Solution · M&A integration

One graph,
from two companies.

The target brought their own Okta, their own HRIS, their own cloud, their own conventions. The deal docs gave you ninety days. Panaptico runs the integration as a live graph — tool rationalization, identity collisions, policy merges, and the deal-timeline gates that actually signed off the acquisition.

Integration Canvas· DEAL-NV-0001 · Day 42 of 90
5,020 employees · 2 stacks → 1

Acquirer

4,200

Halo Commerce

halo.com · est. 2017

  • Okta · 4,200 users
  • Google Workspace
  • AWS · 4 accounts
  • Slack · Enterprise Grid
  • Workday · ServiceNow
  • GitHub Enterprise · 1 org
  • Datadog · BeyondTrust

Unified

5,020

Halo Commerce (NewCo)

unified stack · both domains kept

  • Okta · 5,020 users
  • Google Workspace · both domains
  • AWS · tool-of-record · GCP kept 12mo
  • Slack Grid · D60 merge
  • Workday · BambooHR sunset D120
  • GitHub · Prism repos transferred
  • Datadog · NR sunset D60

Target

820

Prism Labs

prism.com · est. 2020 · acq. 2026-03-15

  • Okta · 820 users (separate tenant)
  • Microsoft 365
  • GCP · 3 projects
  • Slack · Pro
  • BambooHR · JSM
  • GitHub Enterprise · 1 org
  • New Relic · password vault

Stack decisions

8 · signed

Identity collisions

47 · resolved

Policies reconciled

7 of 7

Active gate

Day 60 · ID unify

Dual-spend

$1.9M · closes D90

The gap

Two companies. Two of everything.

01

The target brought their own everything

Two Oktas, two HRIS, two clouds, two chat tenants, two code orgs. Every one of them made decisions the acquirer never heard of and needs to honor or override — usually in ninety days.

02

Day-1 email is easy. Day-90 parity is brutal

Day 1 is a welcome mailbox and a laptop. Day 90 is the deal document — payroll unified, access consolidated, compliance posture honored, dual-spend closed. The gap in the middle is where integrations die.

03

Two of every bill, until someone proves which one to cut

You pay for both Oktas until the target's users are absorbed. Both chat tools until the workspaces merge. Every week of indecision is another week of duplicate SaaS on a line item somebody has to explain.

Stack reconciliation

One tool-of-record per function. Signed, not argued.

For every function that exists on both sides, Panaptico binds the rationalization to a decision record — who wins, which direction the data flows, and why. No post-close meeting, no vendor politics.

  • Identity

    Okta · 4,200 users

    Okta · 820 users

    Halo wins

    Prism users migrate into Halo tenant

    Halo runs PAM + ZTA pipeline; easier to absorb than rewrite

  • Email · productivity

    Google Workspace

    Microsoft 365

    Halo wins

    Prism → Google · 60d window

    Halo has integrated Drive + Looker; M365 data archived 7y

  • Code hosting

    GitHub Enterprise · 1 org

    GitHub Enterprise · 1 org

    Halo wins

    Prism repos transferred · SSO rebound

    SAML rebind only; CI secrets re-vaulted

  • Cloud

    AWS · 4 accounts

    GCP · 3 projects

    Split

    AWS is tool-of-record · GCP preserved 12mo for data

    Data science warrant to stay on BigQuery through Q4

  • Collaboration

    Slack · Enterprise Grid

    Slack · Pro

    Halo wins

    Shared channels D0 · merge to Grid D90

    Grid governance already signed; Pro absorbs cleanly

  • HRIS

    Workday

    BambooHR

    Halo wins

    Prism records → Workday · Bamboo sunset D120

    SOX control boundary lives in Workday

  • Observability

    Datadog

    New Relic

    Halo wins

    Prism services instrument to Datadog

    Single pane; see Consolidations for savings model

  • Ticketing

    ServiceNow

    Jira Service Mgmt

    Halo wins

    Prism tickets migrated · JSM sunset D90

    CAB + change record retention already in ServiceNow

Identity collisions

Two directories. One name. Forty-seven awkward emails.

Same email, different people. Different emails, same person. Two VPs of Engineering. A shared admin account on fourteen SaaS tenants. Panaptico classifies every collision and binds each one to a signed resolution before cutover.

47 collisions · 4 classes · 0 unresolved

identityCOLLIDE-001

Halo

b.stevens@halo.com

Prism

bob.stevens@prism.com

Resolution · Same person · consultant on both sides · identities merged, both mailboxes forwarded 90d

name clashCOLLIDE-002

Halo

alex.chen@halo.com · Senior SWE

Prism

alex.chen@prism.com · Platform TL

Resolution · Different people · Prism issued alex.chen2@halo.com · comms sent D-3 before cutover

role clashCOLLIDE-003

Halo

Priya Menon · VP Engineering (Halo)

Prism

Dev Raj · VP Engineering (Prism)

Resolution · Dev Raj becomes SVP Platform · reports to Priya · signed by CEO + CHRO on D7

dup recordCOLLIDE-004

Halo

7 contractors in both directories

Prism

Paid through Halo · provisioned in Prism

Resolution · Deduped · single Workday record · Prism Okta account deprovisioned D14

identityCOLLIDE-005

Halo

admin@prism.com

Prism

super-admin on 14 Prism SaaS tenants

Resolution · Shared account · broken into 4 named admins · break-glass vaulted in 1Password

Policy reconciliation

Two postures. One winner per rule. Nothing relaxes by accident.

Every policy collision resolves upward — stricter wins unless explicitly relaxed. Each call is a decision record with a signer and a binding to the systems still governed by it.

  • MFA session lifetime

    12h active · 30d refresh

    8h active · 7d refresh

    12h active · 30d refresh

    CISO · 2026-03-28

  • Password rotation

    90d · WebAuthn preferred

    never · SMS allowed

    90d · SMS disabled · WebAuthn for admins

    CISO · 2026-03-28

  • Device trust

    MDM mandatory · Intune

    BYOD allowed

    MDM mandatory · 60d grace for Prism fleet

    CISO · CIO · 2026-04-02

  • Contractor rotation

    Quarterly re-attestation

    Annual

    Quarterly · CHRO signs re-attestation report

    CISO · CHRO · 2026-04-05

  • Privileged access

    BeyondTrust PAM

    Shared password vault

    BeyondTrust · Prism shared accounts decomposed (see Collisions)

    CISO · 2026-04-08

  • Data classification

    4-tier: Public / Internal / Confidential / Restricted

    3-tier: Open / Internal / Sensitive

    4-tier · Prism assets re-tagged · automated scan completes D75

    CISO · Legal · 2026-04-12

  • Retention · deleted users

    180d

    30d

    180d · Prism records back-filled to 180d

    Legal · CPO · 2026-04-14

Halo posture keptMerged policy · stricter + transitionPrism posture kept

Deal timeline gates

The clock the deal agreement already set.

Integration has the deadlines the deal docs wrote. Panaptico binds each gate to a signed must-be-true list and refuses to advance until every item clears.

D-Day · Close

Deal close · Day 0

Must be true

  • Email routing in place · both domains receiving
  • 820 Prism laptops whitelisted on Halo VPN
  • Day-1 welcome pack · 820 users · Okta invite queued

Gated by

CEO · Legal · CHRO

done

Day 30

Payroll + HR unified

Must be true

  • All Prism employees in Workday · reporting chain confirmed
  • Benefits bridged · no lapse
  • Role collisions resolved · comms sent

Gated by

CHRO · CFO

done

Day 60

Identity + access unified

Must be true

  • All Prism users in Halo Okta · Prism tenant in shutdown mode
  • Shared Slack workspace · governance applied
  • Policy rewrite merged · 7 of 7 signed

Gated by

CISO · CIO

2 blockers · open

active

Day 90

Full tool rationalization

Must be true

  • BambooHR · JSM · New Relic · Prism Slack · sunset complete
  • GCP frozen outside data team · AWS tool-of-record
  • Dual-spend closed · CFO signs consolidated monthly

Gated by

CFO · CIO · COO

pending

Two stacks in.
One graph out.

Panaptico turns the integration plan into a live graph — tool-of-record decisions, identity collisions, policy merges, deal-timeline gates. All signed. All queryable. Through Day 90 and after.

← Consolidations·Related: Decision provenance