M&A email risk exposes security gaps across acquired tenants

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Mergers and acquisitions create email security exposure across newly acquired tenants, with legacy authentication, inconsistent controls, and delayed oversight emerging as the key failure pattern.

Why it matters: It matters because IAM, PAM, and security teams have to treat tenant integration as an identity governance exercise, or inherited accounts and mail controls can remain exploitable during the transition.

By the numbers:

• The FBI reported over $2.7B in 2024 losses from business email compromise alone.

Context

Mergers and acquisitions create an identity and email governance problem because every acquired tenant brings its own authentication methods, policy settings, and administrative exceptions. In practice, teams are inheriting live access paths before they fully understand who and what is inside the estate.

That matters for email security because business email compromise thrives when oversight is split, legacy authentication remains enabled, and visibility arrives only after integration work begins. The article’s core point is that acquired tenants need pre-close inspection and controlled standardisation, not just post-close cleanup.

Key questions

Q: What breaks when acquired tenants are integrated without a pre-close security review?

A: The main failure is that inherited email risk becomes part of the live enterprise before anyone can baseline it. Legacy authentication, compromised inboxes, and risky OAuth connections can persist through the deal window, which means integration accelerates exposure instead of reducing it. Read-only visibility before close is the control that prevents that blind spot.

Q: Why do acquired tenants increase business email compromise risk?

A: Because M&A combines trust expansion with uneven governance. New tenants often retain older authentication methods, separate policy baselines, and delayed oversight, which gives attackers more places to hide and more ways to abuse trusted email paths. The more fragmented the tenant estate, the easier it is for BEC to survive integration.

Q: What are the warning signs that tenant integration is not under control?

A: Common signals include overlapping gateway licences, large numbers of policy exceptions, accounts still using legacy authentication, and slow visibility into admin and vendor access. Those symptoms show that ownership exists in one team while enforcement sits elsewhere. That gap usually means the enterprise is inheriting risk faster than it can normalise controls.

Q: How should security teams govern email risk during M&A?

A: Treat the acquisition as a governance workflow, not just a migration project. Start with pre-close visibility, document inherited identities and mail connections, standardise controls across tenants, and remove legacy auth paths as soon as ownership allows. The goal is to preserve business continuity while closing the gap between control ownership and effective enforcement.

Technical breakdown

Why acquired tenants inherit email risk

An acquisition usually introduces multiple Microsoft 365 or Google Workspace tenants, each with different baselines for authentication, mail flow, and admin control. The technical problem is not simply tenant count. It is that policy drift accumulates when legacy gateways, unmanaged users, and local exceptions persist across environments that were never designed to be governed together. That creates inconsistent enforcement for MFA, authentication methods, OAuth app oversight, and phishing response. Once communication channels are merged, attackers can move through the weakest tenant or the least visible inbox path. The key issue is that the security perimeter is no longer one environment but a set of partially governed identity islands.

Practical implication: Build a pre-integration inventory of tenants, auth methods, admin accounts, and mail security exceptions before standardising controls.

What pre-close visibility actually changes

The article’s read-only scan approach matters because it separates visibility from mail routing or business disruption. In a pre-close posture, teams can inventory users, applications, vendors, risky authentication methods, and suspicious inbox conditions without changing production traffic. That is operationally important because deal teams often cannot wait for full integration before identifying exposure. The main value is that you can baseline inherited identity and email risk before control ownership changes. This is especially relevant where acquired entities still rely on legacy authentication or where third-party connections to critical inboxes have not been reviewed.

Practical implication: Use read-only assessment to identify accounts, apps, and mail rules that need review before integration permissions are granted.

Why central oversight beats tenant-by-tenant drift

Central management is not about stripping local autonomy from subsidiaries. It is about enforcing one governance model across many tenants so exceptions are visible, comparable, and remediable. Without that layer, organisations end up with overlapping licenses, inconsistent response workflows, and delayed policy changes that leave users exposed. The article’s examples show that manual, tenant-specific administration creates a gap between ownership and enforcement. The more acquired environments you have, the more likely security coverage fragments into local practice rather than enterprise policy.

Practical implication: Standardise policy reporting and response oversight across tenants so acquired environments cannot remain on different security baselines indefinitely.

Threat narrative

Attacker objective: The attacker aims to gain trusted email access inside an acquired environment so they can conduct business email compromise, abuse inbox trust, or stage follow-on fraud.

1. Entry begins in an acquired tenant where legacy authentication, weak visibility, or unreviewed mail configurations leave inboxes and connected identities exposed to business email compromise.
2. Credential or mailbox access is then amplified by divided oversight, which lets attackers exploit unprotected accounts, risky OAuth connections, or compromised inboxes before the integration team normalises controls.
3. Impact follows when fraudulent mail activity, compromised inboxes, or policy gaps persist through the deal window, eroding trust, delaying integration, and increasing financial and operational loss.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Acquisition integration is an identity lifecycle problem before it is an email security problem. The article shows that tenants arrive with their own users, apps, vendors, and exceptions, which means governance starts before the first post-close migration step. That is exactly where most programmes underperform: they treat integration as a technical merger instead of a controlled lifecycle transition. Practitioners should treat tenant onboarding, exception review, and auth baseline validation as part of the acquisition process itself.

Acquired tenants create identity blast radius because enforcement is usually uneven at the point of takeover. The healthcare example with 14% of accounts lacking MFA is not a one-off anomaly but a pattern that appears when inherited environments carry legacy authentication forward. In NHIMG terms, the blast radius is not only mailbox compromise but delayed trust in every downstream communication path. Teams need to understand that one weak tenant can reset the risk posture of the wider enterprise.

Legacy authentication persistence is the control gap that turns M&A into a BEC multiplier. The FBI’s $2.7B BEC loss figure matters here because acquisition periods combine high trust, rapid change, and fragmented accountability. That combination gives attackers a larger operating window than ordinary steady-state environments. The implication for practitioners is to anchor deal integration on auth removal, visibility, and policy normalisation rather than on mailbox migration alone.

Tenant sprawl is now an identity governance signal, not just an IT consolidation metric. When organisations manage 75 tenants across multiple gateways or carry overlapping SEG licences across acquired entities, the real issue is that ownership and control have decoupled. That creates a governance debt that shows up later as exceptions, manual work, and exposure. Security leaders should read tenant sprawl as a signal that governance is lagging the pace of corporate growth.

Pre-close read-only review should be treated as mandatory control evidence for M&A security. The example of 18 compromised inboxes found before close shows that risk is often already present when control ownership is still being negotiated. That makes the case for a named concept we call acquisition trust debt: inherited identity and email exposure that exists before integration decisions are made. Practitioners should account for that debt explicitly in their deal-security workflow.

What this signals

Acquisition trust debt: Every acquired tenant can arrive with unresolved identity and mail exposure that predates the integration plan. That means security teams need to measure inherited risk before close, not after the first migration wave.

The important shift for practitioners is that email security and IAM can no longer be run as separate workstreams during M&A. The acquired environment has to be governed as part of the identity lifecycle, or legacy auth and mailbox compromise will remain live issues throughout integration.

For practitioners

• Establish pre-close tenant visibility Use read-only access to inventory users, admins, mail rules, OAuth apps, and legacy authentication settings before the acquisition closes.
• Baseline MFA and authentication methods Identify acquired accounts still relying on legacy auth or missing MFA, then prioritise those identities for immediate post-close hardening.
• Standardise oversight across all tenants Move acquired Microsoft and Google tenants onto one reporting and response model so exceptions, approvals, and alerts are managed consistently.
• Consolidate legacy gateways and rules Retire overlapping secure email gateway controls after integration and unify phishing response so coverage is not split across old and new estates.
• Validate inbox compromise before full integration Treat any pre-close inbox anomalies as live risk evidence and resolve them before granting broader enterprise trust or migration authority.

Key takeaways

• M&A expands business email compromise exposure because acquired tenants often carry weaker authentication and fragmented oversight into the parent estate.
• The article shows that pre-close visibility can uncover serious inherited risk, including compromised inboxes and accounts lacking MFA.
• Treat acquisition integration as an identity governance programme, with tenant inventory, auth review, and policy standardisation happening before and immediately after close.

Key terms

• Acquisition trust debt: The inherited identity and access exposure that exists when an acquired tenant enters the parent organisation with unresolved users, authentication methods, and mail controls. It is not just technical debt. It is governance debt created by delayed visibility and incomplete ownership transfer during M&A integration.
• Tenant sprawl: The accumulation of multiple Microsoft 365 or Google Workspace tenants across an enterprise, often after mergers and acquisitions. Tenant sprawl increases governance complexity because policy enforcement, reporting, and incident response become fragmented unless the organisation creates a central control model.
• Legacy authentication: Older login or protocol methods that remain in place for compatibility even after stronger controls exist. They often preserve weaker trust assumptions, which makes them attractive to attackers and difficult to defend if they are not tightly scoped and eventually retired.
• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.