Merger due diligence exposed identity-driven attack paths in minutes

At a glance

What this is: A merger due diligence pentest found that identity compromise paths, not just vulnerabilities, created the fastest route to domain compromise and ransomware exposure.

Why it matters: For IAM, PAM, and security architecture teams, this shows why acquisition-ready identity reviews must map credentials, privilege chains, and segmentation before integration begins.

By the numbers:

• Within 35 minutes, four unique paths to domain compromise were proven by exploiting Zerologon and noPAC vulnerabilities.
• In its first baseline pentest, it uncovered 79 security weaknesses leading to 71 business impacts, and 27 compromised credentials across 53 endpoints.
• The company conducted 40 new NodeZero pentests across 20 additional remote sites over the next 10 months.

👉 Read Horizons.ai's analysis of M&A due diligence, domain compromise, and pentest validation

Context

Merger and acquisition work often assumes that patching, perimeter checks, and policy documents are enough to establish security confidence. In practice, acquisition risk is usually carried by identity exposure, weak segmentation, and inherited privilege paths that connect old systems to new ones. This article is primarily about how a chemical manufacturer used offensive testing to replace assumptions with evidence during M&A due diligence.

For identity and access teams, the important signal is not that weaknesses existed, but that compromise could be chained quickly through domain trust, endpoint credentials, and lateral movement. That makes this a governance story as much as a technical one, because IAM, PAM, and network isolation decisions directly shape whether an acquired environment can be integrated safely or whether hidden access paths survive the transaction.

Key questions

Q: What breaks when acquired environments keep inherited identity trust paths?

A: When inherited trust paths are left in place, a single compromised credential or vulnerable domain relationship can become a route to enterprise compromise. The failure is not only technical. It is governance drift, because the new owner inherits access that has not been fully mapped, revalidated, or segmented. That creates fast lateral movement and makes merger integration far riskier than patch reports suggest.

Q: Why do compromised credentials matter more than vulnerability counts in M&A security?

A: Vulnerability counts show exposure, but compromised credentials show usable access. In acquisition settings, attackers care about what can be chained into privilege escalation, not how long the scan output is. A small number of valid credentials can unlock trust relationships, admin reuse, and lateral movement across many systems, which is why identity paths often determine the real blast radius.

Q: How do security teams know if microsegmentation is actually reducing blast radius?

A: They should test whether a compromised asset can reach adjacent systems, whether denied flows are being logged, and whether containment happens without manual rework. If lateral movement still succeeds across critical segments, the control is not reducing blast radius in a meaningful way.

Q: Who is accountable when merger due diligence misses domain compromise paths?

A: Accountability should sit with both the acquiring security function and the integration leadership that approves trust expansion. If due diligence misses reachable domain compromise paths, the failure is in risk acceptance and evidence quality, not just in controls. Frameworks such as NIST CSF and NIST SP 800-53 both expect control validation, traceability, and risk-informed decision-making.

Technical breakdown

How domain compromise chains through identity exposure

Domain compromise rarely starts with a dramatic exploit. It usually begins with an exposed weakness that becomes useful only when paired with weak credential governance, stale trust relationships, or overbroad reach across endpoints. In this case, the article describes exploitation of Zerologon and noPAC, both of which can be chained into domain-level access when identity and authentication controls are not hardened. The critical point is that the attack surface was not just a vulnerability list. It was an identity graph with reachable privilege paths that could be traversed fast once the attacker had a foothold.

Practical implication: map where authenticated paths can turn into domain control before integration or remediation decisions are made.

Why endpoint credentials and lateral movement matter in M&A

Compromised credentials on endpoints are often the real accelerant in post-acquisition environments. Once attackers obtain valid credentials, they can move laterally through inherited trust, administrative reuse, and weak separation between business units or remote sites. The article’s 27 compromised credentials across 53 endpoints show how quickly identity sprawl can create a chained attack surface. This is where PAM, least privilege, and segmentation converge, because the technical weakness is rarely a single machine. It is the persistence of reusable access across many systems that makes compromise scalable.

Practical implication: treat endpoint credential exposure as a route to enterprise compromise, not a local containment issue.

How safe validation changes remediation from theory to proof

A repeatable find, fix, verify cycle is the only way to know whether remediation actually removed attack paths. The article shows that follow-up testing uncovered 24 new weaknesses introduced by ongoing change, which is a reminder that remediation is a moving target in distributed environments. In hybrid IT and OT estates, validation must be careful enough to avoid production disruption while still proving whether segmentation, authentication, and privilege boundaries hold. Without retesting, security teams only know what was changed, not whether the compromise path was really closed.

Practical implication: build retesting into every material change so closed paths are proven closed, not assumed closed.

Threat narrative

Attacker objective: The attacker objective is to gain domain-level control that can be used to expand access, disrupt operations, and expose high-value files for ransomware or extortion.

1. Entry occurred through exploitable weaknesses that could be chained into an initial foothold in the acquired environment.
2. Credential and trust abuse followed as compromised credentials and vulnerable domain relationships enabled privilege expansion.
3. Impact came when the chain reached domain compromise and ransomware exposure across nearly 200,000 sensitive files.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Acquisition security fails when inherited identity paths are treated as background noise. The article shows that merger due diligence is not just about whether a target is patched, but whether its identity and trust relationships can be traversed into domain compromise. That is a governance failure, because acquisition teams often inherit access graphs before they understand them. Practitioners should treat pre-integration identity mapping as a mandatory control, not a post-close cleanup task.

Standing credential exposure is the real merger risk multiplier. The combination of compromised credentials, multiple endpoints, and fast domain compromise shows how access reuse turns a local issue into an enterprise one. This is exactly where IAM and PAM discipline matters, because the problem is not only who has access, but how long that access remains valid after organizational change. Practitioners should assume credentials in acquired estates are already part of the attack path until proven otherwise.

Segmentation-first validation is a control, not a testing preference. The article’s safe testing approach matters because it demonstrates that security verification can be done without sacrificing production stability. In hybrid IT and OT environments, isolation between zones is the control that determines whether offensive testing is safe and whether lateral movement can be contained. Practitioners should anchor merger readiness in verified segmentation boundaries, not in network diagrams or inherited documentation.

Continuous verification creates a measurable alternative to security theater. The repeated retest model uncovered new weaknesses after remediation, proving that change introduces fresh exposure even when teams believe they have closed the gap. That is the central lesson for security governance: if validation is one-off, assurance decays immediately. Practitioners should build acquisition programs around recurring proof of control effectiveness, not one-time assessments.

Identity and vulnerability management converge in post-acquisition estates. The named concept here is acquisition identity sprawl, where legacy domains, duplicated administrator rights, and untracked credentials create a composite attack surface. This is where NHI-style lifecycle thinking becomes useful even in human identity environments, because every reusable secret or credential extends the window for lateral movement. Practitioners should govern acquisition identity like an exposed privilege system, not a static inventory.

From our research:

• Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
• From our research: Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to The 2024 ESG Report: Managing Non-Human Identities.
• Forward pivot: See 52 NHI Breaches Analysis for root-cause patterns that help explain why exposed credentials keep turning into repeated incidents.

What this signals

Acquisition identity sprawl is the programme risk this article makes visible. Once an organisation combines legacy domains, endpoints, and remote sites, identity governance shifts from inventory management to blast-radius control. The practical question is no longer whether accounts exist, but whether trust paths can be traversed across the estate before integration is complete.

The right signal to watch is whether remediation produces durable closure or only temporary relief. Repeated retesting, verified segmentation, and privilege-path mapping are the controls that tell you if your acquisition programme is shrinking attacker reach. The NIST Cybersecurity Framework 2.0 and NIST SP 800-53 Rev 5 both reinforce that validated control effectiveness matters more than documented intent.

For identity teams, the lesson carries into broader NHI governance as well. When reusable access, service accounts, or privileged credentials are left to persist across organisational change, the attack surface expands faster than policy can catch up. That is why lifecycle control and proof of closure need to sit inside every integration programme, not outside it.

For practitioners

• Map inherited identity trust before integration Inventory domain trusts, administrative reuse, privileged groups, and endpoint authentication paths before the acquired environment is joined to the parent estate. Use that map to identify where a single compromised credential could become domain-level access. Link the mapping exercise to merger close criteria, not to post-integration remediation.
• Test segmentation between business zones first Validate that production, corporate IT, remote site, and OT segments remain isolated under realistic attack conditions before expanding test scope. If lateral movement is possible across zones, treat that as a merger readiness blocker because it creates blast-radius expansion even when individual systems appear healthy.
• Prioritise compromised credential pathways over raw vulnerability counts Use offensive validation to identify which endpoints, accounts, and services can actually be chained into compromise. Close the paths that enable privilege escalation and lateral movement before spending time on low-impact findings that do not change attacker reach.
• Build retesting into every material change Re-run validation after remediation, restructuring, or site onboarding because new weaknesses can appear as configurations drift and systems change. Treat retesting as the proof that control boundaries still hold, especially in environments with frequent integration work.

Key takeaways

• The article shows that merger risk is often an identity problem first, because reachable trust paths can turn inherited systems into domain compromise routes.
• The evidence is concrete: 79 weaknesses, 27 compromised credentials, four domain compromise paths in 35 minutes, and nearly 200,000 files exposed to ransomware risk.
• The control that changes the outcome is verified segmentation plus repeated retesting, because acquisition security only improves when closure is proven, not assumed.

Key terms

• Acquisition-driven identity sprawl: The accumulation of duplicated users, administrators, authentication methods, and directory exceptions after mergers or acquisitions. It happens when integration moves slower than business growth, leaving multiple trust models alive at the same time. The result is more complexity, more privilege, and a larger attack surface.
• Domain Compromise Path: A sequence of weaknesses that lets an attacker move from initial access to control of a Windows domain or similarly central identity layer. The path usually combines credential exposure, privilege escalation, and trust abuse, making it a stronger risk indicator than isolated findings.
• Secret Segmentation: The practice of separating credentials by tenant, context, environment, or user so one compromise does not expose everything. For AI systems, segmentation reduces blast radius and helps align access with the exact workflow the agent is executing.
• Control Retest: A follow-up validation exercise performed after remediation to confirm that a weakness is truly closed. Retest is essential when systems change quickly, because new configuration drift can recreate exposure even after the original issue has been fixed.

What's in the full article

Horizons.ai's full blog covers the operational detail this post intentionally leaves for the source:

• Step-by-step remediation sequencing for the highest-risk weaknesses found during the baseline pentest.
• The follow-up validation approach used to confirm that prior fixes actually closed the compromise paths.
• Operational detail on safe testing in hybrid IT and OT environments without disrupting production networks.
• The rollout pattern across 20 additional sites, including how local teams were empowered to retest.

👉 The full Horizons.ai post covers the attack paths, remediation sequence, and retest model in more operational detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management for practitioners building stronger control models. It is designed for teams that need to connect identity governance to operational security decisions across complex environments.