The first 100 days of integrating acquired pentest businesses

Investors and acquiring groups need to understand how acquired penetration testing and offensive security businesses will keep delivering while their operations change. A shared service catalogue or reporting platform depends on decisions about coverage, people and authority.

Treat the first 100 days as a planning horizon. The sequence below follows dependencies. A practice with clear records and internal management can move differently from one that still relies on its founder for routine decisions. Some changes will need longer to assess.

The integration decisions and sequence in this article are Conversec practitioner guidance.

Confirm delivery and decision ownership

Start with booked engagements, reports awaiting review and outstanding client commitments. Identify who can resolve scope changes, approve reports and agree commercial commitments. Name internal cover for urgent issues while leaders are occupied with integration.

Keep a short decision record showing the owner, evidence needed and dependencies for each change. A client handover should depend on an agreed relationship owner and delivery contact. A change to report approval needs a qualified reviewer with time available.

Compare scope and pricing assumptions

Read proposals, scoping records and completed reports from each practice together. Similar service names may include different coverage, access assumptions, testing effort, reporting or retesting. Establish those differences before setting group pricing or comparing margins.

The CREST Defensible Penetration Test guidance, published in June 2023, describes expectations for objectives, scoping, competent practitioners and reporting. Use those expectations when comparing the coverage and delivery practices behind each service.

Record which assumptions need a commercial decision and which need technical review. Cross-selling depends on sales teams knowing what can be promised and delivery teams receiving the necessary prerequisites. The scoping and handover guide explains the consequences when those inputs are missing.

Reserve reviewer and management capacity

Compare the booked workload with the people qualified to supervise and review it. Include existing report queues, planned coaching and the time integration itself requires. A combined headcount does not establish that the right reviewers are available for each type of work.

Agree review expectations using actual findings before combining QA routes. Investigate whether repeated corrections reflect missing evidence, conflicting standards or insufficient review time. Each cause requires a different response. Use the pentest team performance guidance to define a small set of measures and record the starting position.

Transfer founder and client responsibilities

Map the decisions and relationships that still depend on founders or individual senior consultants. Separate work requiring their specialist experience from routine scoping, approvals and client updates that another person could handle with support.

Assign a receiving owner, provide supervised practice and retain an escalation route. Confirm that the new owner can handle relevant work before reducing access to the previous owner. For client relationships, agree who leads the account, who handles technical questions and how the handover will be explained.

The senior-consultant bottleneck article works through transferring a recurring responsibility without losing the support needed for difficult cases.

Decide what to standardise and what to retain

For each proposed common process or tool, identify the delivery problem it should resolve and the evidence needed to judge it. Shared scheduling, account management or reporting may help, while specialist methods still need experienced technical control.

Check capacity, ownership and client commitments before changing the process. Preserve differences that serve specialist coverage or agreed client needs. Revisit them when the evidence changes. A common platform can wait where its requirements remain unclear.

Review the remaining dependencies

At agreed review points, check whether booked commitments are being met, report quality is holding and responsibilities work in practice. Record decisions still blocked by missing evidence, limited capacity or reliance on particular people. Extend the plan where those dependencies remain.

Conversec’s acquisition and integration service supports operational assessment and defined integration work with practice and group leaders. The investor-backed integration case study describes advisory contributions to an operating model, documented risks and proposed actions. It provides no measured post-implementation results or universal timetable.