The Shadow Extranet: Why Your Next M&A Deal Room Could Be Your Biggest Liability

September 21, 2026

The Shadow Extranet

The Shadow Extranet: Why Your Next M&A Deal Room Could Be Your Biggest Liability

An M&A deal is moving quickly.

The client needs documents. Opposing counsel needs access. The deal team needs a place where everyone can work together.

So, someone creates a SharePoint site, adds external users, and starts uploading files.

It works. The deal moves forward.

But there is a problem: the firm's IT team may not even know that this deal room exists.

That is how a shadow extranet begins.

The Extranet Nobody Approved

A shadow extranet is simply an external collaboration space created outside the firm's normal governance, often a SharePoint site, Teams channel, or third-party portal.

And in high-pressure matters such as M&A due diligence and joint defense groups, it is easy to see why teams create them.

They need speed.

The problem is what happens to governance when speed wins.

Cloud-based document management is now standard across law firms. ILTA's 2025 Technology Survey covered 580 firms and roughly 152,000 attorneys, with cloud adoption continuing to grow even among smaller firms.

BakerHostetler's 2026 Data Security Incident Response Report found that law firm breach incidents nearly doubled year over year.

56% of breached firms lost sensitive client data.

$5.08M Average breach costs reached $5.08 million.

25% of reported incidents began through a third-party vendor or platform.

There is another issue hiding underneath all of this:

The documents in that new workspace are usually copies of documents already stored in the firm's DMS.

And that is where the governance gap starts.

What Happens When a File Leaves the DMS?

Inside the firm's document management system, permissions are tied to the matter.

The system knows:

Who is on the deal team
Who should be blocked
Which documents they can access
What activity needs to be tracked

Now imagine one of those documents is copied into a separate SharePoint site.

The copy has its own permissions.

The ethical wall that protected the original document does not automatically protect the copy.

One document,
in the firm's DMS

Permissions are tied to the matter.

The original

Still governed by the matter it belongs to.

Ethical wall holds

The copy, in a separate SharePoint site

The ethical wall that protected the original does not automatically protect it.

Its own permissions

And when the deal ends, someone has to remember that the extra site exists and shuts it down.

That is the real risk of manual copying:

One document can end up with two different sets of rules.

Recent 2026 legal-sector client notification filings show how little it can take for sensitive information to become exposed - sometimes just one compromised account or one over-permissioned folder.

The information involved included Social Security numbers, financial records, and privileged correspondence.

The Risk Doesn't End When the Deal Does

Now consider what happens after closing.

The deal is over.

The team has moved on.

But the SharePoint site may still be there.

That creates a problem even if nobody ever hacks it.

If the site sits outside the firm's normal monitoring, it may not be discovered until much later.

The deal Governed

The SharePoint site Outside normal monitoring

Recent legal-sector cybersecurity reporting puts the average breach detection-to-containment lifecycle at around 254 days. Incidents detected after 200 days cost roughly $1.2 million more than those caught early.

So, the question for CIOs is:

"Do we know where our sensitive documents are being shared and who still has access to them?"

A Better Way to Collaborate

Not the answer

The answer is not to stop using collaboration tools.

Because

If the approved process is slow, people will find a faster one.

Instead, firms need a model where the governed option is also the easiest option. That can mean:

Keep the DMS as the source of truth

Documents stay in the firm's DMS instead of being copied into another repository.

Use SharePoint as the window, not the storage room

A client-facing workspace can display and sync matter content in real time without creating another document repository.

Carry permissions with the matter

Client and counterparty access should follow the DMS's existing permissions and ethical walls.

Keep one audit trail

Views, downloads, and edits remain logged at the DMS level.

Let access end with the deal

When the matter closes, access closes too, without another site waiting to be cleaned up.

This also aligns with Microsoft's security direction for regulated industries, including conditional access, Azure AD B2B authentication, and Purview-based governance for SharePoint.

5 Questions Every CIO Should Ask

Before the next M&A deal kicks off, ask:

How many client-facing SharePoint sites and Teams channels are active right now?
Which ones were created for specific deals or joint defense matters?
Does each one have a real decommission date?
Does external access follow DMS-level ethical walls?
Is the governed collaboration option faster than creating a new site?

And do not overlook third-party access. It accounted for a quarter of reported law firm breaches in 2026.

Speed and Governance Should Work Together

Speed

When a deal is moving fast, lawyers will choose the tool that helps them get the work done.

Governance

The answer is not to make collaboration harder.

The obvious option

It is to make the secure, governed option the obvious option.

The easiest option

Because the best collaboration system is not the one with the most rules.

It is the one where speed and governance happen in the same place.

Connect with us