After a merger, the first security project is a list

When two companies merge, the announcements talk about synergy. The security team inherits something less glamorous: two of everything, described two different ways.

Two directories. Two endpoint tools. Two definitions of “server”. Two spreadsheets that each claim to be the source of truth, and a long tail of assets that appear in neither.

The temptation is to start with the visible work: a single sign-on, a common policy, a shared tool. Those matter. But every one of them quietly assumes you know what you have, and after a merger you don’t.

So the first project is a list. One inventory, one naming scheme, one owner per asset. It’s slow, unexciting work, and it’s where the real findings turn up: the devices nobody is patching, the accounts that belong to people who left, the systems each side assumed the other was looking after.

A few things I’d hold to.

Count before you consolidate. Migrating tools on top of an unknown estate just moves the unknowns.

Treat “unowned” as a finding, not a field. An asset without a name against it is a risk someone has to accept out loud.

Publish the number. One figure the leadership team sees every month does more than any status report.

Integration isn’t finished when the logos change. It’s finished when one list describes one company, and someone is accountable for every line on it.