Navigating Security pitfalls during M&A : Playbooks & Strategies for doing acquisitions right

The speaker, a security lead who has worked through more than twenty acquisitions, frames the problem: security teams are often given a target company and only a few weeks to report its risk, and an inherited weakness can quickly become the parent company's problem after close. The talk places acquisitions within corporate development cycles and notes that deal timelines are compressed, often running eight to sixteen weeks from start to finish.

Before close, the playbook starts with an architecture review and a questionnaire covering assets, cloud providers and network design. Scoped assessments are often run through a third-party vendor, which lets the buyer learn about the target without direct access to its code. Other steps include reconnaissance of domains and cloud footprint, a check that audit logging is enabled, and a scan for open-source exposure. The speaker also covered edge cases such as an earlier ransomware event, a credible nation-state threat, privacy rules that limit installing monitoring agents in the EU, and lab equipment whose long-running sessions clashed with standard session expiry. Severe findings can be handled through remediation deadlines written into the deal.

After close, the focus moves to rebuilding the asset inventory, since questionnaire answers often proved incomplete. Cross-checking with finance uncovered additional assets through billing records. Other priorities included shared ownership of critical accounts, onboarding basic corporate security tooling, and agreeing on an integration model and exit criteria with the business. The main takeaways were to keep checklists flexible, communicate early and often, and act as an enabler rather than a blocker.