The Problem: Why This Matters
When Oracle acquired Cerner Corporation in 2022 for $28.4 billion, it inherited legacy servers that became the entry point for a breach affecting nearly 20 million individuals. The unauthorized access began on January 22, 2025, and wasn't detected until March 7, 2025. This breach exposed names, Social Security numbers, diagnoses, medications, test results, and medical images across at least 80 hospitals.
Your acquisition team likely spent months on financial due diligence and legal review. But if you're not conducting parallel security assessments on the target's infrastructure, you're buying unknown risk. Once your board signs the deal, you own every unpatched server, misconfigured access control, and dormant credential in the acquired estate. This playbook guides you in integrating security diligence into your M&A process so you don't inherit a breach waiting to happen.
What You Need Before Starting
Before starting security integration, ensure you have:
Access and Authority:
- Signed NDA with security assessment language permitting scanning and configuration review
- Executive sponsor from both acquiring and target companies to authorize technical access
- Legal clearance to review logs, incident histories, and security tool outputs
Your Assessment Team:
- Lead security architect (yours)
- Infrastructure security engineer (yours)
- Target company's CISO or security lead (theirs)
- Third-party penetration tester (if budget allows)
Documentation from the Target:
- Network diagrams showing all environments (production, staging, legacy)
- Asset inventory with OS versions, patch status, and last security review date
- Identity and access management architecture, including service accounts
- Incident response history for the past 24 months
- Current security tool stack (SIEM, EDR, vulnerability scanner)
- List of all internet-facing assets and APIs
Your Tools:
- Vulnerability scanner (Nessus, Qualys, or Rapid7)
- Configuration assessment tool (CIS-CAT, OpenSCAP)
- Credential audit tool (BloodHound for Active Directory, IAM Access Analyzer for AWS)
- Spreadsheet or GRC platform to track findings
Step-by-Step Implementation
Phase 1: Pre-Close Security Assessment (30-45 Days Before Deal Closes)
Identify what you're acquiring. Request a complete asset inventory from the target. Don't accept vague answers like "we use AWS". You need specific accounts, regions, VPCs, and whether they're running legacy infrastructure alongside cloud services.
Run vulnerability scans against all in-scope systems. Focus on internet-facing assets and systems handling regulated data. For healthcare acquisitions, that means anything touching electronic protected health information. For financial services, prioritize systems processing payment card data or covered by the Gramm-Leach-Bliley Act.
Review the target's patch management process. Ask for evidence: When was the last patch cycle? What's the SLA for critical vulnerabilities? If they can't produce patch logs or have servers running end-of-life operating systems, flag this as a day-one integration risk.
Audit privileged access. Pull a list of all accounts with administrative rights. Look for shared credentials, service accounts with passwords that haven't rotated in years, and former employees who still have VPN access. The breach at Oracle Health involved stolen credentials used to access legacy Cerner servers, suggesting weak access controls on those systems.
Phase 2: Day-One Security Lockdown (Within 48 Hours of Deal Close)
Once the acquisition closes, implement these controls:
Reset all privileged account passwords. Use a password manager to generate unique credentials for each administrative account. If the target pushes back, remind them you now own the liability.
Enable multifactor authentication on all administrative access points. Start with VPN, then cloud consoles (AWS, Azure, GCP), then any remote access tools. Use hardware tokens or authenticator apps, not SMS.
Disable all service accounts that can't be immediately validated. If no one can explain what a service account does or which system depends on it, disable it and wait for someone to complain. Document the account for re-enabling if needed, but don't leave mystery credentials active.
Deploy endpoint detection and response (EDR) agents to all acquired systems. If the target doesn't have EDR, this is your detection layer until you can assess their existing security tools. Configure alerts to forward to your Security Operations Center.
Phase 3: 30-Day Integration Sprint
Week 1: Migrate internet-facing assets to your network perimeter controls. If the target has web applications behind outdated firewalls, move them behind your Web Application Firewall and DDoS protection. Update DNS records to route traffic through your security stack.
Week 2: Integrate logging. Forward all authentication logs, firewall logs, and application logs from acquired systems into your SIEM. Create detection rules for credential misuse, lateral movement, and data exfiltration patterns. The Oracle Health breach went undetected for 44 days, a gap that centralized logging might have shortened.
Week 3: Conduct a tabletop exercise with both security teams. Walk through a breach scenario: "An attacker has credentials to a legacy server. What's our detection and response process?" Identify gaps in your combined incident response capability.
Week 4: Prioritize legacy system migration. For any acquired infrastructure that predates current security standards, build a migration plan. Set a hard deadline. The longer you operate dual environments, the larger your attack surface.
Phase 4: 90-Day Remediation
Address critical and high vulnerabilities identified in Phase 1. Patch first, then move to configuration hardening. Apply CIS Benchmarks appropriate to each platform (CIS Benchmark for Windows Server, CIS Benchmark for AWS Foundations).
Implement Role-Based Access Control across the combined environment. Eliminate shared accounts. Apply the Principle of Least Privilege: users get only the access required for their current role, nothing more.
Decommission legacy systems that can't be secured. If you've inherited servers running unsupported operating systems and migration isn't feasible within 90 days, isolate them on a segmented network with strict firewall rules, or shut them down entirely.
Validation: How to Verify It Works
Run a follow-up vulnerability scan 90 days post-close. Compare results to your pre-acquisition baseline. You should see a measurable reduction in critical and high findings.
Conduct a penetration test targeting acquired assets. Hire an external firm to attempt lateral movement from a compromised endpoint in the acquired environment to your core production systems. If they succeed, your network segmentation needs work.
Review your SIEM for authentication anomalies from acquired user accounts. Look for after-hours access, access from unusual geolocations, or privilege escalation attempts. If you're not seeing any alerts, your detection rules may need tuning.
Test your incident response process with a simulated breach in the acquired environment. Time how long it takes to detect, contain, and remediate. If detection takes longer than 24 hours, you have visibility gaps.
Maintenance: Ongoing Tasks
Monthly:
- Review access logs for acquired systems, focusing on privileged accounts
- Validate that all acquired assets are receiving patches on your standard cycle
- Check for new shadow IT: acquired employees spinning up cloud resources outside your approved process
Quarterly:
- Re-scan acquired infrastructure for vulnerabilities
- Review and update your asset inventory as systems are migrated or decommissioned
- Conduct a compliance check: if the target operated under different regulatory requirements (HIPAA, PCI DSS, NYDFS Cybersecurity Regulation), confirm you're meeting all obligations
Annually:
- Penetration test the integrated environment
- Update your incident response plan to reflect lessons learned from integration
- Review the original security assessment findings and confirm all remediation items are closed
The security due diligence you skip before signing the deal becomes the breach you manage after. Build these steps into your M&A playbook now, before your next acquisition puts patient data, customer records, or your company's reputation at risk.
