The Most Common Day-1 Mistake in M&A Integration

How it happens

No one convenes a meeting to decide that an unverified environment should be trusted. It happens in fragments, each individually reasonable and each urgent.

A network engineer builds a tunnel so the integration team can reach the target's systems. An email migration quietly joins two identity systems. A file share is mapped so the finance team can close the month. A vendor's remote access is extended because production cannot stop.

Every one of those is a trust grant, made before anyone verified administrator accounts, endpoint coverage, or what may already be resident in the acquired environment.

Why it is expensive

The acquired company's risk does not stay in the acquired company. Once network paths and identity trust exist, an intrusion in the target becomes an intrusion in the enterprise, and the buyer inherits not only the technical problem but the disclosure, regulatory, and customer consequences.

The asymmetry is severe: the cost of verifying first is measured in weeks of focused work, and the cost of getting it wrong is measured in incident response, downtime, legal exposure, and the deal thesis.

The fix is cheap and structural

Two things prevent this reliably.

The first is a defined minimum control baseline that must be evidenced before connection. Not a policy statement, a checklist with evidence requirements: identity inventoried, MFA enforced on privileged and remote access, endpoint coverage validated by agent count, external exposure reviewed, backups proven, escalation path established. Anything unmet becomes a documented exception with an owner and a date.

The second is a segmented interim pattern for business needs that genuinely cannot wait. Limited, monitored, time-bound access to specific systems is a very different risk from general network trust, and it satisfies most urgent requests without granting the thing that causes harm.

Who owns the decision

In most integration plans, nobody does. Connectivity sits between the security team, the network team, and the integration lead, and it defaults to whoever moves first.

Naming an owner for the connect decision, with explicit authority to withhold it until baseline criteria are evidenced, costs nothing and removes the failure mode entirely. That governance question is worth settling before close, in the same conversation where the 100-day plan is sequenced.