Standardizing Secrets Across a PE Roll-Up's Portfolio Companies

Every acquired company brings its own IT vendor, its own password conventions, and often its own undocumented shared logins that outlived the employees who set them up. Left alone, a platform ends up managing five incompatible approaches to the same problem, which makes it nearly impossible to answer a simple question like who has access to what across the whole portfolio.

During integration planning, get a straight answer from each acquired company on where credentials are stored today, who currently has access, and whether any of them are shared across systems that should be separated. This inventory, done early, is what makes standardization possible later instead of a permanent patchwork.

Questions to ask each acquired company during integration planning:

• Where are credentials stored today, and is that location documented anywhere outside one person's memory?
• Who currently has access to those credentials, including former employees and outside IT vendors who may still hold logins?
• Are any credentials shared across systems that should be kept separate, such as a single administrator password used everywhere?
• Which credentials were ever shared with the parent platform's other companies or central IT, and how would they be cut over cleanly?

Doppler's quick setup lets a platform bring a newly acquired company onto a consistent secrets structure within weeks of close, without needing to stand up shared infrastructure first. For a roll-up moving through several add-ons a year, that speed matters more than any single advanced feature.

Once the platform starts consolidating infrastructure across multiple portfolio companies, sharing a data warehouse or a common application layer, Vault's namespace model lets each portco keep its own scoped access while the platform team manages shared policy centrally. A portfolio company that has to fund an emergency credential rotation across newly acquired systems is spending capital that shows up in the same burn multiple a board tracks between funding rounds¹.

A buyer's diligence team will eventually ask how credential access is managed across the portfolio, and an inconsistent answer across companies is a flag worth avoiding. Standardized rotation evidence, presented the same way for every portfolio company, is a small detail that makes the rest of your diligence package look considerably more credible.

It's easy to deprioritize secrets hygiene at a recently acquired company that hasn't been fully integrated into the platform yet, on the reasoning that it's still running semi-independently and therefore lower priority. That reasoning gets the risk backwards: an unintegrated company often still has its pre-acquisition habits fully intact, including whatever shared or default credentials existed before the deal closed.

Inventory and address the acquired company's existing credentials early, even before deeper systems integration begins, rather than waiting for integration to reach that workstream naturally. The gap between close and full integration is often when a legacy credential is most likely to be exploited, precisely because attention is elsewhere.

With several acquired companies competing for the platform's limited security attention, prioritize by exposure, not by acquisition date. A recently acquired company still running its pre-deal shared administrator credential is a higher priority than an older portco that's already been through one standardization pass, even if the older one closed first.

A simple scoring approach works well enough: for each portco, note whether default or shared credentials are still in use, whether any rotation has happened since close, and how much of that company's infrastructure is now shared with the rest of the platform. Address the highest-exposure company first, then work down the list rather than proceeding strictly in acquisition order.

When a portfolio company is sold or spun out, either to a strategic buyer or back to its own management team, someone has to figure out which of its credentials were ever shared with the parent's other companies or with the platform's central IT, and cut those over cleanly.

This is harder than it sounds if the portco's secrets were ever stored in a shared Vault instance or a Doppler team spanning multiple companies in the portfolio, rather than isolated per entity from the start. Untangling shared access after the fact, under a closing deadline, is far more work than isolating it would have been on day one of the acquisition.

Ask this question during diligence on the way in, not just on the way out: if this company were sold tomorrow, how long would it take to prove that none of its credentials still live inside another portfolio company's systems?