M&A Insider Exfiltration Risk and the Pre-Close Security Investment Case

A merger or acquisition creates the one moment when a company most needs its detection systems to work and the one moment those systems are least able to see anything clearly. That is not a figure of speech. Two forces land on the same calendar date and reinforce each other: the baseline of normal network activity disappears as two organizations merge their systems, and the people most likely to steal something are, for the first time, all under pressure at once. Behavioral detection depends on knowing what normal looks like so it can flag what isn't. During a merger, massive data transfers, new cloud connections, and shifting access grants are the expected texture of the week, so the reference point for "normal" simply stops existing. At the same time, every employee at the acquired company is facing the same uncertainty about their job on the same timeline, which concentrates what is ordinarily a slow trickle of individual risk into a single, compressed episode across an entire workforce. 52% of organizations report that a major undiscovered or undisclosed cybersecurity risk in their most recent deal became visible only during the post-closing integration phase, after the transaction had already closed.

Either of these two forces, taken alone, is a manageable problem. Security teams know how to handle elevated motivation in individual employees, and they know how to handle a temporary loss of baseline during a system migration. What makes M&A different is that both happen at once, to the same population, inside the same window of time. That overlap produces a condition where the employees most motivated to walk out with valuable data are also the employees least likely to be caught doing it, because the systems built to catch them have temporarily lost the ability to tell a legitimate data migration apart from a theft.

This is not a fringe concern raised by security vendors trying to sell a product. The NACD-ISA Director's Handbook on Cyber-Risk Oversight, a 2026 reference used by corporate boards to guide cyber-risk governance, addresses M&A risk directly and states that M&A transactions are favorite targets for hackers and that mergers and acquisitions only increase cybersecurity risk. Board-level guidance treating this as a predictable, structural feature of the deal process, rather than an occasional bad outcome, is the premise the rest of this argument builds on. Everything that follows, the motivation behind individual insiders, the specific ways detection tools fail, the liability that follows a company past the close, and the operational strain on security teams, is a consequence of this one structural fact: the baseline disappears exactly when the incentive to exploit its absence peaks.

Why the departing-employee window is especially dangerous when entire cohorts face it simultaneously

Insider threat research has long shown that the period just before an employee resigns is the single highest-risk moment for intellectual property theft. The majority of IP theft happens in the window before a resignation is announced, and the Fortinet 2025 Insider Risk Report found that 55% of security professionals name departing employees as a leading concern. In a normal operating environment, this risk is spread out over time. Different employees reach that pre-departure window on different schedules, which gives a security team a manageable, staggered surface to watch. An M&A transaction erases that staggering. Every employee at the acquired company faces the same uncertainty about their future on the same timeline, which turns a slow drip of individual risk into one simultaneous, cohort-wide episode.

The cases below predate the M&A context but describe exactly the psychology that a merger activates across an entire workforce at once. GE engineer Jean Patrice Delia downloaded thousands of sensitive files, including turbine calibration tools, mathematical models, cost models, and pricing data, to external storage while negotiating his own departure to join a competitor, and emailed calculations to a co-conspirator in the process. Tesla engineer Guangzhi Cao copied a large volume of Autopilot source code to his personal iCloud account before leaving for a competing EV company, prompting a lawsuit from Tesla under the Defend Trade Secrets Act. A former Yahoo research scientist, Qian Sang, allegedly stole a large volume of files including the source code for Yahoo's AdLearn ad-tech platform, the backbone of its real-time ad-buying system, intending to use it at a competing firm. Before Anthony Levandowski left to found a startup that Uber later acquired, he downloaded thousands of confidential files tied to Google's self-driving car program, and the case ended in a settlement that included a substantial equity payment. Each of these involved one person acting near one departure. An M&A transaction applies that same behavioral driver to an entire workforce at the same moment, with the added weight of not knowing whether a job will exist at all once the deal closes.

Three forces active in 2026 make that cohort-wide window harder to contain than it would have been even a few years earlier. AnySecura's insider threat trends analysis found that generative AI tools now let employees with little to no technical background build custom data-exfiltration scripts or automate credential harvesting. The skill barrier that once limited who could carry out a sophisticated theft has largely fallen away. A large share of files employees upload to GenAI tools contain sensitive material, including source code, M&A documents, customer records, and internal financial data, and that traffic moves through a channel most organizations don't yet monitor closely. The combination means that the same motivated cohort facing the same job uncertainty now has easier tools and a wider set of unmonitored paths out the door than any departing-employee cohort before it.

How behavioral detection fails in the exact environment M&A creates

Legacy data loss prevention tools fail during M&A transactions for a structural reason rather than a configuration mistake: the environment eliminates the very conditions those tools need in order to function. Rule-based DLP is built around recognizable patterns, known file types, known destinations, and known thresholds for what counts as an unusual volume of data movement. During an M&A transition, massive data transfers, new cloud connections, new access grants, and new external sharing arrangements are all part of the expected, sanctioned activity of integration. A genuinely malicious transfer, carried out in the middle of that noise, looks almost identical to a legitimate one, and the rules built to catch it simply can't tell the two apart.

The same gap runs through behavioral analytics platforms, UEBA tools, and other detection systems, all of which depend on a stable reference point for what "normal" looks like for a given user or system. When two separate organizational networks merge, that reference point goes with it. A user downloading many times their usual volume of files might be migrating data at a manager's instruction, or might be taking intellectual property before their role is eliminated in the restructuring, and without a working behavioral baseline, no automated system has a way to distinguish the two.

Two incidents from ReliaQuest's 2024 post-acquisition investigations show how this plays out in practice. At one industrial-sector client, an employee had set up an email forwarding rule sending messages to an external domain, which investigators initially treated as a red flag; it turned out the rule was simply forwarding mail to the employee's old account at the company that had just been acquired, a violation of IT policy but not a malicious act. At a healthcare client, unauthorized access and data exfiltration occurred from a server that originated with the recently acquired company, a server that was missing the standard SentinelOne security agents used elsewhere in the network. The malicious activity went unnoticed at first simply because the acquired environment had no logging in place to catch it. Neither incident was invisible because anyone ignored a warning. Both were invisible because the infrastructure needed to generate the warning wasn't there yet.

The range of channels available for moving data out makes the gap worse. Personal cloud storage, removable media, generative AI tools, personal email forwarding, and unsanctioned SaaS applications all offer paths that keyword matching and file-type rules were never built to track. The Intel case shows what happens when that gap goes unaddressed: a recently laid-off software engineer allegedly exfiltrated a large volume of confidential files, some marked "Intel Top Secret," before disappearing, prompting Intel to file a lawsuit alleging theft of those materials. The failure in each of these cases traces back to the same root cause described earlier: the baseline that static tools depend on had already collapsed by the time anything went wrong.

Behavioral, AI-Driven Detection in a Baseline-Disrupted Environment

So addressing the M&A detection gap starts from a different question than the one legacy DLP asks. A rule-based system asks one thing: does this file match a known pattern? A behavioral, AI-driven platform asks whether this person, moving this data, to this destination, in this surrounding pattern of activity, makes sense given their role and the organization's current context. That second question can still produce a meaningful answer even when the organizational context itself is in flux, because it does not depend on a single fixed historical baseline the way legacy tools do. Instead, it reasons across content, identity, role, destination, and behavioral pattern at the same time, which lets it make a judgment call even in a merged, unsettled network where "normal" has temporarily stopped meaning anything.

Several specific capabilities matter in this environment in ways generic security tooling does not address. Content understanding that does not depend on labels or formal classification matters because the most valuable material moving through an M&A transaction, deal terms, integration plans, the target company's source code, unreleased product roadmaps, often carries no label. A platform built to understand what the data actually means to the business, rather than only checking it against a regex pattern, can protect that material regardless of whether anyone tagged it correctly. Cross-system behavioral sequencing matters because a single download rarely tells the whole story on its own; the risk sits in the sequence, an unusual system accessed, a large download, files compressed, an upload to a personal cloud account. A platform that can identify and score that chain gives an analyst a prioritized picture instead of a pile of disconnected alerts. Shadow AI detection with contextual controls matters because a meaningful share of the files employees upload to GenAI tools contain sensitive corporate data, and pre-close detection has to extend to that unsanctioned AI usage with controls based on the data, the destination, and who owns the account, giving security teams a precise alternative to a blunt policy that blocks AI tools. Investigation pre-assembly matters because a platform that delivers an alert with the surrounding behavioral context already built out, not just the bare event, cuts the time between spotting something and deciding what to do about it, time that matters enormously when a security team is already stretched thin by deal-related work.

The Rippling and Deel case illustrates a related but distinct failure mode. In March 2025, Rippling discovered that a competitor had allegedly planted an insider who spent four months accessing Slack, Salesforce, Google Drive, Gong, and other internal systems to steal customer data and pricing information. The access itself looked consistent with the employee's normal role, so static rules would never have caught it. Surfacing that kind of theft requires correlating behavior across systems over time, the same capability M&A environments need when a merged network has no clean baseline to compare against. A platform built around content understanding, behavioral sequencing, and pre-assembled investigation context, rather than one built around static rules, is structurally better suited to a condition where the baseline itself has been disrupted by the transaction.

Undiscovered Insider Incidents as Deal Liabilities

If an insider exfiltration event happens during the pre-close window and goes undetected, it does not vanish when the deal closes. Instead, the acquiring company now owns it as a liability, alongside every other cybersecurity weakness sitting inside the target's environment. Infosys's cybersecurity due diligence research found that a majority of respondents discovered a major undiscovered or undisclosed cybersecurity risk only during post-closing integration, so the breach had already happened and was already sitting inside the deal before either side knew to look for it.

The risk to the deal itself is not hypothetical. The same Infosys research cites a Forescout survey finding that a large majority of dealmakers treat an undisclosed breach as an immediate dealbreaker. A pre-close insider incident, if uncovered during due diligence by the counterparty or by a third party conducting the review, can end the transaction outright, regardless of how far along the negotiation had progressed. Regulatory exposure adds another layer on top of that financial risk. The NACD-ISA handbook notes that an acquiring company inherits the target's compliance posture along with everything else: exposure under regimes like GDPR, which carries potential penalties of four percent of global annual revenue, and sector-specific regimes like HIPAA and CMMC.

The timeline makes all of this harder to manage. The Infosys whitepaper cites IBM's 2024 Cost of a Data Breach Report, which found that the average time to identify and contain a breach runs into many months. In a deal with a six-month close timeline, an insider incident that happens on day one may not be detected until well after the transaction has already completed, by which point the acquirer has already taken on the legal and financial consequences without ever having had the chance to price them into the deal. Compass MSP's 2026 M&A cybersecurity analysis frames the financial stakes directly: it cites Deloitte's warning that overlooking cybersecurity during M&A can cost organizations significant damages running into the millions, and that figure does not even include the regulatory liability or remediation costs inherited after the close. Pre-close detection, understood this way, is a direct input into what the deal is actually worth.

Why the SOC cannot absorb additional M&A alert volume without structural help

Even when leadership accepts every argument made so far, the practical constraint remains: the existing security operations team has a fixed capacity, and an M&A transaction does not politely wait for that capacity to expand. Integrating two networks generates new alerts from new systems, new identities, new access patterns, and new third-party connections, all layered on top of whatever volume the team already handles on a normal day. If a security operations center is sized for one organization's steady-state alert volume, it has no slack capacity sitting in reserve for a sudden merger.

Static rule-based tools make this worse rather than better, because they generate high volumes of false positives in exactly the kind of environment M&A creates, where legitimate data movement is constant and indistinguishable from the rare malicious transfer. So analysts end up reviewing far more alerts without a corresponding increase in the number that matter, and that burns through the team's limited hours on noise instead of signal. If a platform pre-assembles investigation context around each alert, instead of handing analysts a raw event to research from scratch, it directly addresses this capacity constraint by cutting the time each alert takes to resolve. It is what makes it possible for a security team sized for ordinary operations to survive a period when alert volume spikes and the stakes behind each alert are higher than usual. Investing in AI-augmented detection ahead of an M&A transaction is, in this light, as much a decision about workforce capacity as it is a decision about security coverage, because the team reviewing the alerts is the same team that has to keep the rest of the business running at the same time.