Businesses are neglecting security in M&A deals due to fast-paced transactions.

Mergers and acquisitions (M&A) are often fast-paced events driven by the promise of business growth and demands from stakeholders. However, cybersecurity considerations tend to be overlooked amidst the whirlwind of deal-making, as stated by Dave Lewis, the global advisory CISO at 1Password.
Lewis uses the example of a recent incident involving Salesforce apps and SalesLoft to illustrate his point. In this case, the acquired company had unresolved security issues related to OAuth tokens that were exploited by attackers soon after the merger, underscoring how existing vulnerabilities can quickly become significant risks. This scenario is not isolated and has been observed frequently across the industry.
The question arises – why does this trend persist? Lewis suggests that the urgency of business objectives often supersedes the need for comprehensive technical assessments. Companies prioritize closing deals swiftly, merging systems, and forging ahead without giving due consideration to security implications. Security teams are typically engaged post-transaction to address issues that could have been prevented through thorough pre-deal evaluations.
The complexity of M&A transactions creates a challenging environment in terms of technology integration, identity management systems, compliance standards, all amid the changes in organizational culture. Without a structured framework for evaluating inherited risks, enterprises leave themselves vulnerable to breaches, data loss, and regulatory violations. Lewis emphasizes the importance of security being a fundamental component of the due diligence process right from the initial stages. This includes scrutinizing identity management protocols, assessing access controls, and conducting threat assessments before any systems are integrated. Furthermore, he highlights that cybercriminals closely monitor M&A activities, exploiting any vulnerabilities that may arise during the transition period.
The key lesson to be learned is that each acquisition brings along a set of inherent risks. To safeguard shareholder investments and maintain customer trust, cybersecurity cannot be an afterthought during M&A activities; it must be a primary consideration throughout the process.