5 IT Challenges Every Oil & Gas Company Faces After an Acquisition

Oil and gas has been in a consolidation wave for several years. The EIA counted roughly $234 billion in U.S. exploration and production M&A in 2023, the most since 2012, led by headline deals like Exxon–Pioneer and Chevron–Hess. Enverus tracked another $105 billion in upstream deals in 2024, with the Permian making up more than 40% of fourth-quarter deal value, and activity picked back up in early 2026.

Most of those deals are smaller than the headlines: an operator picking up acreage, a few field offices, and the people who run them. Every one of them comes with a second IT environment that now has to work with yours. After running these integrations, we see the same five problems show up again and again.

1. Two Microsoft 365 tenants that need to become one

The acquired company has its own Microsoft 365 tenant: its own email, Teams, SharePoint, OneDrive, and user accounts. On day one, your people and theirs can't easily see each other's calendars, find each other in Teams, or share files without friction.

Merging tenants is a real project, not a setting. A few things catch people off guard:

A domain can only live in one tenant at a time. You can't move their email domain into your tenant until their mailboxes have moved, so the domain cutover has to be sequenced carefully.
Microsoft's native cross-tenant migration needs an add-on license. Moving mailboxes and OneDrive data with Microsoft's built-in tools requires a one-time "Cross Tenant User Data Migration" license for each user you move.
Not everything comes across. Teams meeting links, email signatures, and Microsoft 365 Groups don't migrate, and users have to rebuild their Outlook profiles.

What to do: set up coexistence first (shared free/busy calendars and cross-tenant access), then migrate in planned waves starting with a pilot group, and move the domain last.

2. Endpoints you didn't know you bought

The corporate laptops are easy to find. The problem is everything else: the workstation in the field office, the laptop in a truck, the tablet at the wellsite, the PC under a desk that has been running the same accounting software for nine years.

Acquired devices often have no endpoint protection, no patch management, and no one who remembers the admin password. Until they're inventoried and brought under management, you can't secure them, support them, or even know if they're still in use.

What to do: compare a real inventory against what diligence told you, then get monitoring and endpoint protection onto 100% of devices in the first 30 days.

3. Security debt you inherit on day one

When you buy a company, you buy its security history too. The best-known example is Marriott: Starwood's systems were breached in 2014, Marriott acquired Starwood in 2016, and the breach wasn't found until 2018. The UK regulator later fined Marriott £18.4 million. In a 2026 FTI Consulting survey, nearly one in four executives said they had a cyber incident during or shortly after a deal.

The usual gaps are predictable: no multi-factor authentication, shared admin passwords that former employees and vendors still know, and remote access tools nobody is watching. Verizon's 2025 Data Breach Investigations Report found stolen credentials were the top hacking method in small business breaches.

What to do: on close, rotate every privileged and shared password, enforce MFA on all accounts, and cut third-party remote access down to what's actually needed. Microsoft Research found MFA reduces the risk of account compromise by 99.22%.

4. Operational technology on the acquired assets

Production sites come with SCADA systems, RTUs, and PLCs, and in smaller operations those often sit on the same network as office PCs. That's a problem, because an infection that starts with a phishing email can reach systems that keep wells running. Dragos counted 119 ransomware groups targeting industrial organizations in 2025, up 49% from the year before.

You don't need to take over the OT systems to reduce that risk. CISA and its partner agencies boil it down to a few basics:

Keep OT off the public internet.
Change default passwords.
Secure remote access with MFA and a single, logged entry point.
Segment the IT and OT networks.
Make sure operations can run manually if needed.

What to do: map how the acquired sites' OT connects to the IT network before you change anything, then put a firewall between them that only allows the traffic that's needed.

5. Licenses, contracts, and the transition agreement

Software licenses are usually tied to a specific legal entity. Many contracts have change-of-control or assignment clauses, and some licenses can't be used by a new owner at all without the vendor's consent. Law firm Nixon Peabody describes a case where CA Technologies sued over a divested business's continued use of software that was licensed only to the former parent.

If the seller is going to keep providing IT services for a while, that's spelled out in a Transition Services Agreement (TSA). IT TSAs commonly run 6 to 24 months, and the most common problems are vague service descriptions, underestimated costs, and paying for TSA services and their replacements at the same time.

What to do: review every critical software agreement before close, get any transition-use rights in writing, and plan the TSA exit as carefully as the TSA itself.

The common thread

None of these problems are exotic. They're the predictable result of two companies that set up IT on their own, for their own needs, with no plan to merge. The operators who handle them well start planning before close, protect day-to-day operations first, and sequence everything else.

If you have a deal coming up, our M&A IT Integration Checklist walks through each phase, or you can book a call and we'll talk through your situation.

Sources

Need help with this?

Book a free discovery call. We'll look at your environment and give you a straight answer on what it would take.

Book a discovery call (512) 309-0848