Here's a number that should bother you: 85% of M&A deals fail to deliver the value they promised — and cybersecurity integration keeps showing up as a leading reason why.
So I sat down with the executive who took Juniper Networks' security through HPE's $14B acquisition and asked the blunt question: what actually breaks first?
His answer flipped how I think about the whole thing. In a merger, your job isn't to slow the deal down to make it safe. It's to keep the business moving fast without driving off a cliff — changing the tires while the car is still doing 80.
In The Chair
Drew Simonis — 25+ years in security, zero-trust at global enterprise scale, a survivor of multi-year SEC and UK regulatory investigations, and (full disclosure) my former boss. He's the rare security leader who runs on empathy instead of authority — which makes him exactly the wrong guy for a generic playbook, and exactly the right one to tell you what really happens.
THE BRIEF — 3 Things Worth Your Time
1. Stop driving compliance. Manage risk. Compliance and a live deal are natural enemies — integration always forces trade-offs. Drew's move is to be the person in the room who can say "it's not perfect, it's good enough, and we can ship it." The business wants to move and feel safe doing it. What it doesn't want is to get blocked over a one-in-a-million risk you've quietly convinced yourself is inevitable. So what: Walk into your next integration call ready to define "good enough" — not just "fully compliant."
2. Attackers know it's chaos. They're counting on it. Day one of integration, everyone's fielding weird requests from people they've never met about systems they've never used — benefits enrollment, a new SSO, some "urgent" contract review. It all looks abnormal because it is. And everyone's moving too fast to stop and ask. That's the exact gap phishing walks through. So what: Before close, warn your people that "weird, urgent, deal-related" asks will spike — and that speed is precisely the moment to slow down on a click.
3. When stacks collide, ego loses. Maturity and cost win. The reflex is "do it our way." Drew's lens is simpler and less precious: whose process is actually more mature, and will it scale to the combined company? Who's got the better license deal? Don't roll into the acquired team with a blowtorch and torch everything they built — some of it is better than yours. So what: Score overlapping tools on maturity + cost, and let the acquired team keep what they do well.
Also in this episode
- What "speak in business terms" actually means (hint: it's not translating everything into dollars) — and the upside-down habit that quietly wrecks technical leaders' credibility
- Can the SOC absorb autonomous AI agents? And why a scary number of "skills files" are no safer than random code off the internet
- Personal liability: why Drew loses less sleep over it than the rest of the profession
- How to build crisis playbooks before the crisis — because you can't make friends under fire
One line worth stealing
"You can't hold someone accountable unless you help them become able." — Drew Simonis
Watch the full conversation
The three above are the appetizer. The full episode gets into M&A security strategy, AI in the SOC, surviving regulatory crises, and why empathy beats authority every time.
▶ Watch on YouTube: https://www.youtube.com/watch?v=v3rfb_uTbz8
Join the conversation
M&A is where cyber assumptions break fastest — and Drew's rapid-fire answer was exactly that: don't make assumptions. So I'll ask you the same thing I asked him. Which assumption burned you first in a merger or integration?
💬 Add your take here
Before you go
If this is your kind of thing, you have the super-power to write to ‘[email protected]’ with a security, privacy, or technology leader (or enthusiast) you would want to see in the chair (including yourself). I read every one.
— Ashish | CISO Chair™