Inherited Intruder Lab: Day 20 After Close
Twenty days after closing, your EDR finds an attacker inside the company you just bought, and the evidence says they arrived before the deal closed. Make scored decisions on who leads, preserving the evidence the indemnity claim depends on, the integration freeze, notification as the new owner and the seller's pushback.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
The deal closed twenty days ago. Your EDR rollout across Tailspin Logistics has just lit up: someone is in the network, and the evidence says they arrived before closing. You are Fabrikam Holdings's incident lead. Decide who leads, how to preserve the evidence the indemnity claim depends on, whether to freeze integration, how to handle notification now that Tailspin Logistics is yours, and how to answer a seller who says it happened on your watch.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
What this template gives you
- This is the post-close angle. The Sign-to-Close Breach scenario covers a target breached before closing; this lab covers the breach you find after you own it.
- Eight to ten decisions, each scored 0 to 10 with feedback that explains the evidence, the clock and the cost.
- Choices branch: rebuild the first host and the attacker comes back; connect the domains early and the attacker crosses into the acquirer.
- Replace the sample names with your own and export the debrief for counsel and the integration office.
Frequently asked questions
Who notifies when a breach at an acquired company pre-dates the acquisition?
Usually the legal entity that controls the data, which is the acquired company, now owned by you. The notification clock generally runs from when the organisation became aware, not from when the data was taken. Who pays is a separate question for the purchase agreement. Confirm the position with counsel.
How do you prove a breach happened before closing?
With several independent artefacts that agree: pre-close backup snapshots containing the implant (matched by hash), edge-device images, file-system and scheduled-task timestamps, and seller-provided logs obtained under the agreement. Keep chain of custody and get an independent forensic statement. A single timestamp is easy to dispute; corroboration is not.
Should integration stop when an acquired company is breached?
Identity and network integration should stop while an attacker is present: a domain trust or privileged migration tooling gives them a path into the acquirer. Non-technical workstreams can continue. Publish written gates for restarting so the freeze has an end.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.