The First 72 Hours After an Acquisition: A Cybersecurity Playbook

Why the first 72 hours matter more than the first 72 days

At close, the acquirer owns everything: the target's administrator accounts, its internet-facing services, its unpatched systems, its vendor connections, and its entire security history. None of that was under the buyer's control the day before, and most of it has never been independently verified.

Meanwhile the business pressure runs in exactly the opposite direction. Integration teams want email flowing, finance wants access to systems, and leadership wants visible progress in week one. Every one of those requests is, underneath, a request to extend enterprise trust to an unverified environment.

The organizations that handle this well do not slow the deal down. They simply decide, deliberately and in advance, what has to be true before trust is granted.

Hour 0 to 24: establish facts

The first day is discovery, not remediation. The objective is a defensible picture of what actually exists, which almost never matches what the data room described.

• Inventory identity: directories, administrator accounts, service accounts, and every account with privileged access
• Inventory endpoints and servers, and compare the real count against the licensing the target reported
• Map internet-facing services, remote access paths, and third-party or vendor connections
• Confirm who currently holds the keys: internal staff, an outsourced provider, or a departed employee nobody has removed

This is also the moment to brief the acquired company's staff. Teams that learn what is happening and why cooperate; teams that discover it by finding themselves locked out do not.

Hour 24 to 48: contain the highest risks

With facts established, the priority is the small number of exposures that could cause immediate harm. In practice this is a short list, repeated across nearly every lower-middle-market target.

• Enforce multi-factor authentication on administrative and remote access
• Contain and re-credential privileged accounts, and remove access for departed users
• Close internet-facing services that have no business justification
• Verify that backups exist and can actually restore, rather than that a backup job reports success
• Establish an escalation path: a named person and a phone number that answers on night one

Hour 48 to 72: baseline and document

The third day converts containment into a defensible position. Deploy endpoint detection and validate coverage by counting agents against the asset inventory rather than trusting a license total. Run a vulnerability scan and remediate critical and externally exposed issues first. Triage where regulated or sensitive data lives, because that determines obligations the buyer now owns.

Everything not fixed becomes a documented exception with an owner and a date. That exception register is what turns Day 1 into a credible 100-day integration plan rather than an open-ended cleanup.

What makes this achievable

None of this is exotic work. It is ordinary security hygiene executed under transaction pressure, which is precisely why it gets skipped. The acquirers who execute it reliably have three things: a defined minimum control set decided before close, people available to do the work in the days when the target has no security staff of its own, and a diligence process that identified these issues early enough to plan for them.

That is the sequence PrimeTech is built around: diligence that finds it, FieldOps that fixes it, and integration that closes it out.