Cybersecurity Risk Assessment In M&A Deals: What Investors Often Miss A Note From Serhii Mikhalap

In the high-stakes world of mergers and acquisitions (M&A), cybersecurity remains one of the most underestimated areas of due diligence.

While financial audits, legal compliance, and cultural alignment often dominate investor discussions, critical digital vulnerabilities can go undetected until they become multimillion-dollar liabilities.

Serhii Mikhalap, a cybersecurity expert and incident responder with over eight years of hands-on experience, has seen this story unfold repeatedly.

He began his career in 2016 as an analyst in Ukraine’s national Security Operations Center (SOC), investigating advanced persistent threats (APTs) targeting critical infrastructure.

Since then, he has built full-scale SOCs for global cybersecurity providers, led commercial incident response teams, and co-founded a security-as-a-service startup working with fintech, crypto, and transactional platforms.

Serhii’s work has earned national recognition in Ukraine’s professional cybersecurity community.

In 2022, he was awarded the “Znak Yakosti” (Quality Mark) distinction by an expert commission for his contributions to digital forensics, incident response, and information security strategy.

In 2023, he received the “Award for High Reputation,” a national honor recognizing business leaders for ethical conduct, quality, and consistency.

This recognition reflects not only his technical expertise but also his principled approach to client partnerships and industry collaboration.

His trajectory offers a rare perspective into the risks investors often overlook—and the cost of missing them.

Hidden Liabilities In Tech-Focused Deals

“In fast-growing startups and mid-sized fintechs, cybersecurity posture is often the last thing founders think about,” says Mikhalap. “They’re focused on growth, not resilience.”

But when these companies become M&A targets, unaddressed vulnerabilities can threaten the deal itself.

From unmonitored privileged access and misconfigured cloud infrastructure to outdated third-party integrations, Serhii’s team regularly uncovers risks that would never appear in a financial report.

“These aren’t theoretical issues they’re active exposures,” he explains. “And buyers may not discover them until after they assume responsibility.”

One common blind spot? Cultural attitudes toward security. “If leadership views security as a compliance checkbox or cost center, that’s a red flag. You’re not just acquiring systems you’re inheriting mindset.”

From National Threat Response To Commercial Security Leadership

Serhii’s foundation in cybersecurity was forged under pressure.

Working inside a Ukrainian national SOC during a period of heightened cyber conflict, he participated in responses to some of the region’s most sophisticated APT campaigns.

This high-stakes environment cultivated a sharp eye for attacker behavior, cross-sector threat modeling, and real-world impact assessment.

In 2020, he transitioned to the commercial space, where he led incident response and later built two Security Operations Centers for global service providers.

Under his leadership, these SOCs implemented 24/7 monitoring, playbook-driven triage, and scalable automation helping organizations in regulated environments like fintech and payments maintain compliance and continuity.

Today, as co-founder of a cybersecurity startup, Serhii oversees high-impact assessments for fast-moving startups and small businesses.

His company specializes in penetration testing, risk assessments, digital forensics, and incident response, with a focus on crypto, banking, and transaction-heavy platforms. The team’s strength lies in speed, clarity, and actionable results.

Serhii has also mentored junior analysts and participated in industry discussions on improving SOC maturity models, sharing insights from his operational leadership experience with cybersecurity teams across Eastern Europe.

Lessons From The Field: Real Risks In Real Deals

“Investors often ask: ‘Has this company had a breach?’” says Serhii. “But the better question is: ‘How ready are they for one?’”

In one recent case, a client preparing to acquire a SaaS platform learned through Mikhalap’s assessment that administrator credentials were hardcoded into the public-facing JavaScript a security lapse exposing more than 200,000 user accounts.

The deal was delayed while mitigation efforts took place.

Other times, his team finds dormant infrastructure, unpatched vulnerabilities, or insecure CI/CD pipelines that attackers could weaponize.

“These are issues that impact valuation, risk transfer, and even brand perception,” he notes.

His approach emphasizes not just detection but preparedness: how well the company would handle a breach if it happened tomorrow.

“Cybersecurity is no longer just about protection it’s about resilience. It’s about your ability to adapt under fire.”

In several engagements, his company’s reporting helped investors renegotiate deal terms based on newly discovered risks, or allocate post-acquisition remediation budgets more strategically.

The result: stronger deal execution and fewer operational surprises.

Recognition And Impact

His efforts contribute to improving cybersecurity standards in Ukraine and beyond through operational leadership, mentorship, and a commitment to clarity in complex environments.

He continues to advise growing companies on how to scale securely, while staying responsive to evolving threats.

What Investors Should Do Differently

“Bring in cyber experts early,” Serhii advises. “Don’t wait for red flags to appear after the deal closes. If you’re doing financial due diligence, digital due diligence belongs at the same table.”

He highlights three questions every investor should ask:

1. Incident Readiness: Is there a tested and documented incident response plan?

2. Access Control Hygiene: Is privileged access logged, reviewed, and restricted by policy?

3. Third-Party Exposure: What platforms or vendors does the business depend on, and how secure are those relationships?

“Security gaps aren’t just technical they’re strategic,” Serhii says. “And the earlier you understand them, the better positioned you are to manage risk intelligently.”

Looking Ahead

With more M&A activity involving cloud-native, API-driven, and decentralized businesses, cybersecurity is no longer a niche concern it’s a deal-shaping factor.

As new risks emerge from supply chain integrations, remote access tools, and generative AI systems, investors need experts who can see beyond checklists.

Serhii Mikhalap is part of that next generation of cybersecurity leaders combining deep technical fluency with real-world operational judgment. His message to investors is clear:

“Don’t assume security is in place. Make it part of your core thesis. Because today, resilience is value.”