The Earn-Out Risk Hiding in Weak Security Metrics

Earn-outs are supposed to bridge a disagreement about the future: the seller believes the business will perform, the buyer pays for that performance only when it shows up. What sellers miss is that every earn-out turns on evidence. After close, the buyer's team measures what the business actually does, and anything the seller claimed but cannot prove becomes a negotiation the seller already lost.

Security sits inside that dynamic more often than people expect. The data room said incidents were rare, controls operated, vendors were managed and recovery was tested. If those claims live in slideware rather than records, they become leverage.

The protection is boring and available long before a process starts: map every claim the deal will make to the documentation that supports it, and fix the gaps while there is no clock running.

TLDR

• Earn-outs convert unproven claims into price adjustments.

• Security assertions in a data room are deal claims; each one needs standing evidence.

• Incident history, control operation, vendor oversight and recovery tests are the usual weak spots.

• A metric-evidence map, built before the process, shows you what a buyer will find.

• Missing evidence with a remediation date beats evidence assembled under pressure.

Claims become covenants

During a sale, security statements appear everywhere: the CIM, the management presentations, the data room index, the answers in diligence interviews. After close, several mechanisms keep those statements alive. Reps and warranties make them legal commitments. Escrows and holdbacks secure them. Earn-out conditions can tie payment to operational performance that security failures would damage, or even to specific remediation milestones.

The seller's problem is asymmetry of records. The buyer owns the systems now. If a dispute arises about what was true at close, the side with documentation wins, and after close, that side is rarely the seller.

The four claims that most often lack proof

• "Incidents are rare and well handled." Prove it with an incident register: dates, scope, root cause, customer impact, what changed. Absence of a register reads as absence of discipline, not absence of incidents.
• "Controls operate effectively." Prove it with completed control activities: access reviews with sign-offs, change records, training completion tied to behavior measures. A policy is not an operated control.
• "Vendors are managed." Prove it with a current register annotated by access and data, plus review dates for the critical ones.
• "We can recover." Prove it with timed, witnessed restore tests. Nothing else carries the same weight, because nothing else is direct evidence.

Build the metric-evidence map

One table: each claim the deal materials will make, the evidence that supports it, where that evidence lives, and the date it was last refreshed. The example below is fictional and illustrative.

Deal claim	Supporting evidence	Location	Last refreshed	Gap
Incident history is documented and learned from	Incident register with post-incident actions	GRC system	Current	None
Access is reviewed quarterly	Signed review records, four quarters	IT shared drive	Last quarter	Q2 record missing sign-off
Critical vendors are assessed annually	Vendor assessments with dates	Procurement system	14 months ago	Two critical vendors overdue
Recovery is tested	Timed restore records per critical system	IT operations	9 months ago	ERP never timed end to end

The gap column is the earn-out protection plan. Every row in it is a future negotiation, priced either now at remediation cost or later at deal cost, with interest.

Timing is the whole game

Evidence assembled during diligence looks like what it is: recent, thin and reactive. Evidence with two years of history looks like an operating habit. Buyers price the difference, correctly.

Sellers with even six months of runway can close most gaps: restart the review cadence, run the restore tests, refresh the vendor assessments. The cost is small next to a price chip. The pre-acquisition assessment route exists for exactly this moment, and the buyer's-eye view is in what buyers must know before they sign.

Frequently asked questions

How do weak security metrics affect an earn-out?

Earn-outs pay on proven performance. Security claims the seller cannot evidence become disputes about what was true at close, and the buyer, who now owns the systems and the records, holds the stronger position. Unproven claims convert directly into price pressure.

What security evidence do buyers weigh most heavily?

Records with history: an incident register, signed access reviews across multiple quarters, current vendor assessments, and timed restore tests. Anything produced during diligence itself gets discounted.

How far before a sale should a seller build the evidence map?

Twelve months is comfortable; six months closes most gaps. The constraint is cadence: quarterly reviews and tests need repetitions behind them to look like operations rather than preparation.

Can missing evidence be fixed once diligence starts?

Partially. Honest gaps with dated remediation plans are negotiable. What cannot be recovered is history: a control first evidenced last Tuesday reads as a control that did not operate before.

A Defensible Next Step

Take the strongest security sentence in your current pitch materials and ask: where is the record that proves it, and how old is that record? Repeat for the next five sentences. The answers are your earn-out exposure list. Book a Decision-Clarity Call to turn it into a remediation plan.