Navigating Security pitfalls during M&A: Playbooks & Strategies for doing acquisitions right

The talk explains how a security team can take part in mergers and acquisitions, drawing on the speakers' experience across roughly two dozen deals at a large tech company. It starts with the deal lifecycle: corporate development finds a target, and security joins during due diligence, a window that often lasts only a few weeks. The speakers explain why the goal is to avoid inheriting a breach, pointing to well-known cases where intrusions surfaced after closing.

The middle section walks through a pre-acquisition workflow. A questionnaire collects asset lists, exposed services and architecture diagrams, and an outside firm runs a short penetration test so the target does not have to share its source code directly with the buyer. Findings are passed to the business for risk-based decisions. For larger deals, a compromise assessment deploys endpoint monitoring for several weeks to look for active intrusions. Post-close integration is sized by model, such as an equity hire, full, limited or delayed integration. The speakers also describe practical hurdles, including missing endpoint management, shadow IT found through finance records, and lost access to cloud accounts when staff leave.

The closing takeaways are to define exit criteria, agree on shared ownership of critical accounts, keep playbooks flexible, and communicate early with leadership and the acquired team. In the question period, an audience member suggested embedding a dedicated security person in a deal for about a year, which the speakers said was a useful idea.