Endpoint compromise assessment before closing an acquisition: why the timing matters
The assessment has to finish before the networks are joined, because once they are connected, a compromise on the target's endpoints can reach your estate. The buyer has a signed deal, a target estate it has not yet been able to verify, and pressure from the business to connect identity, email and file systems quickly. The question for the deal team is narrow: is there evidence of attacker presence on the target's endpoints today? That is a different question from whether the target's EDR program is mature, and it needs an answer on a short timeline. A full EDR rollout, with baselining, tuning and 24x7 triage, answers a longer question and would not finish before a planned interconnection date.
The short answer is to use Velociraptor for hunting and collection, with osquery-based or offline collectors for hosts that cannot accept an agent, all run on infrastructure the buyer controls. Velociraptor's hunts can search for persistence mechanisms, suspicious scheduled tasks, services, and credential theft indicators across the target's estate, and its artifacts can be reviewed and adjusted in the GUI without rebuilding clients. Offline collectors, which the documentation describes as having all the capabilities of a normal client, cover hosts that cannot take an agent. Confirm with the target's IT team which operating systems and network segments are reachable before the plan is set.
The output of this work is evidence for the deal team, not an audit opinion or an attestation. It records what was searched, what was found, what was not reachable, and what remains open, and it should say so plainly. Any finding that suggests active intrusion should trigger the seller's incident process and counsel, and it may change the deal timeline. Agree with counsel before work starts how results will be stored, who can read them, and whether cross-border access by the buyer's staff creates a transfer question for EU personal data.
What the assessment must satisfy and what it means for the build
This table maps each obligation that touches an acquisition compromise assessment to the build decision it affects. Read each row as a question the deal team, counsel and assessors will ask, and check the build against the evidence column before the scan starts. The main takeaway is that the scan itself creates regulated data, so its collection scope and storage location need agreement before deployment.
| Obligation | What it requires | What it means for the build |
|---|---|---|
| SEC ICFR exclusion limits and IT general control scope | Management may exclude a newly acquired business from its internal control assessment for a limited period, and the exclusion and its significance must be disclosed. IT general controls are evaluated only where they support financial reporting controls. | Scope the scan to systems that feed financial reporting, and record which hosts were examined so the exclusion period and disclosure are backed by evidence of what was reviewed. |
| Form 8-K Item 1.05 timing for incidents found in diligence | A registrant must file for a material cybersecurity incident, generally within four business days after determining materiality. | Agree in advance who makes the materiality call, how hunt findings are escalated to counsel, and which collector outputs and timestamps will support that determination. |
| NIS2 notification of changes | Covered entities must give their competent authority their name, contact details, IP ranges, sector and service Member States, and notify changes without delay and within two weeks at most. | Update registration details when the acquired estate, IP ranges or service footprint changes at closing, and assign an owner for that notice in the integration plan. |
| DORA Article 28 register and exit planning | Financial entities must keep a register of ICT arrangements and tested exit strategies for services supporting critical or important functions. | Record any tool, hosting provider or partner that touches the acquired estate in the register, and confirm the collection platform can be exited or migrated without losing evidence. |
| HIPAA 45 CFR 164.312 audit controls and 164.314 business associate terms | Systems holding ePHI need audit controls that record and examine activity, and business associates must comply with the Security Rule and report incidents under contract. | Where the target holds ePHI, confirm the scan does not alter audit logs, and ensure any third party handling collected data is covered by a business associate contract with incident reporting terms. |
| FTC Safeguards 314.4 MFA and logging | Covered financial institutions must require multi-factor authentication for information system access, encrypt customer information, and monitor and log authorized user activity. | Check whether the target's admin paths used by the collector enforce MFA, and confirm that collection and admin actions on the Velociraptor server are logged and retained. |
| Data the scan collects and where it is stored | Hunts for persistence and credential theft can gather process lists, autoruns, scheduled tasks, event logs and file hashes, which may contain personal data. | Define the artifact list before deployment, keep the server in an enclave or region the deal team approves, and set retention and deletion dates for collected data. |
| GDPR Chapter V when non-EEA staff access EU systems | Remote access to EU personal data from a third country, including for support or administration, is a transfer and needs a transfer tool under Chapter V. | If the acquirer's analysts outside the EEA will run hunts or read collections on EU target hosts, put a transfer mechanism in place first or restrict access to EEA-based reviewers. |
Which systems, data and access paths the assessment touches
The first decision is scope: an acquired company's estate usually includes directory servers, domain controllers, workstations, file servers, cloud virtual machines and devices that nobody has fully inventoried. Start from the target's own asset records, then reconcile them against directory queries, cloud account listings and network discovery, because the gaps between those sources are where unmanaged hosts and forgotten servers tend to sit. Agree in writing which segments, domains and cloud accounts are in scope, and which hosts can only be reached through offline collectors. Systems the target cannot touch during the sale process, such as operational technology or third-party hosted services, should be recorded as out of scope with the reason, so the report does not imply coverage that never happened.
Endpoint collections are not harmless metadata. Process listings, command lines, scheduled tasks, browser artifacts, event logs and file hashes can contain personal data, usernames, internal hostnames, traces of credentials and extracts of regulated records such as patient or cardholder data. Before deployment, decide where collected results are stored, in which region, how long they are kept, who can open them and how they are deleted at the end of the deal. If the acquirer is subject to GDPR, a non-EEA deal team member who views results may trigger a transfer question, so confirm that with counsel first.
Who holds the Velociraptor server matters as much as the data. The server should sit in an environment controlled by the party that will be accountable for the findings, usually an independent incident response team or the acquirer's security function working under an agreed engagement letter, not an administrator account shared between the deal team and target IT. Target IT often controls the directory and the endpoints, which creates a conflict if they also control the evidence. Give each party named accounts with role-based permissions, enable audit logging of who ran which hunt, and agree on who can export results. Confirm this model with the deal lawyers before the first client is deployed.
Which open-source platforms fit a pre-close compromise check
A pre-close check is a one-time hunt across hosts you do not yet control, followed by monitoring that continues after the deal closes. The platforms below split that work: Velociraptor for the hunt, osquery for targeted host queries, and Wazuh for the ongoing monitoring that starts once networks are connected.
Velociraptor for the one-time hunt
Velociraptor is the most direct fit for a pre-close sweep because one server can hunt for persistence and credential theft across an estate, and offline collectors can cover hosts where a client cannot be installed. It is a single statically compiled Go executable, so the target's IT team has less to approve. Check the version before deployment: the documentation asks users to update to release 0.77.3 to address multiple CVEs. Confirm how the target's network allows the server to reach clients.
Offline collectors for unreachable hosts
Offline collectors are built from the Velociraptor GUI for hosts where the client cannot be installed. They have the same capabilities as a normal client, can run any artifact, and write results to JSONL or CSV that can be carried out and reviewed by the deal team's examiners. This matters for acquired plants, legacy servers and laptops that the target cannot safely touch before close. Agree in writing who may collect, where the output is stored and how chain of custody is recorded.
osquery for targeted host queries
osquery exposes an operating system as a relational database, so SQL can list running processes, loaded kernel modules, open network connections and file hashes on Linux, macOS and Windows. Run ad hoc through the osqueryi shell during an investigation, or on a schedule with osqueryd. It has no central server of its own, so results must be collected and stored through another platform. Confirm whether the target already runs osquery and what its configuration covers.
Wazuh for monitoring after close
Wazuh's core is licensed under GPL-2.0 and suits the period after close, when networks are joined and detections must run continuously. Its osquery module lets Wazuh agents manage osquery configuration and send results to the manager to generate alerts. This fits buyers who want the target's hosts monitored by their own SIEM once connected. Confirm which hosts already have Wazuh agents, since a one-time hunt rarely replaces an agent that is already reporting.
AGPL terms for modified tools
Velociraptor is licensed under AGPL-3.0, which extends source obligations to users who run a modified version over a network. If the buyer changes artifacts or the server and offers that service to others, including a joint team or a vendor, the license terms may apply. Using unmodified binaries internally usually carries less obligation. Have counsel confirm the position before the team customizes the tool or hosts it for third parties.
Security Onion when already deployed
Security Onion bundles Suricata, Zeek, osquery and the Elastic stack, and uses Elastic Agent with osquery live queries under Elastic Fleet. It is worth using only when the buyer already runs it and can extend its visibility to the target's network before close. Its Elastic License 2.0 terms differ from the other tools here, so confirm them before redistribution. Adding a new platform for a single deal rarely pays off.
Rollout phases for a pre-close endpoint assessment
The sequence moves from agreed data terms to a briefing the deal team can act on, with each phase producing a named output that the next phase depends on. Nothing connects to the target network until the assessment has defined what it will collect and how that data will be handled.
Agree scope and data handling terms
Counsel, the seller's IT lead and the assessment team agree in writing which entities, sites, operating systems and host roles are in scope, which artifacts may run, and where collected data will be stored and who may access it. Where EU personal data or cross-border access is involved, confirm the transfer basis before any collector runs. The step closes when a signed scope document and data handling terms exist, and the reader should confirm with counsel which regulatory regimes apply to the target.
Build an isolated Velociraptor server
The assessment team deploys a Velociraptor server in a segregated environment that has no trust relationship with either company's production directories or networks. Access is restricted to named assessment staff, logging is enabled, and the server build is documented so that its configuration can be shown to the deal team and to any later reviewer. The step closes when the server answers test enrollments from a lab client and the access list matches the agreed scope.
Pilot on a sample of hosts
The team deploys clients to a small, agreed sample of target endpoints covering each major operating system and host role, such as domain controllers, finance workstations and a build server. A pilot offline collector is built from the GUI and run on one hard-to-reach host to confirm that results can be written, transferred and parsed. The step closes when pilot results are reviewed with the seller's IT lead and the collection method is accepted for the full estate.
Run persistence and credential theft hunts
Using artifacts reviewed during the pilot, the team hunts across the estate for persistence mechanisms such as scheduled tasks, services, run keys and startup entries, and for credential theft indicators such as access to LSASS, unusual authentication activity and stored browser or vault data. Each hunt is logged with its artifact version, parameters and target scope so that it can be rerun. The step closes when every hunt has completed, each host has a recorded status, and all flagged items are triaged by an analyst.
Package evidence with hashes and custody notes
Collected results are exported in their original format, and each file is hashed at collection and again at packaging. A chain of custody record names every person who handled the data, when it moved and where it is stored. Analyst notes separate confirmed findings, open questions and false positives. The step closes when an evidence package can be re-verified by an independent party, which the team checks by recomputing a sample of hashes.
Brief the deal team on findings
The assessment lead presents results to the deal team and counsel in a written report that states the scope tested, the coverage achieved, the hosts not reached and the findings with their confidence level. Recommended actions before network integration are listed separately from longer-term remediation. The step closes when the deal team confirms which findings affect price, conditions or integration sequencing, and the assessment's limits are recorded in the file.
Which hunts answer which deal question
Persistence answers whether the target's machines will run something after the deal team has signed off. Velociraptor's scheduled task, service and registry artifacts enumerate the places an intruder usually hides a re-entry point, and its WMI artifacts cover event subscriptions. The osquery equivalents are the scheduled_tasks, services, startup_items, registry and WMI event tables, which return the same locations in SQL on supported platforms. A positive result is a launch point that no change record explains. It does not prove the item is malicious, and a clean sweep does not prove the host is clean, because persistence can sit in locations the collection did not cover.
- Scheduled tasks: Tasks that run as SYSTEM or a privileged account, point to a binary in a user-writable path, or were created outside any change window.
- Services: Services whose image path sits outside the normal program directories or whose install date matches no software inventory entry.
- Run keys and startup folders: Autorun entries under the Run and RunOnce keys and per-user startup folders, compared against a baseline from a reference image.
- WMI event subscriptions: Permanent event filters bound to command-line or script consumers, which ordinary business software rarely uses and which deserve manual review.
Check whether each finding maps to a documented software deployment, and ask the seller for its software inventory and change records before treating any result as a compromise.
Credential theft asks whether an attacker already holds valid accounts, which matters more to a buyer than any single malware file. Velociraptor's process, file and event artifacts can show which processes touched the local security authority process, locate credential files and copies of directory databases, and surface unusual logons. osquery covers the process and file side through its process and file tables, but visibility into process handles and event data depends on platform and version, so confirm coverage on each operating system before relying on it. A positive result indicates that a credential may have been exposed. It does not prove which credential was taken or whether it was used.
- Access to the local security authority process: Processes other than known security tools opening that process, especially unsigned binaries or tools launched from temporary folders.
- Credential files and dumps: Dump files, archives or copies of the directory database and registry hives stored in user profiles, temporary folders or file shares.
- Unusual logons: Service or administrative accounts logging on to workstations they do not normally use, or interactive logons at unusual hours, drawn from the Windows event logs.
- Kerberoasting indicators: Bursts of service ticket requests for many service accounts from a single host, particularly requests that negotiate older encryption types.
Ask the seller which service accounts have passwords that have never rotated, because that determines how much a single exposed credential is worth to an attacker.
Remote access tools are a common route for intruders and for legitimate support staff alike, so the question is whether each tool is sanctioned, configured and used by the right people. Velociraptor can enumerate installed software, services and network connections across the estate in one hunt, and offline collectors cover hosts where no agent can be installed. osquery's program, service and network tables give the same view in SQL on hosts that run osquery. A positive result is an unapproved tool or an unexplained outbound relay. It does not prove intent, because many IT teams use these tools legitimately and often without central records.
- Installed remote tools: Known remote desktop and remote management products, including versions missing from the seller's approved list, and portable executables that need no installation.
- Persistent remote services: Remote tool services set to start automatically, which suggests unattended access that a user did not initiate.
- Outbound connections: Connections to relay or rendezvous hosts from machines that should not need outside support, reviewed against proxy and firewall logs.
- Tunneling and proxy binaries: Reverse proxy or tunneling tools run from user folders, which are often used to move between internal networks.
Request the list of vendor support accounts and their approval records, and confirm which remote tools the target's managed service provider uses.
Unauthorized accounts test whether the target's local and directory accounts match what it says it has. Velociraptor's local account and group artifacts list accounts and administrative group membership on each host, and a single hunt can compare those results across the whole estate. The osquery users, groups and logged_in_users tables return the same data in SQL on supported platforms. A positive result is an account that no identity or HR record explains. It does not prove a breach, because orphaned service accounts and stale contractor accounts are common in organizations that have never been compromised.
- Local accounts: Enabled local accounts on workstations and servers that do not exist in the central identity provider, including built-in accounts that were renamed or re-enabled.
- Administrative group membership: Members of local and domain administrator groups who do not appear on the target's privileged access list.
- Recent creation: Accounts created or added to privileged groups outside the change window, which the host state can help date.
- Dormant accounts with recent logons: Accounts unused for a long period that show recent logon activity.
Request the identity provider export and the most recent privileged access review from the seller, then reconcile both against the hunt results before presenting findings to the deal team.
Evidence the deal team and regulators are likely to ask for
This table lists the evidence items a deal team, auditor or regulator is likely to request from an endpoint compromise assessment, the component that produces each one and what the reader should confirm before relying on it. DeployOpen prepares this evidence, but independent auditors, certification bodies and counsel decide what it proves. The main takeaway is that unreachable hosts and exceptions matter as much as clean hunt results.
| Evidence item | Produced by | What to confirm before sharing |
|---|---|---|
| Artifact inventory and versions | Velociraptor server configuration and artifact repository exports | Velociraptor version in use, such as the 0.77.3 update referenced in the documentation, and the exact artifact versions run |
| Collection logs | Velociraptor server logs and collection records for each hunt | Start and end timestamps, the operator account for each action and the scope of each collection |
| Offline collector outputs | Offline collector runs writing JSONL or CSV results | Which hosts ran the collector, when, from what media and whether transfer hashes were recorded |
| Osquery query results | Osquery queries run ad hoc or scheduled, where osquery is deployed on the target estate | Query text, host identifiers and whether results were captured in the same time window as the hunt |
| Host coverage list | Velociraptor client inventory compared with the target's asset list | Count of hosts reached, count not reached and the source of the asset list used for comparison |
| Unreachable hosts register | Assessment team, built from failed client connections and offline collector gaps | Reason for each gap, owner on the target side and whether the host was isolated from the network |
| Hunt results with timestamps | Velociraptor hunt output for persistence and credential theft artifacts | Whether findings were triaged, the analyst who reviewed each hit and any false positives recorded |
| Hash records for collected files | Velociraptor collection output and hash fields recorded at acquisition | Hash algorithm used, chain of custody notes and storage location of original collected files |
| Exceptions register | Assessment team, listing each deviation from the agreed scope or method | Approval for each exception, the risk it introduces and whether the deal team accepted it in writing |
Questions to ask an implementation partner before you sign
Start with where the data lives and who can touch it. Velociraptor servers keep their data in files on the server's filesystem, so ask the partner to name the region and account where the server runs, where the collected JSONL or CSV results are stored, and where backups go. If the target holds EU personal data, ask how any non-EEA acquirer staff or partner engineers would get access, since remote access from a third country, including for support, is treated as a transfer under EDPB Guidelines 05/2021. Ask for the written access list and the transfer tool they would rely on, and confirm it with your counsel before any remote session starts.
Next, ask how the partner handles hosts with no network path. Velociraptor offline collectors are built from the GUI, carry the same capabilities as a normal client, and write results to JSONL or CSV, so the partner should explain how they would build, hash and transport collector media, who witnesses the collection and how results are verified on return. Ask how they document hunts and negative results: each artifact version, query parameters, time window, the endpoints covered and the endpoints not reached. A clean hunt is only evidence if the record shows what was checked. Also ask who holds the Velociraptor server administrator credentials, API keys and collector signing material after handover, and whether those are rotated and logged.
Finally, agree the escalation path and the scope in writing before work starts. Ask how a suspected active compromise is raised to your designated decision maker within hours rather than at the end of the report, and who decides whether it may trigger a Form 8-K Item 1.05 assessment or a NIS2 notification to your competent authority. Confirm the fixed scope: the list of endpoints, operating systems, artifacts, deliverables and dates, plus what happens if new hosts are found mid-engagement. Ask for the quote to separate one-time collection and analysis from any recurring retainer, and to state which costs depend on endpoint count, offline collection effort and travel. Do not sign until those terms match what the deal team needs.
How long, costly and hands-on is a pre-close endpoint assessment?
What drives the cost of an endpoint compromise assessment before closing?
The main drivers are the number of endpoints, the mix of host types, the access window the seller allows, and whether offline collection is needed. A few hundred Windows laptops with an agent push permitted is a very different job from a plant network with servers that cannot take a client and no remote access. Each added host type usually adds deployment and validation work, and each restricted window compresses the hunts into less time. Ask for a quote that states the endpoint count by host type, the collection method for each, the artifacts and hunts in scope, and the reporting format for the deal team. Quotes follow a written scope, so the scope document is what makes two offers comparable.
Which parts of the assessment are one-time and which would recur?
A compromise assessment is normally a one-time engagement. The one-time work covers planning, deploying Velociraptor or preparing offline collectors, running the agreed hunts for persistence and credential theft, triaging results, and writing the findings for the deal team. Recurring costs only appear if the buyer decides to keep monitoring after close, for example by moving the deployment into a continuing detection service, keeping a server running, or retaining staff to review alerts. Those ongoing items are separate from the assessment and should be scoped and priced on their own, so the deal team can see what is a closing cost and what is an operating cost.
What does the buyer need to provide for the assessment to run?
The buyer needs four things before work starts: a named executive sponsor who can resolve access questions quickly, technical access to the target estate (administrative credentials or a deployment path, network routes to a collection server, and a list of hosts), a legal review that confirms what data may be collected and where it may be stored, and a point of contact for the target's IT team who knows the exceptions. Legal review matters more when the target holds EU personal data, because remote access by a non-EEA acquirer's staff can count as a transfer under the GDPR. Confirm these items with counsel before the scope is signed, not after collection has begun.
Can our internal security team run a pre-close assessment without a partner?
Often yes, if the team has prior experience with endpoint forensics, can deploy and manage a Velociraptor server, and can write up findings that a non-technical deal team will trust. The harder parts are usually not the tooling but the time pressure, the evidence handling and the independence of the review. Internal staff may also be the people who will own the target's systems after close, which can complicate objectivity. Assess your team against the work list in the written scope: deployment, offline collection, hunt design, triage, and a report with clear confidence statements. If several of those items are new to the team, a partner can run the assessment or work alongside the team.
How hands-on is the work for the target's IT staff?
The target's IT staff are usually needed for a limited but important set of tasks: confirming the host inventory, approving the deployment method, identifying business-critical systems that must not be touched during collection, and explaining known exceptions such as legacy hosts or shared accounts. Their availability during the access window often determines the pace more than the tooling does. Ask the seller to name the people responsible for these tasks and their available hours, and state in the scope which decisions the buyer will make and which the assessment team will make. Clear responsibilities reduce the number of change requests after work starts.
Does the assessment change if the target runs on-premises or in several clouds?
Yes. Each environment has different deployment paths, network reachability and change controls. On-premises estates may need a domain-wide deployment through existing tools, while cloud workloads may need images, instance groups or cloud-native automation. Hosts in isolated segments may need offline collectors, which can run any artifact and write results to JSONL or CSV. Every collection path needs its own approval and testing, so a scope that lists environments, network zones and collection methods separately will be more accurate than a single endpoint count. Ask the assessment provider how it will document evidence from each path so the deal team can compare results.
How do we confirm the scope and price before the work starts?
Ask for a written scope that lists the endpoints and host types, collection methods, hunts and artifacts, access and timing assumptions, buyer responsibilities, deliverables, and the reporting format for the deal team. DeployOpen does not publish a price list. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and a quote follows from that written scope. Include in the request any items you need for your own process, such as the findings format, evidence retention rules and how results will be shared with counsel. Compare offers on the same scope document, not on headline figures.
What changes after the deal closes
The compromise assessment does not end at the deal date. Before the networks are joined, the acquirer should decide which of two paths each acquired host takes: keep the target's endpoints on Velociraptor for investigation only, or enroll them in Wazuh monitoring as a continuing detection layer. Velociraptor remains useful for hunts and targeted collection after closing, but it is not a substitute for continuous alerting. Hosts that will be monitored long term need a Wazuh agent and a documented enrollment record. Hosts that are being retired or reimaged should be collected and released from the assessment scope first, so that nothing is wiped before the evidence is secured.
Evidence retention has to be settled before the assessment closes, not after. Write down, in the deal file, where Velociraptor collections, offline collector output in JSONL or CSV, hash lists and hunt results are stored, who holds access, and how long they are kept under the retention period agreed with legal counsel and the seller. Confirm that the storage location sits inside the acquirer's own environment, and that chain-of-custody notes travel with the files. The retention period is a decision for counsel and the deal team, not a default that the tooling supplies.
Findings should then flow into detection content. Each persistence mechanism, credential-theft indicator or suspicious binary found during the assessment is a candidate Wazuh rule, a Velociraptor hunt artifact to rerun on a schedule, or an input to the acquirer's threat intelligence process. Record which indicators were confirmed, which were dismissed and why, and who approved each decision, so that later analysts can trace the origin of a rule. Rerun the hunts after integration and after the first change window, because the target's estate will continue to change. Ask the implementation partner to state in the written scope which of these handover steps are included and who owns the outputs.
How DeployOpen scopes and runs a pre-close assessment
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For a pre-close endpoint compromise assessment, we agree the scope in writing first, deploy Velociraptor or offline collectors inside the environment the target controls, run the hunts you approve, and hand over the evidence and findings in a form your deal and security teams can use.
How we scope
- Written scope names the acquired entities, host groups, operating systems and sites covered by the assessment before any work starts.
- We agree which hunts run for persistence, credential theft and suspicious remote access, and which artifacts each one uses.
- The scope records data handling rules, including where collected evidence is stored and who on each side can access it.
How we build
- We deploy the Velociraptor server in an environment the client controls, or run it locally when agents cannot be installed.
- Offline collectors are built for hosts where the client cannot be installed, using the artifacts approved in the scope.
- We test collector deployment and hunt queries on a small set of hosts before rolling them out across the estate.
How we hand over
- Deliverables include the hunt results, collection logs, a chain-of-custody record and a written findings report for the deal team.
- We document the deployed components, configurations, artifacts and access accounts so the acquirer can operate or remove them.
- A handover session walks through findings, open questions and the cleanup steps for collectors and temporary infrastructure.
How we support
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- Follow-up work, such as continued monitoring or remediation support, can be covered by a retainer.
- Questions about scope changes, new findings or additional hosts are handled through a written change to the agreed scope.
