What should you do with an acquired company's attack surface in the first 30 days?

Why are acquisitions a special case?

An acquired company arrives with its own domains, cloud accounts, certificates, vendors and habits. Its inventory, if it has one, is incomplete. Its people know where things are, but some will leave. And the business wants to know quickly what it bought. Several vendors in our set describe mapping assets to acquired companies: IONIX describes M&A discovery and attribution to subsidiary or business owner, CyCognito attribution to subsidiary, brand or business unit, and watchTowr mapping assets to subsidiaries, brands and M&A.

Days 1 to 10: find and attribute

1. Collect what the acquired company knows: domains, cloud accounts, IP ranges, CDN and WAF vendors.
2. Run discovery from that list and from the company name, and compare the two.
3. Attribute every asset to an owner in the acquired company, and mark doubtful matches for review.

Days 11 to 20: protect and close the easy ones

1. Find which internet-facing applications sit behind a WAF, which WAF, and which sit behind none. Acquired companies often use a different WAF or CDN vendor.
2. Look for dangling DNS records and expired domains still referenced by the company's sites. These are quick to close and easy to exploit. IONIX describes buying expired domains and claiming abandoned cloud buckets on the customer's behalf; you can also do it by hand.
3. Put compensating controls in front of anything confirmed exploitable that cannot be fixed this month.

Days 21 to 30: hand over and scope

1. Agree who owns fixes in the acquired company after the integration team moves on.
2. Make the acquisition the scope of your next CTEM cycle. Gartner's guidance is to align assessment and remediation with business projects rather than infrastructure components alone, and an acquisition is a business project.
3. Report to the business: assets found, assets protected, exposures confirmed, fixed and accepted.

Which tool types help?

Discovery with strong attribution for steps 1 to 3, WAF posture for step 4, compensating controls for steps 5 and 6, and CTEM programme support for steps 7 to 9. The exposure finder weighs these if you answer that you have subsidiaries or recent acquisitions.