Not long enough. Security leaders are typically given less than 4-5 weeks to perform a comprehensive security assessment of an acquisition target. This includes activities like pen testing, asset inventory, and code review of any open-source components.