Day 1 — the welcome
A buyer connected the target to corporate identity and collaboration services so teams could work together immediately. A trusted network path was added for finance-data migration. The integration signalled momentum.
Day 4 — the first use
A target administrator used a long-standing privileged account to configure synchronisation. The account had been compromised weeks before signing through a vendor remote-access tool.
Day 9 — the expansion
The attacker used the new trust to collect directory information, reach shared documents and create a persistent application credential in the buyer’s environment. The activity looked like integration work.
Day 17 — discovery
A monitoring alert found unusual access from the target tenant. By then the buyer had to investigate both environments, pause migration and notify leadership that the acquisition had expanded the incident.
What failed
The integration plan assumed the target was merely less mature, not actively hostile. Commercial urgency converted organisational trust into technical trust before the buyer had established identity, device and administrator integrity.
The interruption control
- Treat the target as an untrusted external environment until evidence changes that state.
- Use clean buyer-issued identities for integration personnel.
- Inspect privileged accounts, persistence, vendor access and logs before federation.
- Move data through controlled transfer zones rather than broad network trust.
- Define the evidence required to increase connectivity in stages.
The integration gate
No new trust path should open without an owner, business purpose, maximum consequence, monitoring plan, expiry and rollback. Speed comes from a pre-built quarantine pattern, not from pretending the risk begins at close.