In a new article, Rich Ferraro argues that private equity buyers lose the most money in AI and cybersecurity, the areas most deal teams still review last, and offers eight questions to close the gaps.
THOUSAND OAKS, Calif. – Compello Partners, an operator-led technology consulting firm serving private equity sponsors and their portfolio companies, has published a new article by CEO and Managing Director Rich Ferraro on where pre-close technology reviews most often fall short. In “The Million-Dollar Blind Spots in IT Due Diligence: AI and Cybersecurity,” published on LinkedIn on November 13, 2026, Ferraro identifies six recurring gaps in how deal teams assess AI and security risk, and sets out eight questions buyers can ask on their next transaction.
A carve-out that skipped diligence
Ferraro opens with an engagement Compello joined after a sponsor closed on a $200 million carve-out from a $20 billion parent while folding in a $40 million manufacturer. No IT due diligence had been done before close. The ERP integration proved far harder than expected, separating servers and networks from the parent was a major undertaking, and outsourced IT the buyer had budgeted at about $150,000 came in at more than $1 million. With diligence up front, he writes, most of that gap would have been a price conversation rather than a hole in the hold-period plan.
“Here’s an unpopular view from someone who sells diligence: IT due diligence rarely kills a deal,” Ferraro wrote. “What poor diligence does is cost money.”
Why the blind spots have moved
According to the article, the standard diligence checklist of ERP, infrastructure, headcount and IT spend has changed little in a decade, but the value has shifted. AI now often features in the growth story of a target’s confidential information memorandum, and cyber exposure surfaces in insurance premiums, representations and warranties, and 100-day plans that need security budgets nobody modeled. Many deals still rely on a security questionnaire the target completes about itself, sometimes a separate cyber firm, and little or no review of AI.
Three cybersecurity gaps
On cybersecurity due diligence, Ferraro points to cyber insurance applications that list controls such as multi-factor authentication, tested backups and monitoring that are not fully in place, which can create a coverage question. He also flags security programs that only react, citing a 950-user field services company Compello assessed that had no MFA, end-of-life servers, zero workstation patch compliance and no managed detection. The third gap is compliance the target cannot prove. He recommends asking for the last audit, the last penetration test and the evidence behind the policies, and contrasts that with a $150 million professional services client that passed its FFIEC exam with zero findings.
Three AI gaps
On AI due diligence, the article warns against paying a multiple for an “AI-powered” story that is a thin layer over another company’s model or that the architecture cannot support. Ferraro singles out shadow AI as the risk that concerns him most: employees pasting customer data, financials and contracts into free AI tools on personal accounts, often with no policy, owner or approval path in place. The sixth blind spot is upside. If diligence looks only for risk, AI savings never reach the value creation plan. He cites a fax intake automation for a $400 million pharmacy that saves about $500,000 a year and paid for itself in under three months.
One review instead of three
The article’s broader argument is that splitting IT, cybersecurity and AI across separate firms creates its own blind spot, because the risks overlap. Shadow AI is a data protection issue, every AI vendor is a third-party risk and AI-written code is an application security issue. Ferraro closes with eight questions, four on cybersecurity and four on AI, covering whether the insurance application matches reality, who monitors the environment after hours, when recovery was last tested, what compliance can be proven, whether the AI story is defensible, who owns AI, what data has gone into which tools and what AI upside is missing from the model.
How Compello approaches technology diligence
Compello’s IT due diligence for private equity buyers reviews operations, technology, security and the technology product in parallel, with AI checks built into each track. Red flags go to the deal team as they are found, and each finding is tagged to be priced in, fixed before close or added to the 100-day plan. After close, the firm can stay on as fractional CISO or CIO, running 24/7 security monitoring or AI governance. Since 2015, Compello has worked with about 50 private equity firms and more than 100 portfolio companies. Its red-flag review takes three to five days and includes AI and cybersecurity. More information is available at compellopartners.com.
Ferraro notes that one sponsor Compello works with already uses questions like these to qualify or disqualify targets before committing to full diligence, and he expects more firms to follow.
About Compello Partners
Compello Partners is a technology consulting firm serving private equity sponsors and their portfolio companies. Founded in 2015, the firm provides IT due diligence, carve-out and integration services, IT strategy and advisory, ERP services, AI strategy and adoption, security and compliance, operations consulting and managed IT services. Its mission is to help private equity firms use technology to support value creation across the deal lifecycle, from diligence to exit.
Contact Information
Compello Partners
2803 Sandhurst Ave
Thousand Oaks, CA 91362
Phone: (805) 300-3338
Email: marketing@compellopartners.com
Website: compellopartners.com
Media gallery
