant risk connected with the conduct of a business, placing it firmly within the board’s duty of oversight.

Retained Board Advisor

Ongoing, independent advice to the board or risk committee across cyber, technology and AI governance. Priority access between meetings, briefing papers ahead of board cycles, and a standing point of independent expertise the board can call on.

Independent Governance Assurance

External expert assurance where the board has a gap in its own cyber, technology or AI governance capability: a named, independent practitioner the board can point to as evidence it has taken its oversight duty seriously.

Cyber & AI Maturity Advisory

Independent review of maturity against the NIST Cybersecurity Framework, the ASD Essential Eight, ISO 27001 and the ISM, translated out of technical language and into a position the board can state with confidence, to itself, to regulators and to the market.

Board Advisory Services

A three-page overview of the advisory and training practice, including track record, engagement models and practitioner background. Suitable for circulating to a board or risk committee ahead of a conversation.

Tony Barnes

Tony Barnes is the founder and lead practitioner of Cyber Partners, and the person who leads every technology and cyber due diligence engagement the firm undertakes. He brings to each mandate a combination of technical depth, commercial judgement, and direct experience on both sides of the investment committee table.

Tony’s career spans more than three decades of senior executive and non-executive roles across technology, critical infrastructure, telecommunications, software, and cybersecurity sectors in Australia, New Zealand, the United Kingdom, Europe, and the United States. He has founded, scaled, acquired, and exited technology businesses, including serving as chief executive of a public technology company ranked sixth in the Deloitte UK Fast50 and 17th in the EMEA Fast500.

In parallel with his executive career, Tony has served as a non-executive director of national critical infrastructure companies, including a major electricity distribution network and a fibreoptic telecommunications network, and currently serves as a non-executive director of RSPCA Queensland and RSPCA Australia.

Tony is a Certified Information Systems Security Professional (CISSP), a Fellow of the Governance Institute of Australia. He has led technology and cyber due diligence on transactions from A$30M to US$3.5B across multiple sectors and geographies. Every Cyber Partners engagement is led by Tony personally — there is no delegation to junior practitioners and no handoff between diligence and reporting.

Cyber Partners