Quandary Peak Research Introduces CogniCrypt for Detecting AI-Generated Malware in M&A Due Diligence

Developed by Quandary Peak experts and described in a peer-reviewed paper, the framework analyzes how unfamiliar software behaves to support repeatable cybersecurity assessments of acquisition targets.

LOS ANGELES, Aug. 25, 2026 /PRNewswire/ -- Quandary Peak Research today announced that it is incorporating CogniCrypt, an AI-generated malware detection framework developed by its experts, into its technical due diligence approach for mergers, acquisitions, and technology investments. Described in a paper accepted at the peer-reviewed CRIS 2026 conference, CogniCrypt analyzes how unfamiliar software behaves and supports more consistent evaluation of cybersecurity risks that may affect valuation, deal terms, remediation obligations, and integration planning.

Cybersecurity exposure can materially change the risk profile of a transaction. An undisclosed breach, vulnerable software dependency, weak access control, unsupported critical system, or incomplete incident history may create financial, operational, regulatory, and legal risks for the buyer.

AI-generated threats add another layer of uncertainty. Attackers can use artificial intelligence to produce and modify malicious software more rapidly, creating variants designed to avoid established detection methods. Questionnaires, policy reviews, and conventional vulnerability scans may capture only part of that exposure.

A Repeatable Method for Evaluating Cyber Risk

Quandary Peak's review process aligns cybersecurity analysis with the objectives and risk profile of each transaction. The process identifies critical systems, data, software dependencies, and operational requirements before examining source code, system architecture, security controls, known incidents, and potential threat exposure.

Technical findings are then evaluated according to their scope, severity, likelihood, and plausible business consequences. The resulting analysis helps transaction teams determine whether an issue warrants further investigation, remediation before closing, contractual protection, a valuation adjustment, or prioritized action after closing.

The process uses documented criteria and evidence-based reporting to support consistency across engagements. This gives decision-makers a clear record of what was examined, what was discovered, why a finding matters, and what actions may mitigate the associated risk.

"Cybersecurity diligence should explain more than whether a control or policy exists," said Mahdi Eslamimehr, Executive Vice President at Quandary Peak Research. "It should examine how a company's systems may behave under real conditions and connect that technical evidence to the decisions facing the transaction team. Our methodology provides a consistent way to evaluate those findings and prepare for their financial and operational consequences."

When unfamiliar or dubious software warrants closer analysis, CogniCrypt helps prioritize possible execution paths and classify potential malware.

Studying Cyber Risk From Threat Behavior to Transaction Consequences

Quandary Peak's methodology draws on research and analysis examining cybersecurity risk at three levels: the changing threat environment, the technical challenge of detecting unfamiliar malware, and the hazards of undisclosed vulnerabilities in transactions.

The New Shockwave: AI-Generated Cyber Attacks examines how artificial intelligence is changing the scale, speed, and adaptability of cyber threats. It also addresses the governance and security controls organizations need as AI becomes more widely incorporated into software systems and business operations.

CogniCrypt focuses on the challenge of identifying unfamiliar malware, including malicious software generated using AI. At a general level, CogniCrypt analyzes how unfamiliar software may behave, prioritizes the most relevant execution paths, and classifies prospective malware using machine learning.

Technically, CogniCrypt combines concolic execution, a method that evaluates observed program behavior alongside mathematical representations of other possible execution paths, with large language model-guided path prioritization and transformer-based classification. Its experimental evaluation reported 97.5% detection accuracy on AI-generated malware samples.

"What draws me to this research is the need to identify malicious software before it has a familiar name, signature, or history," said George Edwards, President & Chairman at Quandary Peak Research. "AI challenges many of the assumptions built into traditional detection methods. CogniCrypt grew from our effort to reason about what unfamiliar code is capable of doing, rather than waiting to recognize something we have already seen."

The framework is described in CogniCrypt: Synergistic Directed Execution and LLM-Driven Analysis for Zero-Day AI-Generated Malware Detection, co-authored by George Edwards and Mahdi Eslamimehr. The paper was accepted by the 12th International Conference on Cryptography and Information Security (CRIS 2026), a peer-reviewed academic conference held in Zurich, Switzerland. Read the full paper.

The Digital Trojan Horse: Why Cybersecurity Failures in Due Diligence Destroy M&A Value connects technical cybersecurity findings to transaction outcomes. The report cites survey findings that 73% of dealmakers would abandon a transaction after discovering undisclosed cybersecurity risks. It explains how hidden vulnerabilities can transfer financial and operational liabilities to an acquirer, affect negotiations, and complicate integration.

Together, this work provides a clearer path from identifying an emerging threat to assessing its significance within a transaction.

Applying Cybersecurity Expertise to Due Diligence

Together with Mahdi Eslamimehr, Gordon McKay and William Luk contribute experience in applied cryptography, systems security, computational systems, and advanced architectures to the firm's due diligence work.

Quandary Peak experts help transaction teams assess how software, infrastructure, security controls, and technical dependencies influence business continuity and risk. Their analysis focuses on explaining complex technical findings in terms that legal, technical, and executive stakeholders can use.

Clearer Information for Transaction Decisions

Effective cybersecurity due diligence turns technical evidence into transaction decisions. By connecting threat analysis, software behavior, system architecture, and business consequences, Quandary Peak gives buyers, investors, and counsel a documented basis for determining which risks are material, which can be mitigated, and which may affect valuation or the structure of the transaction.

CogniCrypt extends that analysis to the evolving risk of AI-generated malware, helping deal teams assess acquisition targets with greater clarity before closing and establish practical priorities for remediation and integration.

About Quandary Peak Research
Quandary Peak Research provides technical due diligence and expert analysis for software-intensive transactions and disputes. Its experts advise investors, attorneys, and corporate leaders on cybersecurity, source code, software architecture, scalability, technical dependencies, intellectual property, and other factors that may affect valuation, transaction risk, integration planning, and litigation outcomes.

For media inquiries, please contact:
Jeremiah Deasey
Manager of Digital Marketing, Media, and Brand
[email protected]

SOURCE Quandary Peak Research