Here’s how you can do things differently and protect your business from cyber threats throughout the M&A process:
Pre-acquisition
1) Run full security assessments
Don’t just trust what you’re told – verify everything. There are stories of deals where the selling party presented a rosy picture that didn’t match reality. That’s why we always recommend running a full suite of cyber security assessments before any money changes hands.
- Internal and external penetration tests to uncover vulnerabilities that might not be documented.
- Red team exercises that test technology, people and processes
- Business continuity and disaster recovery exercises
2) Asset discovery and inventory
You need to know exactly what you’re acquiring, and we mean everything. The official IT inventory is just the starting point – the real work is uncovering what’s not on the list. Shadow IT is rampant in many organisations, and during M&A, these undocumented systems become your biggest risk.
Run a discovery project to find and identify all:
- Systems
- Identities
- Networks
- SaaS solutions
- Software
- External facing services
- Cloud environments
Check expense reports, talk to department heads, and analyse network traffic. You’d be amazed how many critical business processes run on tools IT doesn’t even know about.
Make sure to check for active vulnerabilities against everything you find. If there’s one undocumented system, there could well be dozens more.
3) Deep investigation
Dig deep, looking for undisclosed breaches and other issues. They’re not always maliciously hidden. Sometimes the target company simply doesn’t know they’ve been compromised. That’s why you need to actively hunt for signs of historical or ongoing breaches.
You could look for unusual network traffic patterns in historical logs – sudden spikes in data transfers, connections to suspicious IP addresses, or activity at odd hours. Unexplained system modifications are another red flag. Why was that server rebuilt six months ago? What prompted that emergency patch deployment last year?
Pay attention to gaps in security monitoring or log retention too. If logs mysteriously disappear for certain periods, or if monitoring was “temporarily disabled” and never re-enabled, you need to dig deeper. And if the company is reluctant to share security documentation or keeps finding reasons to delay security reviews, that’s often a sign they’re hiding something.
4) Evaluate technical debt
Audit all current solutions and their maintenance programmes. Finding software, hardware, and other solutions that haven’t been maintained is a sure indicator of more issues to be found.
Where there’s smoke, there’s fire – technical debt is the smoke, and often you’ll find other issues hiding behind a lack of maintenance.
While the above steps are super important, it can seem like a big workload to deal with. That’s the nature of mergers and acquisitions, unfortunately — but if you want to speed things up or be more certain you’ve covered everything, consider bringing in external experts to help with your due diligence.
Post-acquisition
Once the deal is done, the real work begins. Here’s how to navigate the integration minefield while keeping a newly-expanded business secure.
1) Network segmentation
Don’t fully integrate networks until you’ve completed thorough security hygiene. You don’t want a breach to occur because you rushed to connect systems without proper controls in place.
Keep the acquired systems isolated while you implement your security standards across the board. This means patching all vulnerabilities, upgrading authentication methods to match your standards, and conducting a thorough review of user access.
Move all new staff immediately to:
- Passkeys
- Multi-factor authentication (MFA)
Acquisition targets often have employees with access to systems they haven’t used in years. Or worse; former employees who still have active accounts.
So constantly review all staff access during the integration period. Often, privileged accounts can be created, missed, or not deactivated during the transition.
2) Consolidate your external attack surface
Even if you can’t immediately modernise legacy systems (which can sometimes be a multi-year project) you can control how they connect to the outside world. This is where many companies miss a trick. By routing traffic through your secure infrastructure, those creaky old systems suddenly benefit from your modern security controls.
Even if this just means running traffic through your network as an ingress point for legacy systems, this can give you great control with:
3) Set up strong recovery capabilities
Before you need them in a crisis, make sure your business continuity and disaster recovery plans cover the newly acquired systems. Remember: untested plans are just expensive fiction.
Run regular drills that include the new infrastructure. Can you actually restore those legacy systems? Do you have the right expertise to recover applications you’ve just inherited? What happens when the one person who understands that critical system is on holiday? These drills often reveal gaps you never knew existed, and it’s much better to find them during a test than during a real incident.
So many businesses fall at the first hurdle during a cyber attack because they have no tested and secure way to recover.
Make sure your backups are immutable. Bad actors are very keen to try to wipe your backup systems. If you can’t recover, you’re far more likely to have to pay in a ransomware situation.
4) Increase threat hunting
During and after integration, you need to shift from reactive to proactive security. Attackers often wait for the chaos of integration to make their move, knowing that your security team is stretched thin and anomalies might be dismissed as “integration issues.”
Ramp up your security monitoring and actively hunt for threats. This means looking for unusual access patterns – like why someone in accounting is suddenly accessing development servers. Watch for data exfiltration attempts, especially large transfers to external destinations. Monitor for privilege escalation activities and lateral movement between old and new systems.
Remember, attackers who’ve been dormant in the acquired company’s systems might activate once they detect the merger. They know you’re distracted, they know there’s confusion about who owns what, and they know response times are likely slower. Don’t give them the opportunity they’re waiting for.
5) The human factor: Don’t forget about people
Remember that M&A transitions can be stressful for employees. We’re talking about the confusion of new systems, new processes, new colleagues, and new expectations. In this environment, even well-meaning employees can become security risks.
Confused staff might bypass security controls simply to get their work done. They might share passwords because the new access management system hasn’t been properly explained. They might fall for phishing emails because they’re now getting messages from unfamiliar email addresses and don’t know what’s legit.
That’s why clear communication about security policies is essential from day one. Above all, offer support to help staff adapt to new systems. A supported employee is far less likely to become a security risk than one who feels abandoned in the chaos of change.
