Aug 27, 2025 Security

If the sofa wobbles, assume the firewall does too

All posts

In more than twenty-five years of post-acquisition integration and technology due diligence, I have learned that small details often reveal more than spreadsheets. A broken sofa in reception, laptops too old to run basic endpoint protection, firewalls and licences stretched far beyond their intended use — individually these may seem trivial, but collectively they reveal a pattern: cost starvation disguised as cost discipline.

When companies prepare for sale, management faces pressure to present tidy numbers; costs are trimmed, spending is deferred, and anything resembling "waste" is avoided. I once had a CEO tell me, straight-faced, that there was no point replacing the sofa in reception before an acquisition because it would just look like wasted money and the new owners could pick up the tab. This same logic applies to laptops, licences, firewalls, and even the basics of IT hygiene — why spend precious capex today if someone else will carry the cost tomorrow? On paper it makes sense; in reality it starves the organisation of resilience and leaves hidden risks just beneath the surface.

There is an important distinction between cost discipline, which trims fat while protecting the muscle that drives long-term value, and cost starvation, which dresses up short-term performance while quietly undermining resilience. You can usually tell which one is at play without looking at the P&L; the signs are everywhere once you walk the floor. AV equipment in conference rooms that never works, a patchwork of licences and "temporary" fixes that became permanent, teams working with outdated tools and no sign of renewal. These details seem small, but they tell a bigger story about priorities, leadership culture, and the risks a buyer will inherit.

Employees pick up on these signals too. When company performance looks strong but the office environment is quietly starved of investment, staff often assume something is happening behind the scenes — a sale, a change of ownership, or a shift in direction that has not yet been shared. The environment speaks even when management does not, and once employees begin to sense it, productivity, trust, and morale often decline long before a deal is announced.

None of this shows up in diligence binders, and you cannot model it in Excel, yet these are often the clearest indicators of hidden risk. I recommend a floor walk during diligence — sit at a desk, use a workstation, talk to frontline staff, because the atmosphere and tools on the ground tell you more than the board pack ever will — followed by a 90-day reset after acquisition to replace neglected kit, secure the basics, and set a standard. Transformation cannot be built on broken furniture and outdated firewalls, and without these steps hidden IT debt quickly becomes a drag on integration, stretching already rigid budgets and distracting teams from the growth agenda.

Technical due diligence that goes beyond financials and operational metrics — examining the actual state of IT infrastructure, software, security posture, and the alignment of technology with business objectives — is where these issues surface. It is easy to laugh at the sofa story, but the deeper point is serious: if the sofa wobbles, assume the firewall does too. The smallest details often tell you the most about what is being hidden, deferred, or underfunded.

Read next Bombshells After Close: When Critical Security Gaps Emerge Weeks Later