In the used-car market, a "lemon" is a vehicle whose defects are hidden from the buyer. Distressed M&A has a direct analog: the cyber lemon — a target whose security debt is invisible in the data room and inherited in full at close. Buyers who price the balance sheet but not the breach exposure are systematically overpaying.
Why Distressed Targets Are Higher Risk
Distress and security debt are correlated, not coincidental. A company in financial trouble has spent the last several years deferring exactly the unglamorous investments that constitute good security: patching, monitoring, staffing, vendor review. The same pressures that produced the distress produced the cyber lemon.
What the Data Room Hides
Standard diligence checklists capture financials, contracts, and IP. They routinely miss:
- Unremediated incidents. A breach already happened; it just has not been disclosed or even detected.
- Dwell-time risk. An attacker is present in the environment now, and you would be buying their access along with the assets.
- Compliance liability. Latent regulatory exposure that converts to fines and remediation cost on your watch.
- Technical debt as security debt. Unsupported systems and abandoned integrations that cannot be patched at any price.
Pricing the Lemon
A credible cyber diligence does three things the financial model does not:
- Quantifies remediation cost. What will it actually cost to bring the target to a defensible baseline, and over what timeline?
- Estimates incident probability and impact. Not a checkbox — a real expected-loss figure that belongs in the deal model.
- Allocates the risk. Reps, warranties, escrow, and indemnification that put inherited cyber liability where it belongs rather than silently on the buyer.
The Strategic Read
The cyber lemon is not a reason to walk — it is a reason to negotiate. The technical debt is real and so is its cost, and a buyer who has quantified it holds the stronger position. The deals that go wrong are not the ones where the target had security debt. They are the ones where the buyer found out after the wire cleared.