Quandary Peak adds CogniCrypt to M&A cybersecurity due diligence
Quandary Peak Research said it is adding CogniCrypt to its technical due diligence process for mergers, acquisitions and technology investments.
The company said the framework is meant to help assess cyber risks in mergers, acquisitions and technology investments.
Quandary Peak Research said Aug. 25, 2026, that it is incorporating CogniCrypt, an AI-generated malware detection framework, into its technical due diligence work for mergers, acquisitions and technology investments.
The company said the tool is designed to analyze how unfamiliar software behaves and to support a more consistent review of cybersecurity risks that can affect valuation, deal terms, remediation obligations and integration planning.
In its release, Quandary Peak said cyber exposure can change transaction risk when buyers uncover undisclosed breaches, vulnerable software dependencies, weak access control, unsupported critical systems or incomplete incident history. The company also said AI-generated threats can be created and modified more rapidly, which may make them harder to catch with established detection methods.
The release said the diligence process examines critical systems, data, software dependencies, operational requirements, source code, system architecture, security controls, known incidents and threat exposure. Findings are then evaluated by scope, severity, likelihood and business consequences.
Quandary Peak said CogniCrypt is described in a paper accepted at the peer-reviewed CRIS 2026 conference, the 12th International Conference on Cryptography and Information Security, held in Zurich, Switzerland. The paper is titled “CogniCrypt: Synergistic Directed Execution and LLM-Driven Analysis for Zero-Day AI-Generated Malware Detection,” and the company said it was co-authored by George Edwards and Mahdi Eslamimehr.
The release said the framework’s experimental evaluation reported 97.5% detection accuracy on AI-generated malware samples. Atlas could not independently verify that figure from the company release alone.
Mahdi Eslamimehr, executive vice president at Quandary Peak Research, said cybersecurity diligence should do more than check whether a control or policy exists and should connect technical evidence to transaction decisions, according to the release.
George Edwards, president and chairman, said the research is aimed at identifying malicious software before it has a familiar name, signature or history, the company said.
Quandary Peak also cited another report, “The Digital Trojan Horse: Why Cybersecurity Failures in Due Diligence Destroy M&A Value,” saying it includes survey findings that 73% of dealmakers would abandon a transaction after learning of undisclosed cybersecurity risks. The release did not provide the underlying survey data in the text.
The release said the company plans to use CogniCrypt in its due diligence process. It said the work is meant to help investors, attorneys and corporate leaders assess cybersecurity, source code, software architecture, technical dependencies and other factors tied to valuation, risk and integration planning.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()