Acquisition day one: security checklist for the acquiring team

On day one after an acquisition, take control of identity and administrator accounts, inventory domains and cloud accounts, review who holds access, rotate shared secrets, scan the code and dependencies, and delay network connection to your own systems until you understand what you inherited.

First 24 hours: take control

• Administrator and owner accounts. List every account with top level rights in the identity provider, cloud, source control, domain registrar and key SaaS tools. Confirm each person should still have it.
• Multi factor authentication on every one of them. Fix this first.
• Domains and certificates. Find every registered domain, who holds the registrar account, and when each expires.
• Money and mail. Confirm who can change banking details or payment settings, and who controls the finance mailboxes. Fraud attempts target the confusion of deal periods.

First week: inventory

1. Assets. Servers, cloud accounts, containers, databases, laptops and mobile devices, plus anything the old team ran from a personal account.
2. Code and dependencies. Scan repositories for secrets and known vulnerable components, and generate a software bill of materials for each product.
3. Data. What personal and customer data exists, where it lives, and which commitments the company made about it.
4. Vendors. Contracts, data access and integrations.
5. Incidents and findings. Recent incident records, open audit findings and prior test reports. Ask directly about past incidents and compare with what the diligence documents said.

Rotate and reduce

Rotate shared passwords, signing keys and tokens that were known to the sellers or departing staff. Remove dormant accounts. Reduce standing access to what the transition needs.

Hold the line on integration

Do not connect the acquired network to your own, or add its identity provider as trusted, until you have assessed it. Connecting early extends your attack surface to a stranger's hygiene. Use a staged plan: isolated, monitored, limited trust, and then full integration.

People and culture

Meet the engineers and ask what worries them. They usually know where the problems are. Make reporting safe, and keep key staff informed, since uncertainty makes staff leave and takes knowledge with them.

Measure and report

Produce a one page risk summary for leadership within thirty days, with owners and dates. Security debts found here are priced into the deal already, and should be funded.

Safeguard's asset discovery and SBOM scanning can speed up the inventory step.

Do not rely on goodwill alone. Even honest sellers forget accounts, tokens and systems that were set up years ago by someone who has since left. A methodical discovery pass, using your own tools and checking logs for what actually runs, finds more than interviews alone. Combine the two, and resolve any difference between what people say exists and what the scan shows.

Quick check

Last reviewed: 19 October 2026.