OT Security Due Diligence.
When you buy an industrial business you buy its plant, its controllers and its unmanaged remote access. We put engineers inside the target's operational technology before you sign — and price what we find.
Cyber risk in an industrial deal is lost production, not lost data.
01 · The gap in the deal process
Cyber diligence covers the office. The value is in the plant.
Standard technology diligence reviews the corporate estate — identity, endpoints, cloud, GDPR exposure. It rarely goes past the IT/OT boundary. Yet in a manufacturing, energy, water or logistics target, the earnings sit behind PLCs, SCADA and a handful of vendor connections nobody has inventoried. That risk is unpriced in most transactions, and it lands on the buyer on completion day.
Deal room01
Where the deal is run
Advisers, models and a timetable. Cyber appears as one line in the technology workstream.
Data pack02
What the target discloses
IT policies, an ISO certificate, a penetration test of the corporate network. Almost nothing below the boundary.
Plant03
Where the earnings are made
Legacy controllers, flat networks, vendor dial-in, and a recovery time nobody has ever measured.
Diligence stops at the second frame. The liability lives in the third.
Technology diligence providers
The scope stops at the firewall
Strong on cloud, identity and data protection. But no one on the team has commissioned a PLC, and the target’s control systems are recorded as “out of scope” or taken on trust.
We are the OT half of the workstream.
Buy-side deal teams
No way to test what they are told
The target says the plant is segmented and backed up. Without an engineer on site there is no means to verify it inside the exclusivity period — so it becomes an assumption in the model.
We verify on the floor, in your window.
Vendors in a sale process
Surprises found by the buyer
Unmanaged remote access or an unrecoverable controller discovered late becomes a price chip, an indemnity or a delay — at the worst possible moment in the process.
We find it first, and close what is cheap.
Post-deal integration
A report nobody can execute
Findings arrive as a risk register with no owner, no cost and no sequence. Twelve months later the same issues appear in the group’s own audit.
We deliver the remediation ourselves.
02 · What it is
An engineering opinion on the asset, written for the deal team.
We assess the target's operational technology the way we would assess a plant we were about to be accountable for: what is installed, how it is connected, who can reach it from outside, what happens if it stops, and how long it would take to bring back. Where access allows we do it on site, walking the process areas with the target's own engineers.
The output is not a maturity heat map. It is a costed, sequenced set of findings expressed in the language a deal runs on — capex, EBITDA impact, warranty exposure, day-one actions and the two or three items that genuinely bear on price.
Findings priced · not scored
03 · Site validation
The single most valuable thing we do on a deal is turn up at the site.
Everything else in diligence is someone's account of the asset. Site validation is the part where an engineer stands in the plant, opens the panel and establishes what is actually true. It is where the material findings come from, and it is what makes a deal case defensible rather than assumed.
On the asset · with the target's own engineers
On the asset
An engineer stands in the plant, opens the panel, and establishes what is actually true.
Multi-site estates
Where a target has ten plants we validate a representative sample — the largest earner, the oldest asset and the one with the most external connections — then extrapolate with a stated confidence level rather than a guess.
Discreet by design
Visits are arranged as engineering or insurance reviews where the process requires it. Our people look and sound like plant engineers, because they are, so a walkdown does not unsettle a workforce that has not been told about the deal.
No access, no bluff
If the process will not permit a site visit we say plainly which findings we can and cannot stand behind, and what we would insist on as a condition or warranty instead. We do not dress up a document review as verification.
04 · Pre-deal & post-deal
We work both sides of completion — and that is the point.
Diligence houses stop at signing. Integrators start after it. The findings fall down the gap between them. Because the same engineers do both, the numbers in our report are numbers we are prepared to deliver against.
Before you commit, we tell you what you are buying.
From an initial sector screen through to confirmatory diligence and SPA support, we build the engineering picture of the asset while the terms are still open — so what we find can still move price, clauses and conditions.
- Asset and obsolescence position, costed
- Site validation of the primary plants
- Downtime and lost-production exposure
- Warranty, indemnity and condition input
- Red-flag report and IC briefing
Findings arrive while they are still negotiable.
After close, we fix it — with the same engineers.
The report becomes a funded programme. We deliver day-one controls, close the quick wins in the first weeks, and run the remediation site by site around production windows until the asset meets the standard you hold it to.
- Day-one access, backup and escalation controls
- First-100-days remediation delivery
- Integration to the acquirer’s OT standard
- Carve-out separation of shared OT infrastructure
- Evidence pack for group assurance and regulators
The plan is delivered, not handed over.
Our OT expertise is what makes the deal case strong. Not a benchmark, not a questionnaire — people who have written the PLC code, commissioned the line and recovered the plant, giving the investment committee an engineering opinion it can rely on and then executing against it after close.
05 · Across the deal
How we help, stage by stage.
We can join at any point, but the earlier we are in, the more of the finding is still negotiable. Engagements are scoped to the timetable you already have.
06 · Scope of examination
What we look at inside the target.
Eight lines of enquiry. Each one is scored for deal impact — price, warranty, day one, or post-close capex — so nothing lands in the report that the deal team cannot act on.
07 · Deal impact
What a finding actually changes.
A diligence report that does not move a number, a clause or a plan was a waste of the fee. Every finding we raise is tagged to one of these four outcomes.
08 · Deliverables
What lands in the data room and the IC pack.
09 · Why Nuvantiq
We can also fix what we find. Most diligence providers cannot.
01
Engineers, not reviewers
Our people have written the PLC code, configured the switch and recovered the plant. Target site engineers talk to us candidly, which is where the real findings come from.
02
We speak deal, not maturity model
Findings arrive as cost, exposure, clause and sequence. No heat maps, no alphabet soup, nothing an investment committee has to translate.
03
Diligence and delivery from one team
The people who found it can fix it. That keeps the 100-day plan honest — we will not put a number in a report we would not be prepared to deliver to.
04
We work to your timetable
Site visits arranged without alarming the workforce, findings delivered inside exclusivity, and a straight answer when the window is too short to be certain.
Buy-side · funds & corporate development
You need to know whether the asset can keep producing, what the remediation bill really is, and which findings belong in the SPA rather than the integration plan. We give you a costed engineering view before you commit, and a day-one plan if you proceed.
Sell-side · vendors & exit preparation
Buyers will find the unmanaged vendor access and the unbacked-up controllers. Better that you find them first. We run vendor diligence, close the cheap items before the process opens, and give you defensible answers for the ones that remain.
Portfolio & post-deal
Across a portfolio of industrial assets you need one comparable view of OT risk, and delivery capacity to act on it. We assess to a consistent method, report to the same format, and remediate site by site with our own engineers.
Live deal, or one in the pipeline
See the asset before you own it.
Send us the target, the sector and the timetable. We will tell you within a day what can be assessed in the window you have — and what it will cost.