M&A cybersecurity due diligence
Run buy-side or sell-side cybersecurity assessments, document security risks, track remediation, and organize a due-diligence package.
How Honey Built Acquisition-Ready Security in 5 Months
Honey needed acquisition-ready compliance and security to support a world-class acquirer. VioletX delivered every system in five months. The result: a $4B exit to PayPal.
Published January 20, 2026 by Megan Fulton.
Category: Customer Story
What you’ll take away
- The Challenge
- The VioletX Approach
- The Outcome
Our point of view
A useful diligence package helps people make and carry out a transaction decision. It makes evidence, limitations and the work remaining after close understandable.
Key points
- Organize evidence around material risks rather than document volume.
- Separate management representations from independently validated observations.
- Connect findings to accountable remediation and a practical handover.
When Honey was preparing for acquisition, security due diligence was not optional. Enterprise acquirers with mature procurement processes conduct thorough technical and compliance reviews, and a target company that cannot provide clear, credible answers to security questions creates risk in the transaction — risk that can delay a deal, reduce valuation, or derail it entirely.
VioletX worked with Honey to build acquisition-ready security infrastructure in five months — a timeline that would be impossible with a traditional compliance approach and was achievable only because of the operator-led model VioletX uses.
The Challenge
Honey's security posture was typical of a high-growth technology company: strong engineering practices, a security-conscious culture, and a compliance program that had not kept pace with the company's growth. The policies, evidence, and documentation that an acquirer would require existed in fragments across the organization — in engineering wikis, in vendor contracts, in the institutional knowledge of a small security team.
Assembling that documentation into a coherent, auditor-ready program in five months required a combination of speed, expertise, and operational capacity that Honey's internal team could not provide alone.
The VioletX Approach
VioletX embedded its program operators into Honey's operations immediately, conducting a rapid assessment of existing controls and documentation, identifying the gaps that presented the greatest risk to the acquisition timeline, and building a remediation plan that prioritized the evidence and documentation an acquirer would actually review.
- Rapid control gap assessment against SOC 2 Trust Services Criteria
- Evidence collection and organization for the twelve-month audit period
- Policy and procedure documentation aligned with actual operational practices
- Vendor security assessment for critical third-party relationships
- Preparation for acquirer security due diligence review
The Outcome
Honey entered its acquisition due diligence process with a complete, coherent security program — not a collection of disparate controls and incomplete documentation. The security review that might have created friction in the transaction instead provided confidence to the acquirer that Honey had built a mature, well-operated security posture.
Acquisition-ready security is not built in a weekend. But it can be built in five months, with the right operator.
How VioletX helps
Relevant work is scoped to your systems, responsibilities, and decision boundaries.
Risk assessments & security roadmaps
Maintain risk registers, prioritize remediation, and organize practical security improvement initiatives.
More information
Prepare evidence, identify material limitations and connect transaction findings to accountable post-close work.
The Portfolio Office: Cybersecurity due diligence & transaction readinessRelated reading
- Prepare cybersecurity evidence before transaction pressure arrives — Organize a risk-focused evidence package for buy-side or sell-side diligence.
- What cybersecurity diligence cannot tell you without technical validation — Distinguish documentary review from technical evidence and agree what can be established before close.
- What a penetration test does—and does not—tell your board — Interpret a scoped test without turning a point-in-time finding into an assurance guarantee.