Why do acquisitions increase account takeover risk?

Why This Matters for Security Teams

Acquisitions expand account takeover risk because identity becomes the easiest path through a transition that is already messy. The buyer inherits user accounts, service accounts, passwords, MFA states, delegated admin rights, exceptions, and stale integrations that were configured under a different security model. That mix creates more opportunities for password reuse, credential stuffing, and unnoticed privilege sprawl, especially when IT teams are focused on business continuity rather than hard resets.

This is not only a human-identity problem. Mergers often expose hidden non-human identities as well, and NHI Management Group notes that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys in its Ultimate Guide to NHIs. The broader lesson aligns with NIST Cybersecurity Framework 2.0: identity risk must be governed continuously, not only during steady state. In practice, many security teams encounter account takeover only after inherited access has already been used in production, rather than through intentional discovery of risky accounts.

How It Works in Practice

During an acquisition, attackers benefit from uncertainty. Identity inventories are incomplete, password policy mismatches are common, and administrators often keep temporary exceptions in place to avoid disrupting business operations. That makes takeover more likely in three places: reused employee credentials, legacy admin accounts, and machine identities that were never rotated or offboarded.

A practical response starts with rapid identity triage. Teams should inventory all directory sources, federated logins, privileged accounts, shared mailboxes, and service credentials on day one, then classify them by exposure and business criticality. The goal is not to trust inherited access, but to re-establish proof of ownership and purpose. Current guidance from NIST SP 800-53 Rev. 5 Security and Privacy Controls supports strong account management, access enforcement, and auditability, which become essential when two identity ecosystems are merged.

• Reset credentials for high-risk user and admin accounts early in the integration window.
• Revoke dormant access, shared accounts, and orphaned API keys before directory synchronization expands trust.
• Require MFA re-enrollment where assurance levels differ between the two organisations.
• Review service accounts, CI/CD secrets, and third-party integrations separately from human users.
• Use the transition to remove exceptions rather than grandfathering them into the new environment.

Acquisitions also create a false sense of safety when teams rely on imported policies without verifying whether they still match the new operating model. NHI Management Group’s Top 10 NHI Issues highlights how excessive privilege and weak rotation frequently persist unnoticed after integration. These controls tend to break down when the acquired company uses multiple directories, unmanaged SaaS tenants, or embedded secrets in code because identity evidence is fragmented across systems.

Common Variations and Edge Cases

Tighter identity cleanup often increases integration overhead, requiring organisations to balance takeover reduction against merger timelines and business continuity. That tradeoff becomes sharper when the acquired business runs customer-facing services, regulated workloads, or acquired technology that cannot tolerate immediate credential resets.

Best practice is evolving on how quickly to force full identity convergence, and there is no universal standard for this yet. Some organisations phase the cutover by risk tier, starting with privileged users and externally exposed accounts, while others isolate the acquired environment and federate only the minimum necessary access. Both approaches can work if the security team can prove who owns each identity, what it can reach, and how quickly it can be revoked.

Edge cases also matter. A clean employee directory can still hide risky machine access through old CI/CD tokens, vendor service accounts, or backup credentials stored outside a secrets manager. The Ultimate Guide to NHIs notes that many organisations store secrets outside approved vaults, which means an acquisition can surface dormant exposure long after the human accounts are remediated. Acquisition risk is highest when identity, secrets, and admin exceptions are merged faster than they can be validated.

Related resources from NHI Mgmt Group

• Why do passkeys reduce account takeover risk more effectively than OTP?
• Why do phone-number based login methods create account takeover risk?
• How should security teams reduce AI-enabled account takeover risk in authentication flows?
• Why do Salesforce integrations increase NHI risk?