Security diligence checks how a company protects systems and customer data, what incidents it has had, and whether it meets the obligations its customers and regulators expect.
10 min read · Level 3
'We take security seriously' is, in my experience, the phrase least correlated with actually doing so. The useful questions are specific and slightly uncomfortable - who can see customer data right now, and when did someone last try to break in on purpose - and a well-run company answers them without difficulty.
Security diligence does not require an investor to be a security expert. It requires asking the right questions and knowing when to bring in one.
Area Questions Access Who can reach production systems and customer data? Is access removed when people leave? Authentication Is multi-factor authentication required for staff and admin tools? Data What personal or sensitive data is held, where, and is it encrypted? Testing Has an independent penetration test been done, and were findings fixed? Incidents Have there been breaches or near misses? Were customers or regulators told? Obligations Which data protection laws apply? What do customer contracts require? Certifications Are certifications such as SOC 2 or ISO 27001 held or required by customers?
The level of scrutiny should match the risk. A company holding health, financial or children's data needs far more than one holding public product catalogue information.
Because a serious breach can trigger regulatory penalties, contractual claims and customer loss at the same time - an existential event for a small company.
Security requirements also affect growth. Enterprise customers often require certifications and security reviews before buying.
This is educational information, not legal advice. Rules differ by country and change — get advice from a qualified professional in your jurisdiction before acting.
Educational, not personalised financial advice. Nothing in the Investor Academy is a recommendation to buy, sell or hold anything — what is right for you depends on your own circumstances and the rules where you live.
Sources: European Data Protection Board; UK Information Commissioner's Office; U.S. FTC - Data security guidance
Diligence on a company selling to hospitals.
Holds patient-related data yes Multi-factor authentication for staff partial Last independent penetration test never Enterprise customers requiring certification 3 of the next 5 largest deals Estimated time and cost to certify 9 to 12 months, significant external cost
The security gaps are a risk and a sales blocker. The investor asks for a funded plan and treats the certification timeline as a constraint on the revenue forecast.
Treating security as a technical detail rather than a commercial and legal risk, or accepting 'we take security seriously' as an answer.
Identify how sensitive the company's data is.
Cover access, authentication, encryption, testing and incidents.
Review what customers and regulators require.
Use an independent security review for high-risk companies.
During diligence on any company holding customer or personal data.
Do not demand enterprise-grade certification from very early companies that do not yet sell to customers requiring it; judge the plan.
Data protection authorities, including European regulators enforcing the GDPR, have issued public fines against companies for failures to protect personal data, and regulators publish enforcement actions describing the security failures involved.
Security failures can become regulatory and financial events, not only technical ones.
Create a free account to read the rest and apply it to your own investing.