So, your security company was acquired – what next?

Dave Lewis gives his first-hand advice on how not to panic during an infosec takeover

There might be a time in your career where you find yourself sitting at your desk in the morning, sipping a coffee and scanning through your email when you see one sitting there flagged as ‘highly important’.

“We’re pleased to announce that we’ve been acquired by the ACME MEGA corporation!” writes your company’s CEO.

The cup slips in your hand ever so slightly.

If you ever find yourself in a situation like this, it is important to breathe. Do not do anything rash. Let the thoughts percolate for a while – you will experience a wide array of emotions and you need to hold on tight.

Having worked for numerous companies in the past that have acquired other firms, I have learned a lot from experience.

Acquisitions are rather common, particularly in the cybersecurity industry.

It is important to make the newly-minted employees of your company feel welcome. If they’re made to feel alienated, they will leave, and they will do so in short order.

Further to that end, you need to ensure that you have contractual language in place to avoid losing the staff for your newly-acquired gem.

One company that I worked for in the past bought a small firm that had a solid data science team in house.

Shortly after the acquisition was announced, the entire team pulled up stakes and left to join a competitor, and there was nothing in the contract that would have discouraged that. A ball had been dropped.

Managing perspectives with peers in the industry can be a curious thing as well.

There is this misconception that there are Scrooge McDuckian pools of currency and the staff are all swimming in the backstroke through piles of pounds, euros, and dollars. This conception can provide for added stress to the staff involved.

Also, retaining staff can be a difficult task. Trying to integrate a new crew into an alternate reality can be problematic. There is an institutional distrust if the two are former competitors.

Sometimes the team from the acquirer can exhibit an inadvertent arrogance or malaise that can cause negative impact to morale without realizing it.

Managing mental health

I’ve been very fortunate to be on the receiving end of an acquisition only once and it was an extremely positive experience. Unfortunately, I do realize that this is the exception as opposed to the norm.

There is a certain anxiety that comes with being part of the company that is being acquired. The fear of the unknown coupled with the fear of losing one’s job can be a powerful force.

Always keep your skill set current and your resume up to date. Hopefully you won’t need the latter, but it is better to be prepared than to be scrambling in the event of a hostile takeover.

I worked at a company in the past that had huge layoffs more than a few times. I was part of the team collecting laptops and cell phones from co-workers as they were marched out of the building en masse.

That anxiety took on a different perspective there, as the guilt of having survived the layoffs caused me many sleepless nights. Mental health must always be kept in tight focus by both sides of the deal when an acquisition takes place.

Due diligence is another key component that needs to be given prompt attention when your shop buys another company.

Your team is walking into a new situation blindly and you have to hope that the documentation is current and that there are no surprises. But if we’re being honest with ourselves, there is always a surprise lurking someplace on the network.

There needs to be a rationalization of assets to remove duplication wherever possible to lower costs of maintaining the environment and limiting potential exposures.

A complete security assessment has to take place to hunt for possible ‘gotchas’ that may have accumulated over time due to compounded security debt.

Keep a record. This might seem rather simplistic but, it is an often-overlooked step.

Between managing staff expectations and anxiety to making sure you know where the potential nasties are lurking, there is nothing simple about going through a corporate takeover.