Notifications
Clear all
Topic starter
11/07/2026 8:37 pm
TL;DR: Cyber due diligence for VC and PE firms needs two phases: immediate domain breach monitoring after close, then continuous Active Directory security once integration begins, according to Enzoic. IBM’s 2025 Cost of a Data Breach Report puts the average credential-based breach at $4.45M, making inherited identity risk a valuation issue as well as an operational one.
NHIMG editorial — based on content published by Enzoic: Securing the Deal: Cyber Due Diligence for VC and PE Firms
By the numbers:
Questions worth separating out
Q: How should security teams handle exposed credentials during M&A due diligence?
A: They should treat exposed credentials as inherited identity risk and verify them as early as possible after close.
Q: Why do acquisitions increase account takeover risk?
A: Acquisitions increase risk because the buyer inherits identities, passwords, policies, and exceptions that may already be weak or compromised.
Q: What breaks when Active Directory security is not updated after a deal closes?
A: Inherited credentials and old policy settings remain usable, which gives attackers a path from initial access into broader compromise.
Practitioner guidance
- Start domain breach monitoring at close Check whether target-company employee credentials are already appearing in breach data before integration work begins.
- Force resets and MFA re-enrollment for exposed accounts Require credential resets for any user or service identity linked to known exposure, and re-enrol MFA where authentication trust may have been weakened.
- Review inherited Active Directory policy exceptions Audit password complexity, expiration, legacy authentication paths, and group membership inherited from the acquired company.
What's in the full article
Enzoic's full post covers the operational detail this analysis intentionally leaves for the source:
- Domain breach monitoring workflow for identifying exposed acquired-company credentials.
- Active Directory remediation steps for resetting passwords, re-enrolling MFA, and removing inherited exceptions.
- Post-close monitoring approach for tracking credential reuse through the integration period.
- Board-facing framing for showing how cyber due diligence affects valuation and deal velocity.
👉 Read Enzoic's guidance on cyber due diligence for VC and PE credential screening →
Credential exposure in M&A: what IAM teams need to secure first?
Explore further
11/07/2026 9:06 pm
Credential exposure becomes inherited risk at close: Acquisition due diligence assumes the target’s security posture can be assessed before ownership changes. That assumption breaks because exposed credentials remain usable after legal close, when attacker interest is often highest. The implication is that identity risk must be treated as a transaction asset problem, not just a post-merger remediation queue.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, which shows how quickly one identity weakness can become a repeated attack pattern.
A question worth separating out:
Q: Who is accountable for credential exposure found after an acquisition?
A: Accountability should sit with both the acquiring security team and the deal team, because identity risk affects valuation, integration, and operational continuity. The buyer needs a defined owner for remediation, a timeline for resets and policy cleanup, and a way to prove that inherited access has been reduced before normal business resumes.
👉 Read our full editorial: Cyber due diligence for M&A starts with credential exposure
