M&A onboarding exposes the limits of VPN-led access models

At a glance

What this is: This article argues that M&A onboarding creates a step-change in access governance because thousands of users may need access immediately, not gradually.

Why it matters: It matters because IAM, PAM, and NHI programmes all rely on controlled onboarding, and merger scenarios can expose gaps in device trust, visibility, and least privilege.

Context

M&A onboarding is not the same as normal employee onboarding. A merger or acquisition can require thousands of users to be enabled almost at once, which stresses access control, device trust, and visibility models built for gradual change. In identity terms, the challenge is less about creating accounts and more about whether access can be granted without turning day-one convenience into standing trust.

Traditional VPN-led access models assume the network boundary is a useful proxy for trust. That assumption weakens when acquired users arrive with unmanaged or differently managed devices, uneven security tooling, and different application needs. The governance question is how to give productive access while still enforcing posture, least privilege, and revocation discipline across a rapidly expanding identity estate.

Island's example is typical of the pressure M&A places on access programmes, because the onboarding event compresses weeks of identity and endpoint work into a very short window.

Key questions

Q: What breaks when M&A onboarding relies on VPN access alone?

A: VPN access can expand connectivity quickly, but it does not by itself control application scope, device trust, or revocation discipline. In an acquisition, that means the organisation may grant broad network reach while still lacking the governance needed to limit what users can actually do once inside. The failure is treating transport as identity control.

Q: Why does merger onboarding increase access governance risk?

A: Because it compresses a normal, gradual identity lifecycle into a burst of thousands of users, which makes entitlement scoping and cleanup harder to manage. The risk rises when temporary access becomes durable because no one defines the review and removal point up front. That is a governance problem, not just an access-delivery problem.

Q: What do security teams get wrong about first-day access for new hires?

A: They often focus on the authentication method and ignore the handoff between HR, IT, and the identity provider. The real failure is allowing a human-readable secret to travel through onboarding steps before the user has enrolled a durable credential. That keeps the organisation dependent on weak bootstrap behaviour.

Q: How should teams govern temporary access during M&A integration?

A: They should treat temporary access as a controlled exception with a defined owner, expiry trigger, and removal path. The right model is to grant only the access needed for immediate work, monitor who received it, and force a formal review as systems converge. That keeps transitional trust from becoming permanent entitlement.

Technical breakdown

Why VPN-led onboarding struggles at merger scale

VPN access extends network reach, but it does not solve the underlying governance problem of who should reach which applications, from which devices, and under what trust conditions. When a company acquires another organisation, the scale spike turns access from a normal lifecycle event into a mass provisioning exercise. That increases the risk of broad, persistent access paths that are difficult to unwind later. A VPN can authenticate a session, but it does not by itself provide fine-grained application control, device posture enforcement, or strong visibility into what the user actually touches.

Practical implication: Treat VPN access as a transport control, not an identity governance model, and pair it with application-level entitlements and device checks.

What zero trust adds to M&A access governance

Zero trust access patterns shift the decision point away from the network boundary and toward the user, device, and application context. In an M&A onboarding scenario, that matters because the acquired workforce may bring a different device estate, different management tooling, and different risk levels. The practical value is not in blocking access, but in making access conditional on posture and scope. This is especially important where the acquiring company wants day-one productivity without granting broad trust that outlives the transition period.

Practical implication: Use conditional access and posture-based policy to narrow the trust surface during integration, then tighten access as systems converge.

Why visibility and revocation matter more than speed alone

Fast onboarding is useful only if the organisation can still see who has access, what device they used, and what needs to be removed when roles stabilise. M&A creates temporary exceptions that often become permanent if they are not tracked carefully. That is where lifecycle discipline becomes the real control. Without a clear inventory of newly enabled users and their access paths, security teams can lose the ability to prove least privilege or revoke access cleanly when integration milestones change.

Practical implication: Build a revocation plan into the onboarding design so temporary access does not become permanent overexposure.

NHI Mgmt Group analysis

Day-one onboarding becomes an identity governance stress test, not a connectivity problem. The core issue in merger access is whether the organisation can distinguish temporary convenience from enduring trust. VPN-centric designs often treat network reach as sufficient, but merger onboarding demands application-scoped access, device-aware policy, and clear offboarding paths. Practitioners should read M&A onboarding as a lifecycle control problem first and a remote-access problem second.

Standing trust is the hidden failure mode in rapid access projects. When thousands of users are granted access at once, organisations often prioritise speed and leave the revocation model vague. That creates a temporary state that becomes durable because nobody owns the cleanup moment. For identity teams, the lesson is to define expiry, scope, and review triggers before day one access goes live.

Merger access sprawl: a compressed onboarding window can turn transitional access into a semi-permanent entitlement estate. That is the governance pattern this article exposes. The relevant control question is not whether users can get in quickly, but whether access can be limited, observed, and removed with equal precision after integration milestones change. Practitioners should design for contraction as well as expansion.

Browser-mediated access is becoming an identity control point, not just a UX choice. The article shows that the browser layer can carry policy, posture, and visibility in a way that legacy network access often cannot. That matters for IAM and NHI programmes because the same principle is increasingly used to govern people, contractors, and machine-mediated access paths. Security teams should treat the browser as a policy enforcement surface when merger onboarding compresses the control window.

Identity programmes need merger-ready operating assumptions. Many access models assume a steady-state workforce and a slower provisioning rhythm. M&A breaks that assumption and exposes the difference between a system that can authenticate users and a system that can govern them. Practitioners should prepare for sudden scale by defining how posture, scope, and lifecycle controls will behave under acquisition pressure.

What this signals

Merger onboarding should be treated as a lifecycle event, not a one-time provisioning task. The largest risk is not initial access speed, but the tendency for temporary onboarding permissions to linger after integration milestones change. Security teams should design the control model around expiry, scope reduction, and review so the programme can contract as well as expand.

Browser-enforced access is becoming a practical control surface for fast-moving identity transitions. Where acquired users cannot all be brought under the same endpoint stack immediately, the browser can help enforce policy at the point of access. That makes browser-mediated controls relevant to IAM teams that need to balance productivity, visibility, and phased trust reduction during post-acquisition integration.

For practitioners

• Define merger-specific access tiers Separate day-one business access from long-term production access so newly acquired users do not inherit broad permissions that were meant to be temporary.
• Enforce device posture before application access Require a minimum trust state for corporate applications, especially when the acquired device estate is unmanaged or inconsistently controlled.
• Create a revocation milestone for integration Tie access review and removal to specific merger checkpoints so transitional access is actively reduced as systems and identities are consolidated.
• Track temporary exceptions in a single register Record which users received exception-based access during onboarding, what they could reach, and when the exception expires.

Key takeaways

• M&A onboarding breaks the assumption that access can be granted gradually, because integration often requires thousands of users to be enabled at once.
• VPN-led access may solve reachability, but it does not by itself deliver the device posture, visibility, or entitlement precision that merger governance needs.
• The strongest control pattern is transitional access with clear expiry, scoped permissions, and a planned revocation step as systems consolidate.

Key terms

• Merger access sprawl: The uncontrolled expansion of access rights that can happen when two organisations merge and large numbers of users are onboarded quickly. It usually appears when temporary access decisions are made for speed and then persist because no team owns the cleanup or review phase.
• Device Posture: The current security condition of a device or runtime at the moment access is requested or renewed. Posture can include patch state, protection status, integrity, and whether the endpoint is managed. In identity governance, posture is part of the trust decision, not a separate endpoint problem.
• Transitional access: Access granted for a short-term operational need during a change event such as an acquisition, migration, or restructuring. It should be explicitly scoped, monitored, and expired so it does not become a permanent entitlement path.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management in the context of access control and lifecycle discipline. It helps practitioners connect identity controls to the operational realities of hybrid and fast-changing environments.