Topic starter
16/01/2026 1:19 pm
TL;DR: Mergers and acquisitions expand the identity attack surface by inheriting dormant accounts, shadow privileges, orphaned service accounts, and misconfigured SSO paths, according to Hydden. The real risk is that IAM, IGA, and PAM controls are built for stable estates, not for rapid integration with fragmented identity data and configuration drift.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “How M&A Activity Increases Identity Risks”.
Key questions
Q: What breaks when identity governance is not in place during an acquisition?
A: Without identity governance, merger teams lose track of who owns access, which accounts are temporary, and where privileged rights overlap.
Q: Why do orphaned service accounts create so much risk after an acquisition?
A: Orphaned service accounts are dangerous because they often keep working after the original owner has left or the original environment has changed.
Q: How do security teams know if inherited access is actually under control?
A: They know it is under control only when duplicate accounts are removed, privileged access is vault-managed, stale credentials are rotated, and each identity has a clear owner.
Practitioner guidance
- Map every inherited identity before Day One Build a pre-merger inventory of human accounts, service accounts, API keys, certificates, and privileged entitlements across both estates before access is expanded.
- Reconcile trust paths and SSO integrations early Review federated trust, SSO configurations, and cross-domain authentication paths to remove unintended trust relationships created by the merger.
- Isolate inherited privileged access immediately Vault privileged accounts and keys as soon as they are discovered, then reduce standing access to the smallest viable set while integration work continues.
Bottom line: M&A risk is fundamentally an identity governance problem because the combined estate inherits accounts, privileges, and trust paths that were not designed to be managed together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 1:35 am
M&A creates identity debt faster than governance can absorb it: The merged estate inherits accounts, entitlements, trust relationships, and machine identities that were never designed to be governed as one. That is why the most dangerous risk is not a single bad account but the accumulation of identity debt across two operating models. Practitioners should treat integration as an identity reconstruction problem, not just an access migration.
A question worth separating out:
Q: What should IAM teams do when two companies use different access models?
A: IAM teams should establish a temporary control baseline that covers both estates, then normalise authentication, entitlement, and privileged access policies before expanding trust. The point is not to preserve both models indefinitely. It is to reduce the combined estate to one governed identity plane as quickly as possible.
👉 Read our full editorial: M&A identity chaos exposes inherited NHI risk across merged estates