Topic starter
27/06/2026 1:52 pm
TL;DR: Mergers and acquisitions create email security blind spots because acquired tenants often inherit legacy authentication, uneven policy enforcement, and delayed oversight, with one healthcare example finding 14% of accounts lacking MFA and a manufacturer uncovering 18 compromised inboxes before close, according to Abnormal AI. For IAM and security teams, deal integration is now an identity governance problem as much as an email defence problem.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Securing the Deal: Reducing Email Risk During Mergers & Acquisitions”.
By the numbers:
- The FBI reported over $2.7B in 2024 losses from business email compromise alone.
Key questions
Q: What breaks when acquired tenants are integrated without a pre-close security review?
A: The main failure is that inherited email risk becomes part of the live enterprise before anyone can baseline it.
Q: Why do acquired tenants increase business email compromise risk?
A: Because M&A combines trust expansion with uneven governance.
Q: What are the warning signs that tenant integration is not under control?
A: Common signals include overlapping gateway licences, large numbers of policy exceptions, accounts still using legacy authentication, and slow visibility into admin and vendor access.
Practitioner guidance
- Establish pre-close tenant visibility Use read-only access to inventory users, admins, mail rules, OAuth apps, and legacy authentication settings before the acquisition closes.
- Baseline MFA and authentication methods Identify acquired accounts still relying on legacy auth or missing MFA, then prioritise those identities for immediate post-close hardening.
- Standardise oversight across all tenants Move acquired Microsoft and Google tenants onto one reporting and response model so exceptions, approvals, and alerts are managed consistently.
Bottom line: M&A expands business email compromise exposure because acquired tenants often carry weaker authentication and fragmented oversight into the parent estate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:22 pm
Acquisition integration is an identity lifecycle problem before it is an email security problem. The article shows that tenants arrive with their own users, apps, vendors, and exceptions, which means governance starts before the first post-close migration step. That is exactly where most programmes underperform: they treat integration as a technical merger instead of a controlled lifecycle transition. Practitioners should treat tenant onboarding, exception review, and auth baseline validation as part of the acquisition process itself.
A question worth separating out:
Q: How should security teams govern email risk during M&A?
A: Treat the acquisition as a governance workflow, not just a migration project. Start with pre-close visibility, document inherited identities and mail connections, standardise controls across tenants, and remove legacy auth paths as soon as ownership allows. The goal is to preserve business continuity while closing the gap between control ownership and effective enforcement.
👉 Read our full editorial: M&A email risk exposes security gaps across acquired tenants