M&A Monday: Triaging a Fleet of 300 Inherited Machines

The scenario nobody budgets for

The deal closes on a Friday. On Monday morning you own three hundred Windows machines you've never seen, running software you didn't buy, administered by an IT team that no longer works for you. The acquisition deck called them "synergies." Your security team calls them something else.

This isn't hypothetical. Marriott acquired Starwood in 2016 and, two years later, disclosed that intruders had been living in the Starwood reservation network since 2014 — before the acquisition even closed. Hundreds of millions of guest records: a breach Marriott literally bought and paid for. The diligence gap between "we own these machines" and "we know the security state of these machines" is where deals go to die.

What's actually hiding in an inherited fleet

Every acquired fleet I've seen has the same archaeological layers, top to bottom:

• Straggler operating systems. Server 2012 R2 boxes "scheduled for decommission" three years ago. A Windows 7 machine driving the one piece of lab equipment nobody can re-certify.
• The previous regime's credentials. Local admin accounts with the old company's naming convention, service accounts whose passwords were last rotated during the previous administration.
• Security tooling with lapsed coverage. The old EDR contract covered 250 seats and nobody renewed the expansion. A patching cadence that made sense for a 40-person startup, not for you.
• "Temporary" exceptions that calcified. RDP opened to the internet for one vendor session in 2022. SMBv1 re-enabled for the legacy scanner. Firewall rules with names like "DO NOT DELETE — Dave".
• A compliance posture nobody can attest to. Your auditors will ask whether the new subsidiary meets your baseline. The honest answer on day one is "unknown," which auditors translate as "no."

The first-week playbook

You need a complete security picture fast, before inherited problems become your incidents. Here's the order of operations.

1. Get an agent on every box, immediately

Discovery tools tell you a machine exists; an audit agent tells you its actual state. Deploy to everything — domain-joined or not, on-VPN or remote. The audit itself is the cheap part: the free edition runs the full battery of all 64 audit modules on each machine, no limits, so a per-box picture costs you nothing but deployment time.

2. Roll up posture — don't read machines

This is the step that separates a weekend project from a month-long death march. Three hundred machines each produce a full audit report, which nobody will read one by one. What you need is the fleet-level rollup: every node ranked by posture score, every critical finding deduplicated across the estate. That central view is the reason this class of problem is what Pro's fleet orchestration exists for — agent management at scale, compliance rollups for the merged entity, and drift alerts when a remediated node regresses.

3. Work the kill list, not the long tail

Your week-one kill list, in strict order:

1. Internet-exposed RDP and unprotected admin shares — the ransomware front doors.
2. SMBv1 and other legacy protocols — kill them before the next worm rediscovers them.
3. Stale local administrators and never-rotated service accounts.
4. Disabled or lapsed endpoint protection — every gap is a coverage lie.
5. Critical unpatched CVEs from the last two Patch Tuesdays.

4. Reset the credential inheritance

Every inherited credential is a credential the old org's departed admins still know. Roll out LAPS for local admin passwords, rotate the service accounts, kill the shared "ITAdmin" logins. This is also the moment to bring the new machines under your baselines — but audit first and enforce second, or you'll break the line-of-business app that justified the weird configuration in the first place.

5. Produce an attestation, not a vibe

Compliance doesn't care that you tried. Map the audit findings against your acquiring baseline — CIS or whatever your shop standardizes on — and hand the auditors a posture report for the acquired entity, dated week one. "We inherited X, found Y, remediated Z in the first 30 days" is a defensible story. "We were getting around to it" is not.

The Starwood lesson

Marriott's breach wasn't a failure of security tooling. It was a failure of inheritance hygiene — the acquired infrastructure never got a rigorous, adversarial security review on a deadline. The intruders had persistence in the Starwood network for four years, two of them under Marriott ownership. Nobody audited what they'd bought until the damage was public.

Post-merger triage is due diligence, not paranoia. One week, a full audit on every box, a fleet-level rollup of what you own, a kill list worked in order, and a dated attestation for the auditors. That's the difference between inheriting machines and inheriting someone else's breach.