Acquisitions merge attack surfaces before inventories
When one organisation buys another, the networks connect long before anybody understands what was acquired.
The acquired estate arrives with its own unknown systems, its own unpatched software and its own existing compromises, and it is now reachable from yours. This is a well-documented route into large organisations. The integration timeline is commercial; the security assessment is rarely allowed to be on the critical path.
More on Attack surface management
- The Internet sees what you expose, not what your CMDB remembersCounted three. Answering six
- A new subdomain can create a new perimeterThe fence just got longer
- Shadow IT becomes shadow attack surfaceDoors around the back
- Internet exposure is a property that changesThe tide does not read your map
- A forgotten test system can be a production entry pointThe shed is still joined to the house
- Third-party hosted assets still carry your nameTheir building, your name over the door