Why is an acquisition an ASM problem?
On the day a deal closes, the buyer inherits domains, certificates, cloud accounts and hosts that its security team has never seen. The acquired company's own inventory may be incomplete, and the people who know it best may be negotiating their exit. Attackers watch deal announcements too.
What do tools describe?
- IONIX describes discovery during mergers and acquisitions through recursive Connective Intelligence mapping, and automatic attribution of each asset to the relevant subsidiary or business owner.
- watchTowr describes mapping assets to subsidiaries, brands and M&A.
- CyCognito describes discovery that starts from the organization's name and attributes assets to a subsidiary, brand or business unit, with a trace per finding.
One limit worth knowing for Azure-centred groups: Microsoft's Defender EASM documentation says there is no cross-tenant resource access, including through Azure Lighthouse, which matters when the acquired company keeps its own tenant.
A first-90-days plan
- Days 1 to 7: discover. Run discovery from the acquired company's name and known domains. Record what the tool needed to start.
- Days 7 to 30: attribute. Assign every asset to an owner on the acquired side and a sponsor on the buyer's side. Rule out assets that only look related.
- Days 7 to 30, in parallel: prove. Test the internet-facing services first, especially remote access, login pages and anything running software with a CISA KEV entry.
- Days 14 to 60: contain. Where the acquired company sits behind a WAF or edge service you can reach, put compensating controls on proven exposures. Where it does not, consider restricting access until the integration plan is clear.
- Days 30 to 90: route and recheck. Move proven exposures into your ticketing with deadlines, and retest every fix.
What to measure
The share of acquired assets with a named owner, the number of proven exposures, the number contained and the age of the oldest open one. Asset counts will rise quickly in the first week; that is the least useful number on the dashboard.
How it maps to our scores
Acquisitions stress the first two criteria most: finds the unlisted estate and routes to an owner. On those, IONIX and CyCognito hold the top scores on our data. The calculator lets you weight them up for an M&A-heavy year.