Topic starter
10/06/2026 11:07 pm
TL;DR: Security in acquisitions and partnerships now affects product trust, legal exposure, and integration risk because a deal inherits technology, process gaps, and security weaknesses, according to 1Password’s Chasing Entropy conversation with Matt O’Leary. The governance lesson is that identity, diligence, and post-close integration have become one control plane, not separate workstreams.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “Why security makes or breaks M&As, with Matt O’Leary”.
Key questions
Q: What breaks in an acquisition when inherited access is not mapped before close?
A: Unmapped inherited access turns diligence gaps into operational risk.
Q: Why do partnerships create access risk even when no acquisition is involved?
A: Deep partnerships often create shared trust through connected systems, delegated rights, and authenticated integrations.
Q: What are the signs that M&A diligence is too shallow for identity governance?
A: Warning signs include undefined ownership for inherited accounts, late discovery of privileged exceptions, missing offboarding plans for duplicate access, and integration timelines that assume security cleanup can happen later.
Practitioner guidance
- Map inherited identity and access assets before close Build a pre-close inventory of service accounts, privileged roles, partner connections, and other access paths that will survive the transaction.
- Treat technical diligence as a deal gate Require security and engineering sign-off for material exposure in the target’s identity and infrastructure posture.
- Define trust boundaries for partnerships early Document which systems, data flows, support processes, and access routes will be shared with a partner before integration begins.
Bottom line: Acquisitions and partnerships import identity, access, and trust dependencies, so security diligence belongs inside M&A governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 4:56 am
M&A security diligence is now an identity governance discipline, not a point-in-time security review. The article’s central point is that acquisitions and partnerships inherit identity, access, and trust relationships along with the business itself. That makes diligence part of the identity lifecycle, because access that is not understood before close will become harder to govern after integration. Practitioners should treat pre-close assessment as the start of governance, not a separate exercise.
A question worth separating out:
Q: Who should own access cleanup during post-merger integration?
A: Ownership should sit across corporate development, security, engineering, and the business leader responsible for the acquired capability, with one team accountable for the access transition end to end. If ownership is fragmented, identity rationalisation is usually delayed until customer impact or audit pressure forces action.
👉 Read our full editorial: Security diligence in M&A is now an identity governance issue
This post was modified 1 day ago by NHI Mgmt Group