To merge SDK and API inventories after an acquisition or reorganization, map both sets of fields to one template, normalize vendor names, mark conflicts, assign owners for orphaned rows, and only then consider consolidating vendors. Merge first for visibility, consolidate later for savings.
Why mergers expose inventory gaps
A reorg moves people, and the people are the owners in your rows. An acquisition brings a second company's integrations, accounts and habits. Both leave rows whose owner is gone, hostnames nobody recognizes and duplicate vendors under different contracts.
OWASP notes that a lack of asset inventory leads to running unpatched systems and that it is easy to end up with exposed hosts when deployment is quick and independent. The week after a merger is when those conditions are most likely.
Steps
- Freeze the schema. Choose the target template, usually the stricter of the two, and add a column for source company or team.
- Map fields. Create a mapping table from each source field to the target. Mark fields with no equivalent.
- Normalize vendors. Use the canonical vendor name and domain. Keep a short alias list.
- Import with provenance. Load both sets, tagged with their origin and import date. Do not overwrite anything.
- Find conflicts. Same vendor with different versions, accounts, credentials or data classes.
- Assign owners. Every row needs a current person. For rows tied to departed staff, name an interim owner from the receiving team.
- Run discovery on the new side. Scan the acquired repositories and outbound traffic, and compare with what was handed over.
- Review credentials. Check which are held by individuals or by accounts outside your identity system.
Conflict handling
| Conflict | First action |
|---|---|
| Same vendor, different accounts | Keep both, record each, plan consolidation later |
| Same SDK, different versions | Pick the newest tested version as the target |
| Acquired company sends personal data to a vendor you have not reviewed | Route to privacy review |
| Row with no matching traffic | Confirm with the old owner before retiring |
| Shared credentials across services | Plan to split them |
Do not rush the cleanup
Retiring integrations to simplify can break features that customers use. Observe traffic for a full cycle, confirm owners, then retire in stages with a rollback plan.
Keep the learnings
Write down how long the merge took and where the gaps were. The next reorg will be faster.
Quick check
Should I keep the other company's template?
Use one target template. Keep a mapping and a source column so you can trace each row back.
What is the first risk to check?
Credentials held by personal accounts or outside your identity system, since they are easy to lose track of.
Safeguard offers SBOM and dependency scanning and asset discovery that can feed this kind of inventory. You can run a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
