Read summarized version with
About project
Working time:
Since 2025
Industry:
Software holding company
The service:
Cloud Operations
Overview
The customer is a Canadian software holding company that acquires and operates vertical market software businesses. Several acquisitions a year arrive with their own AWS accounts, built by small teams over many years.
The Challenge
Technical due diligence had looked at the product and the code, but not deeply at the cloud estate. After closing, the group needed to know what it had bought.
1. Unknown Access
Root credentials and administrator keys sat with founders and former contractors.
2. Unreviewed Exposure
Public storage, open security groups and unencrypted databases had never been reviewed.
3. Untested Recovery
Backups existed, but nobody had restored one.
4. Cost Blind Spots
Spend was unknown by product or environment, and accounts sat outside any organization.
Technology & Approach
We run the same three-week review for every acquisition, so the group compares companies on one baseline and starts integration with a plan instead of surprises.
Implementation
Week 1: Access and Exposure
Reviewed root and administrator access, identity providers, long-lived keys, public resources and network exposure with IAM Access Analyzer, AWS Security Hub and Amazon GuardDuty, and fixed urgent issues the same week with the acquired team.
Week 2: Well-Architected Review and Data
Reviewed the main workloads against the AWS Well-Architected Framework in the AWS Well-Architected Tool, located sensitive data with Amazon Macie, and checked encryption, logging and backups with a test restore.
Week 3: Cost and Integration Plan
Analyzed spend with AWS Cost Explorer, flagged idle resources and commitments, and delivered a prioritized integration plan with effort, risk and an owner for each action.
Customization & Client Adaptation
The review is built for deal timelines and for teams that are still adjusting to new ownership.
Read-Only by Default
The review runs through a read-only IAM role the acquired company creates and removes at the end, with every call logged in AWS CloudTrail.
The Group Baseline as Yardstick
Findings are scored against the group’s own security and operations baseline, not a generic checklist.
Fix First, Report Second
Critical access issues are fixed in the first week, before the written report.
Ready for the Operating Review
The integration plan is shaped for the first operating review with the acquired company’s leadership.
If you find this case interesting, we recommend taking a closer look at
The Results
Each acquisition now gets a baseline within three weeks of closing. In the first review, critical access findings were closed in week one and quick savings were identified before integration began.
Long-Term Value
- One baseline to compare companies across the portfolio.
- Well-Architected findings recorded for follow-up reviews.
- A repeatable intake that shortens each integration.
Business Impact
- Former founders’ and contractors’ access removed early.
- Restores tested before they are needed.
- Cost drivers known before the first budget cycle.
