Why do mergers and acquisitions create hidden identity risk even when due diligence looks complete?

Why This Matters for Security Teams

M&A identity risk is hidden because diligence usually inventories systems, not effective authority. A clean spreadsheet can still miss service accounts, stale API keys, delegated admin paths, and identities created outside formal onboarding. Once networks, directories, and SaaS tenants are connected, inherited trust expands faster than most teams can validate it. NHI Management Group research notes that only 5.7% of organisations have full visibility into their service accounts, which helps explain why post-deal surprises are so common in the Ultimate Guide to NHIs.

That gap matters because identity is the control plane for access, not just a record of users. If the acquired environment contains unmanaged NHIs, then the integration itself can create new privilege chains, data exposure paths, and third-party reach before anyone finishes remediation. Security teams often assume risk is static at close, but in reality the transaction changes who can authenticate, delegate, and automate on day one. Current guidance from NIST Cybersecurity Framework 2.0 reinforces that asset and access governance must track operational change, not just discovery. In practice, many security teams encounter compromise only after domain trust, SaaS federation, or CI/CD access has already been merged.

How It Works in Practice

The safest M&A approach treats identity as a pre-integration workstream, not a cleanup task. Teams should separate human accounts from NHIs, map where secrets live, identify privileged service accounts, and trace each identity to an owner, purpose, and expiry. The 52 NHI Breaches Analysis is useful here because it shows how often incident patterns involve forgotten access paths rather than obvious compromise.

Practically, that means:

• building a merged identity inventory before trust relationships are enabled;
• tagging orphaned accounts, shared logins, and dormant integrations for immediate review;
• resetting or rotating secrets tied to acquired systems before federation;
• validating ownership for each admin role, API key, and automation token;
• using least privilege and time-bound access for remediation teams.

Controls such as inventory reconciliation, privileged access review, and secret rotation should be executed at the pace of the integration, not the pace of the legal close. The challenge is that many acquired environments already violate basic hygiene, so a single directory sync can inadvertently extend broad access across both estates. NIST’s control baseline in NIST SP 800-53 Rev 5 Security and Privacy Controls is relevant here because it emphasizes access enforcement, accountability, and system integrity during transition activities. These controls tend to break down when legacy accounts are undocumented and the target company has no reliable owner for service credentials.

Common Variations and Edge Cases

Tighter identity control during M&A often increases integration cost and can slow synergies, requiring organisations to balance speed against containment. That tradeoff becomes harder when the deal includes shared infrastructure, outsourced operations, or cloud environments where the buyer cannot easily inspect the full identity graph. Best practice is evolving, but there is no universal standard for this yet: some teams freeze all privileged changes, while others allow only narrowly scoped exceptions with explicit expiry.

Edge cases are usually the ones that create the worst hidden risk. Carve-outs may leave behind dangling trusts, while tuck-in acquisitions can inherit legacy SaaS tenants with incomplete logs. Third-party access is another common blind spot, especially where vendors authenticate through federated identities that were never documented in the data room. For deeper context, NHI Management Group’s Top 10 NHI Issues and Ultimate Guide to NHIs — Key Challenges and Risks both highlight how excessive privilege and poor offboarding persist after ownership changes.

The practical rule is simple: if the buyer cannot explain who owns an identity, what it can reach, and how quickly it can be revoked, the risk is not contained. In post-merger environments with weak logging, cross-domain federation, or shared secrets in CI/CD, identity risk compounds faster than conventional due diligence can reveal it.

Related resources from NHI Mgmt Group

• Why do mergers and acquisitions create identity risk even when the acquirer has strong IAM controls?
• Why do non-human identities create compliance risk even when policies exist?
• Why do collaboration platforms create identity risk even when the workspace looks tidy?
• Why do business applications create hidden identity risk even when perimeter security is strong?