The deal closed with two of everything — directories, clouds, policies, conventions. From day one, Panaptico observes both estates and verifies them against the declared target: overlaps and conflicts surface as findings with evidence and named scope, milestones pass on proof, and deal-mandated boundaries stay continuously verified.
Acquirer
4,200Halo Commerce
halo.com · est. 2017
Declared target
5,020Halo Commerce (NewCo)
one estate · continuously verified
Acquired
820Prism Labs
prism.com · est. 2020 · acq. 2026-03-15
Duplicate systems
8 · findings
Identity findings
47 · scoped
Policy areas at target
5 of 7
Active gate
D60 · passes on evidence
Dual-spend
$1.9M · closes D90
The gap
01
Two Oktas, two HRIS, two clouds, two chat tenants, two code orgs. From day one, both estates are observed — every duplicate, overlap, and deal-mandated boundary is verified against declared intent, not discovered in week six.
02
Day 1 is a welcome mailbox and a laptop. Day 90 is the deal document. In between, progress arrives as status reports — unless every milestone is verified against live state from both estates, with denominators that don't move.
03
You pay for both Oktas until every user is verified moved, and both chat tools until the old workspace is verified absent — no workload, integration, or team still depending on it. Evidence closes the bill; assumptions renew it.
Duplicate systems
For every function that exists in both estates, Panaptico shows current state per estate against the declared target — what is verified moved, what is off target, and what is Unknown. Divergence lands in a named scope, not in a status meeting.
Identity
Okta · 4,200 users
Okta · 820 users
Target · HaloTarget: one Halo tenant · 5,020 users
763 of 820 verified in Halo · 57 Unknown — never assumed moved
Email · productivity
Google Workspace
Microsoft 365
Target · HaloTarget: Google Workspace · both domains
801 of 820 mailboxes verified routing · 19 off target, named
Code hosting
GitHub Enterprise · 1 org
GitHub Enterprise · 1 org
Target · HaloTarget: one org · Prism repos transferred
312 of 340 repos verified transferred · SSO binding evaluated per repo
Cloud
AWS · 4 accounts
GCP · 3 projects
SplitTarget: AWS system-of-record · GCP retained 12mo for data
both estates observed · GCP scope frozen — 0 new resources since close
Collaboration
Slack · Enterprise Grid
Slack · Pro
Target · HaloTarget: one Grid workspace by D90
shared channels observed since D0 · merge verified at the D90 gate
HRIS
Workday
BambooHR
Target · HaloTarget: Workday only · Bamboo retired D120
820 of 820 records verified in Workday · retirement gated on verified absence
Observability
Datadog
New Relic
Target · HaloTarget: Datadog · New Relic retired D60
1,790 of 1,847 services verified reporting · 57 Unknown
Ticketing
ServiceNow
Jira Service Mgmt
Target · HaloTarget: ServiceNow · JSM retired D90
3 integrations still observed calling JSM — retirement blocked, scope named
Identity overlap
Same email, different people. Different emails, same person. A shared admin account on fourteen SaaS tenants. Panaptico observes both directories from day one and surfaces every overlap as a finding — classified, backed by evidence, and scoped to the exact accounts, systems, and paths affected.
47 findings · 4 classes · 0 Unknown remaining
Halo
b.stevens@halo.com
Prism
bob.stevens@prism.com
Finding · Same person, two identities · scope: 11 systems, 3 privileged paths · one identity remains — the other verified absent
Halo
alex.chen@halo.com · Senior SWE
Prism
alex.chen@prism.com · Platform TL
Finding · Different people, same handle · scope: mail routing + group grants in 2 tenants · surfaced with evidence before cutover
Halo
priya.menon@halo.com · org-wide approver
Prism
dev.raj@prism.com · org-wide approver
Finding · Overlapping approval rights · scope: 14 approval paths across both estates · duplicate grant verified absent since D7
Halo
7 contractors in both directories
Prism
Paid through Halo · provisioned in Prism
Finding · Duplicate records · scope: every grant each record still holds · Prism accounts verified absent since D14
Halo
admin@prism.com
Prism
super-admin on 14 Prism SaaS tenants
Finding · Shared account, no attributable owner · scope: every privileged path on 14 tenants · old credential verified absent
Policy divergence
Every policy area is shown as current state per estate against the declared target — field by field, population by population. Divergence is a finding with the affected accounts named; where evidence is missing, the result is Unknown, never assumed compliant.
MFA session lifetime
12h active · 30d refresh
8h active · 7d refresh
12h active · 30d refresh
Verified · both estates
Password rotation
90d · WebAuthn preferred
never · SMS allowed
90d · SMS disabled · WebAuthn for admins
Off target · 214 Prism accounts
Device trust
MDM mandatory · Intune
BYOD allowed
MDM mandatory · 60d grace for Prism fleet
In grace · 412 of 820 verified
Contractor re-attestation
Quarterly
Annual
Quarterly · both estates
Verified · evidence 2d old
Privileged access
BeyondTrust PAM
Shared password vault
PAM required · no shared accounts
Off target · 3 shared accounts observed
Data classification
4-tier: Public / Internal / Confidential / Restricted
3-tier: Open / Internal / Sensitive
4-tier · Prism assets re-tagged
Unknown · scan coverage 61%
Retention · deleted users
180d
30d
180d · both estates
Verified · both estates
Verified milestones
The deal docs set the dates; Panaptico verifies the conditions. Each gate carries a must-be-true list evaluated against live state from both estates — a milestone passes on evidence, not status reports, and deal-mandated boundaries stay verified between gates.
D-Day · Close
Deal close · Day 0
Must be true
Signs on the evidence
CEO · Legal · CHRO
Day 30
People verified in one HRIS
Must be true
Signs on the evidence
CHRO · CFO
Day 60
Identity + access verified
Must be true
Signs on the evidence
CISO · CIO
2 findings · blocking
Day 90
Duplicates verified absent
Must be true
Signs on the evidence
CFO · CIO · COO
Both estates observed from close. Duplicates, overlaps, and policy divergence surface as findings with evidence and named scope; milestones pass on proof, not status reports. What remains after Day 90 is one estate — continuously verified.