If your security tool vendor is acquired or ending a product, do not panic and do not wait. Read your contract for assignment, termination and data terms, ask the vendor for written support and roadmap commitments, export your data now, and set dated triggers that decide whether you stay or migrate.
Separate three situations
| Situation | Typical meaning | First move |
|---|---|---|
| Acquisition announced | Ownership changes, product may continue | Ask for written commitments |
| Product end of life | A date after which support stops | Plan migration against that date |
| Vendor shutting down | Service may end abruptly | Export immediately |
Step one: read the contract
Look for assignment and change of control clauses, termination rights, notice periods, service level terms and what happens to your data. The clauses are covered in compliance platform contract terms to check. If you have a right to terminate on a change of control, note the window.
Step two: ask in writing
Questions worth asking:
- Will the product continue, and for how long, in writing.
- Will support, security patching and data hosting terms remain.
- Will the data processing terms and sub-processors change.
- What is the export path and format.
Verbal reassurance is not a plan.
Step three: export now
Do not wait for a deadline. Take an export of findings, decisions, configuration and reports in standard formats, as covered in what to do with scanner history after you switch.
Step four: set triggers
Decide in advance what would make you move. Examples: support response times worsen, a release cadence slows, the data processing terms change, or a stated end of life date is announced. Put dates on a review, say quarterly, and write the decision in your log.
Step five: shortlist options quietly
Look at what an exit would take using your effort drivers. Check exit plan clauses in any new contract before you sign.
Keep security coverage steady meanwhile
Do not stop using the tool or loosen gates because the news is uncertain. Keep patching your own integrations, keep exporting on a schedule, and keep the tool in your inventory with a note on its status. If findings stop updating because feeds are not maintained, that is one of your triggers to move. Tell your compliance lead early, since control descriptions and vendor risk records may need updating.
Quick check
Should we migrate immediately after an acquisition?
Not automatically. Many products continue unchanged. Prepare, export and watch the triggers, and move if they are hit.
What if the contract has no exit terms?
Ask the vendor to add a data export and deletion commitment in writing, and take your own export on a schedule.
Safeguard covers SBOM and dependency scanning, reachability analysis, policies and gates, and compliance evidence automation. You can try a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
