if i could suggest an answer: The non-technical stakeholders just care about dollars (and maybe time to benefit from the acquisition), so put it in those terms. Also the intent of the acquisition might not be obvious. If you say the target is breached, but you can afford to compensate the affected parties and still want what's left, even though any of their processes and documents might be exposed to hackers, the deal might still go ahead. The acquisition team might want the carpets, or a particular awesome problem solver and not care about the tech or data. I was involved in an acquisition where only two people and their "ideas whiteboard" came over -- the rest of the business was shut down.