When You Buy a Company, You Buy Its Breach

The cybersecurity section of a standard purchase agreement is usually three sentences long. Two of them are qualifiers. “No material breaches.” “Commercially reasonable security measures.” “To the knowledge of the Company.” The deal team uses these sentences to protect the balance sheet. They do not protect the network.

Security due diligence before signing is typically a 200-line spreadsheet in a data room. The answers are provided by an IT director who knows they are likely being made redundant. The spreadsheet reflects the acquired company’s written policies, not their actual firewall rule hygiene. A green answer on multi-factor authentication is not a list of service accounts exempt from it. The diligence finding is not just the risk you found. It is the access you did not have to look.

The wire transfer clears on Thursday. The integration steering committee meets on Friday. The business sponsors want the acquired executive team to have access to the parent company’s intranet, shared calendars, and the global address list by Monday. Achieving this usually requires a two-way Active Directory forest trust or a full directory synchronization.

A forest trust is a bridge. You do not build a bridge to a house you have not inspected. Kerberos does not respect organizational intent. If the acquired company has an active intruder, that trust is the routing path the attacker uses to compromise the parent domain. SID history, unconstrained delegation, and legacy authentication protocols turn a business convenience into an attack vector. Connecting a newly acquired network before deploying your own telemetry is an act of faith.

The network diagram in the data room shows two offices. The firewall configuration shows tunnels to a warehouse provider, a managed service provider, and an old corporate parent. The acquired company’s MSP often has domain admin, a shared remote monitoring and management agent, and an auto-renewing contract. It is the single largest unassessed vendor in the deal, and it usually is not in the data room. If the MSP is compromised, the acquisition just made you a customer of the same breach.

The same applies to backups. Backup administration is usually domain administration in disguise. If the backup system is shared between the parent and the acquired company, one compromise covers both. If the acquired company’s backups have never been restore-tested, they are not backups.

There is a 30-to-120-day window between signing and closing. The deal team has finished its diligence. The integration team has not started. The target’s security team is distracted, updating resumes, or both. This is when an existing intruder accelerates their dwell time and a new one walks in. Nobody on the deal team has a budget line for this window.

Integration is an engineering reality, not a legal exercise. The sequence is the deliverable.

Before signing, conduct an external attack surface assessment. Check breach corpora and ransomware leak sites. Identify the MSP. Interview the people who actually run the environment, not the person who filled out the questionnaire. Negotiate specific indemnities for what you cannot verify.

From close to day 30, freeze and observe. No connectivity. No directory sync. No trust. Deploy your endpoint detection and response agent alongside theirs. Get log ingestion flowing one way into your security information and event management system. Build the inventory. Hunt for the intruder. The output of this phase is visibility, not integration.

From day 30 to 90, remediate in place. Patch the domain controllers that have not rebooted since the pandemic. Enforce multi-factor authentication. Clean up privileged access. Isolate the backups. Do not merge a broken environment into a healthy one and call it integration.

From day 90 to 180, establish controlled connectivity. Use one-way identity federation instead of network trusts. Acquired employees get accounts in the parent tenant, governed by conditional access policies requiring compliant devices. They access parent resources through web applications or virtual desktops. The underlying networks remain physically and logically severed. Put contacts in the global address list, not credentials.

Only after identity is stable and remediation is verified do you move to endpoint reprovisioning, application migration, and data transfer. Rebuild workloads rather than lift-and-shifting unpatched virtual machines. Export the data from legacy applications and import it into your systems.

The business will push back. The synergy number is a forecast. The incident is a fact. The CFO will ask why acquired employees cannot have email on the parent domain yet. The CISO will explain that merging tenants before remediation exposes the parent directory to credential risk. The CFO will ask for a date. The CISO will give one, and it will be wrong, because security is the only workstream measured by what did not happen, which is why it loses every scheduling argument.

Sometimes the acquired company is better at security than the parent. They have fewer legacy systems, stricter conditional access, and a flatter network. The right answer is to adopt their controls, not impose the parent’s standard. That is a political problem, not a technical one, and it requires an executive sponsor.

Protect the acquired company’s security team. Give them authority over the integration boundary. If they leave, you lose the threat model and the institutional memory at the exact moment you need both.

The legal team will tell you the reps and warranties cover unknown liabilities. The security team will tell you that a forest trust routes traffic exactly as configured. The network does not read the purchase agreement.