You have five days to threat-model an acquired company's entire estate. How do you bound it?

### The scope that never finishes Some scopes have no natural edge. An acquired company's estate, a platform nobody has documented, an integration that touches four partners - in each case the honest inventory is unknown, and every hour spent enumerating produces two more things to enumerate. Left alone this produces one of two bad outcomes: a model that never ships, or a model that claims completeness it does not have. The way out is to stop treating scope as a property of the system and treat it as a property of the exercise. The system is as big as it is. The exercise is as big as you decide, and the quality of the work is judged by whether the decision it serves got better. ### Bound by the decision, not the inventory Start by writing the decision in one sentence. For due diligence it is usually: do we connect these networks and identity systems on day one, on what terms, and does anything here change the price or the deal structure? That sentence does more scoping work than any diagram. It tells you that the acquired company's marketing site probably does not matter, and that a shared administrative account between their estate and yours matters enormously, because only one of those can change the answer. From the decision, derive the assets - not the systems. Here they are the customer data the acquired company holds, the source-code and model IP that justified the acquisition, and the possibility of pre-existing undocumented access: a former contractor's credential, an old vendor tunnel, an unremoved administrative key. That last one is the distinctive threat of an acquisition, because the attacker position is not hypothetical, it is *unknown*: you cannot enumerate who already has access, so you model the consequence rather than the actor and design around it (staged connectivity, credential rotation before integration, no shared trust on day one). ### Slice, time-box, and choose coverage or depth explicitly With the assets named, cut the work into slices and put a hard clock on each. Five days might be one day per asset slice plus two days to write up. Inside each slice the facilitator's job is to hold the box: when the discussion slides outward - and it always does, into a partner's estate, into a platform team's problem, into an unrelated legacy system - the move is not to follow it and not to dismiss it. The move is to park it on the out-of-scope register with an owner and a re-entry trigger, and return. That facilitation move is the same one that saves a ninety-minute design session. A session on a new dynamic ad-insertion service, for example, will slide outward into the entire advertising estate within twenty minutes: the exchange partner, the measurement pipeline, the billing reconciliation. The compromised-partner threat to revenue and measurement integrity is real, but a ninety-minute session that tries to hold all of it produces nothing usable. The facilitator's boundary call - *the exchange integration is one flow in our model and one entry on the exclusion list; we are not modeling the exchange* - is what makes the ninety minutes worth having. Then make the coverage-versus-depth call in the open rather than by accident. Broad and shallow gives you a map and a rough ranking, and misses design flaws. Deep on one slice gives you real findings about the crown jewels and says nothing about the rest. Either is defensible; drifting into one because the clock ran out is not. ### The out-of-scope register is the deliverable In a bounded-by-force exercise, what you did not look at carries as much decision value as what you found. A credible register entry has four parts: what was excluded, why, what it would cost to cover (a person-week, a vendor questionnaire, an access request that takes three weeks), and what the decision-maker should assume until then. That last part is what makes it executive-readable: *we did not examine their payment processing integration; assume it is unreviewed and hold it out of day-one connectivity; two days of access would close this.* The alternative - a report that lists findings and says nothing about coverage - is read as a clean bill of health for everything unmentioned. That misreading is not the reader's fault. It is the direct product of shipping findings without a boundary. ### How to judge whether it worked Not by how much of the estate was covered. By three things: could the decision-maker act, did they know what they were not told, and did the next pass have somewhere to start? A model that covers a fifth of the estate, is explicit about the other four fifths, and leaves a prioritised list of what to open next is a success. A model that quietly attempted everything and finished nothing is not, however thick it is.