The add-on closes Friday. What IT does in the first 30 days

Platform acquisitions get the full treatment: diligence teams, a 100-day plan, an integration budget with its own line items. The add-on that closes 8 months later gets a fraction of that. It is a 30-person tuck-in, the thesis is straightforward and everyone’s attention is on customers and the sales pipeline. IT gets a sentence in the integration memo: “migrate to platform systems over time.”

Here is the uncomfortable arithmetic behind that sentence. On the Friday the deal closes, the platform’s attack surface grows by every laptop, every account, every forgotten VPN credential and every unpatched server the add-on owns, and it grows before a single one of those assets is inventoried. Attackers read deal announcements. Newly acquired companies see phishing waves within days of the press release, themed around the acquisition itself: fake “new payroll portal” emails, fake instructions from the new parent’s CFO. The smallest company in the portfolio becomes the most attractive door into the largest.

So the first 30 days of add-on IT are not about integration. Integration is the months-long project that follows. The first 30 days are about putting a floor under the risk you just purchased, with a sequence small enough to run without pausing the business.

Week 1: see what you bought

Diligence on an add-on is often financial-first and light on IT, which means the honest starting point is discovery:

• Inventory accounts and access. Every user account, every admin, every third party with remote access. The add-on’s IT might be 1 overworked person or an hourly local provider; either way, get the password vault, the domain admin credentials and the list of who can reach what, in writing, before memories fade
• Find the money paths. Who can initiate payments, approve wires and change vendor banking details, and from which systems. Payment fraud against newly acquired companies is a pattern, not an anecdote, because attackers know approval chains are in flux
• Catalog the crown jewels. Customer lists, pricing, drawings, formulas. Where they live, who can reach them, whether anything leaves the building on personal accounts
• Check the backups. When the last restore test happened, where copies live and whether the credentials that manage backups are the same ones an attacker would steal first

Weeks 2 to 3: the 4 controls that move risk fastest

Resist the urge to redesign anything. Four moves cover the bulk of the exposure:

1. MFA on email and remote access, enforced, everyone. The add-on’s email tenant is the beachhead for every acquisition-themed phish. This is days of work, not weeks, and it is the single highest-return hour the integration will ever spend
2. Offboard the ghosts. Terminated employees, expired contractors, the former owner’s brother-in-law who “still helps sometimes.” Every stale account is a credential that cannot be phished away from someone who no longer exists
3. Endpoint protection the platform can see. Deploy the platform’s EDR to the add-on’s machines, into the same console someone already watches. Visibility first, standardization later
4. A payment verification rule, announced loudly. Any change to banking details or any unusual payment request gets voice verification on a known number, no exceptions during the integration period. Say it at the all-hands, because the first fraudulent “new parent company wire instructions” email may already be in someone’s inbox. The deeper playbook is in wire fraud and the first 48 hours

Week 4: decide the integration path with data

Only now, with the environment visible and the floor in place, is the integrate-or-isolate decision worth making. Three honest options, and mature platforms use all 3 across their add-ons:

• Absorb. Migrate the add-on onto platform identity, email and tooling next quarter. Right when systems are commodity and the add-on’s stack is weak
• Connect. Keep the add-on’s line-of-business systems, bridge identity and security monitoring to the platform standard. Right when the add-on runs specialized software the platform does not
• Quarantine. Keep networks and identity fully separate for a defined period. Right when discovery found problems that should not touch the platform until they are cleaned up

What makes any of these work is the platform standard itself, the documented baseline the 100-day plan built: identity, EDR, backup, monitoring and reporting that every portfolio company lands on eventually. If that baseline exists, each add-on is a known quantity of work. If it does not, every add-on is a snowflake and the integration debt compounds with each deal. The baseline is the heart of the 100-day cybersecurity plan, and the same artifacts become the sell-side story at exit, as covered in the 18-month runway.

The sponsor’s one-page view

Operating partners juggling several add-ons a year need this reduced to a dashboard line per deal: discovery complete, 4 controls in place, integration path chosen, target date. That is the whole status. When the add-on’s IT floor is in place by day 30, the integration proper can run on the business’s schedule instead of the attacker’s, and the quarterly report says so in a sentence.

Atticus Rowan runs this sequence as the IT partner on lower-middle-market deals, from the Friday close through the integration that follows, for sponsors and for the portfolio company teams doing the absorbing. The buy-side view of what to check before the deal closes is in PE cybersecurity diligence, and the full lifecycle picture is in our PE portfolio cybersecurity guide. If an add-on is closing this quarter and the IT sentence in the integration memo is still just a sentence, start a conversation.