30 deep dives · 5 short answers · 6 chapters · newest October 27, 2026
The checklist
Technology Due Diligence Checklist for Mid-Market Acquisitions
The ten domains a technical review covers in confirmatory diligence, with a checklist you can use.
Open source
An Open Source Audit for M&A Is a Bill of Materials With a Price on Each Line
What a software composition review finds and how each finding turns into a cost.
Before you sell
Sell-Side Technical Due Diligence Is a Seller’s Job, Done Before the Buyer Shows Up
Finding the issues before the buyer’s team does, and fixing or disclosing them on your terms.
What due diligence has to answer
Diligence exists to change a decision: the price, the structure, the integration budget or whether to walk. A review that describes the target in detail and never touches the model has missed its purpose, however thorough it reads.
The useful framing is to start from the investment thesis and ask what has to be true about the business for it to hold. Financial diligence and the quality of earnings test the numbers. Technical, security and commercial diligence test whether the systems, the data and the revenue engine can carry the plan the numbers assume.
Terms used in this guide
Technical due diligence (TDD): a review of a target’s architecture, code, infrastructure, security, data and engineering team, written as deal risk.
Commercial due diligence (CDD): a review of the market, customers, pricing and revenue quality behind the forecast.
Quality of earnings (QoE): the accounting review of whether reported and adjusted EBITDA hold up.
Confirmatory diligence: the phase between a signed letter of intent and close, when access to data and people is fullest.
Sell-side (vendor) diligence: the same review commissioned by the seller before a process, so findings arrive on the seller’s terms.
Deep dives in this chapter
- Engineering Team Assessment Due Diligence That Predicts Whether the Plan ShipsWhen a technical diligence report tells you the codebase is "modern" and the team is "strong," you still do not know what the investment committee is…
- Software Due Diligence for Private Equity: The Findings That Move a Purchase PriceYou are three weeks from signing, the seller's tech stack is the thesis, and the CTO handed you a 40-page report color-coded by severity. None of…
- Pricing Power Diligence: Testing Whether a Business Can Raise PricesThe value-creation plan shows a 12% price increase in Year 2. The model assumes it flows straight to EBITDA. The deal team nods along because the…
- Sales Team Diligence: What to Inspect in the People, Pipeline and ProcessYou are three weeks from close. The target shows 40% year-over-year revenue growth, healthy gross margins, and a sales team of eight. The model assumes this…
- Digital Due Diligence: Website, Martech, Analytics and Revenue InfrastructureDigital due diligence is the structured examination of a target’s digital infrastructure, marketing technology, analytics integrity, and data governance. It surfaces risks that rarely appear in…
- GTM Due Diligence: The Revenue Questions Financial Models MissYou are three weeks from close, and the seller’s management presentation shows a hockey-stick pipeline. Bookings grew 40% last year. The CRM has 800 open opportunities.…
- Due Diligence as Value Protection and Investment GovernancePrepare for startup investment with comprehensive due diligence. Assess your business, identify potential risks, and build investor trust.
Technology and code
A technical review covers the same areas whichever firm runs it. What separates a useful one is whether each finding arrives with a cost, a timeline and a view on whether it changes the price.
What a technical review covers
- Architecture and scalability: whether the platform carries the growth in the model, and where it stops.
- Code quality and technical debt: maintainability, test coverage and the cost of the debt, measured in the code.
- Infrastructure and operations: hosting, deployment, monitoring, recovery and cloud spend.
- Data: where customer and revenue data lives, how it reconciles and who can change it.
- Team and key-person risk: who the business depends on, and what happens to the roadmap if they leave.
- Vendors and licenses: contracts, renewals and what they become at the next stage.
A full review usually fits inside the deal timeline when access is agreed before the data room opens: read access to code and infrastructure, the architecture and vendor documents, and time with the people who run the platform.
Deep dives in this chapter
- Continuous Technology Due DiligenceYou already know the engineering stack will not be perfect. Every asset you look at has technical debt, an over-tenured lead who owns too much undocumented…
- What Software Code Review for M&A Tells a Deal PartnerYou have signed the LOI. Confirmatory diligence is running, close is six weeks out, and the seller has just granted your technical team read-only access to…
- What Tech Due Diligence Has to Answer Before You SignTechnical due diligence has to answer five questions before you sign: does the technology support the investment thesis, what will the material weaknesses cost to fix,…
- M&A Technology Assessment: What a Deal Partner Needs to DecideAn M&A technology assessment should answer four questions in order: does the platform carry the investment thesis, is there a deal-breaker risk, what will integration cost…
- Buy-Side Technology Due DiligenceYou are three weeks from signing, the LOI is out, and the technology section of your diligence report reads like a bug tracker. Forty pages of…
- Technical Due Diligence Checklist for Mid-Market AcquisitionsA technical due diligence checklist in ten areas, each mapped to a deal decision, with the questions to ask the CTO, cost, timing and the report.
Security, data and AI exposure
Security findings are the ones most likely to move a price after signing, because the buyer inherits the exposure. Kroll’s 2026 survey of 325 PE portfolio leaders put the average financial impact of a cyber incident at $2.1M, and found cyber diligence standard in transaction diligence at 81% of firms above $25B in assets under management against 29% of smaller firms.
The same chapter covers what an AI claim is worth in a deal: the data the target can use, the cost of running its models against the revenue they support, and the open source and third-party code its product ships.
Source for the figures: Kroll, February 2026.
Deep dives in this chapter
- Open Source Software Composition Due Diligence Is a Line Item in Your Value Creation PlanIf you are in confirmatory diligence on a software or software-enabled target and the seller's tech deck says nothing about the third-party code inside the product,…
- An Open Source Audit for M&A Is a Bill of Materials With a Price on Each LineWhen a deal partner asks me what an open source audit for M&A is supposed to produce, the honest answer is short: a list of every…
- Portfolio Cyber Assessment in Private EquityYou are three weeks from close on a lower-middle-market SaaS platform, and the cyber section of the data room is thin: a two-year-old penetration test with…
- Security Due Diligence for M&AYou are three weeks from confirmatory diligence on a software or software-enabled target, and the security workstream just landed on your desk as a 40-page report…
- Security Due Diligence for Private EquityYou are three weeks from close on a software or software-adjacent target, and a security question is sitting on your risk register with no owner and…
- CRM Data Quality Audit: Why Diligence Numbers Fall Apart in the System of RecordThe management presentation shows $4.2 million in qualified pipeline. The CRM export shows $6.1 million. Neither number matches the forecast the CFO sent last quarter. You…
Commercial and financial diligence
Commercial diligence tests the revenue the model depends on: customer concentration, churn and net revenue retention by cohort, pricing power, pipeline quality and the add-backs behind adjusted EBITDA. A quality of earnings report can be clean while the commercial picture deteriorates, so the two answer different questions and both belong in the deal.
Deep dives in this chapter
- Adjusted EBITDA and the Art of Add-BacksThe number that determines your company's valuation is rarely the number sitting on your income statement. When buyers evaluate a business, they look past reported EBITDA…
- Commercial Due Diligence Red Flags in B2B BusinessesYou are two weeks into confirmatory diligence on a B2B software target. The seller's QofE looks clean, EBITDA margins check out, and the management presentation told…
- Churn and Net Revenue Retention Diligence: Reading the Signal the Deck HidesYou are reviewing a B2B SaaS target with 92% logo retention. Management presents this as proof of sticky customers. The CIM calls it "best-in-class." But when…
- Quality of Earnings vs Commercial Due Diligence: What Each One Tells YouYou are three weeks from close. The quality of earnings report lands in your inbox, and the accounting firm confirms that EBITDA adjustments are defensible, revenue…
- Commercial Due Diligence Checklist for B2B AcquisitionsYou are three weeks from signing a Letter of Intent on a B2B software company. The seller’s management presentation shows 40% year-over-year growth, strong retention, and…
Choosing a diligence firm
Firms differ less in their checklists than in what they hand over. Ask for a sample findings memo before signing: every material finding should carry a cost, a timeline and a recommendation on price or structure, and the memo should double as the first technology section of the 100-day plan.
Ask too who will do the work, how much access they need and when, and whether they have run the systems they are judging. An operator who has integrated acquisitions reads a codebase for what it will cost to own.
Deep dives in this chapter
- Technology Due Diligence Firms for Private Equity: What a Partner Gets for $15K in Five DaysA deal partner at a $500M mid-market PE firm spent three weeks on reference calls for a SaaS acquisition, heard five versions of "scalable architecture," signed…
- Transaction Advisory Technology in Private Equity Comes Down to Four Decisions a Deal Partner OwnsYou are three weeks from an LOI on a founder-led software business, and the technology section of your advisory scope reads like a compliance checklist. Cloud…
- The Best Tech Due Diligence Firm for Private Equity Is the One That Prices Deal Risk in EBITDAThe best technical due diligence firm for private equity prices every material finding in EBITDA and time, writes to the deal partner instead of to engineers,…
- A Crosslake Alternative That Fits the Deal in Front of You(advisory profile) You are two weeks from a confirmatory diligence deadline, the target is a software or software-enabled business, and someone on the deal team said…
Sell-side and vendor diligence
A seller who runs the buyer’s review first can fix what is cheap to fix and disclose the rest with a plan, instead of meeting each finding as a price reduction. Twelve to eighteen months before a process leaves time for the fixes that matter: documentation, single points of failure and revenue data that reconciles.
The value creation guide covers exit readiness from the owner’s side.
Deep dives in this chapter
- Sell-Side Technical Due Diligence Is a Seller’s Job, Done Before the Buyer Shows UpBy the time a buyer's diligence team opens your codebase, the price range is mostly set. If you are the deal partner or operating partner running…
- Sell-Side Commercial Due Diligence: Preparing the Business Before Buyers Do It To YouSell-side commercial due diligence, also called vendor due diligence, means running a buyer's commercial diligence on your own business a year or more before a sale:…
Common questions
What is technical due diligence?
A review of a target company’s technology before an acquisition: architecture, code, infrastructure, security, data and the engineering team, written up as deal risk with a cost and timeline for each finding.
How long does technical due diligence take?
It fits the deal timeline. Scope and access are agreed before the data room opens, so the findings land before the investment committee meets.
What is the difference between commercial due diligence and a quality of earnings report?
A quality of earnings report tests whether the reported and adjusted EBITDA hold up. Commercial due diligence tests the market, customers, pricing and revenue quality behind the forecast.
When should a seller run vendor due diligence?
Twelve to eighteen months before a process, early enough to fix what is cheap to fix and to disclose the rest with a plan.
What should a diligence report contain?
Every material finding with its cost, its timing and whether it changes the price or the structure, plus the remediation that belongs in the first 100 days.
Every article in this guide
Technology and code
Security, data and AI exposure
- Open Source Software Composition Due Diligence Is a Line Item in Your Value Creation Plan
- An Open Source Audit for M&A Is a Bill of Materials With a Price on Each Line
- Portfolio Cyber Assessment in Private Equity
- Security Due Diligence for M&A
- Security Due Diligence for Private Equity
- CRM Data Quality Audit: Why Diligence Numbers Fall Apart in the System of Record
Commercial and financial diligence
Choosing a diligence firm
- Technology Due Diligence Firms for Private Equity: What a Partner Gets for $15K in Five Days
- Transaction Advisory Technology in Private Equity Comes Down to Four Decisions a Deal Partner Owns
- The Best Tech Due Diligence Firm for Private Equity Is the One That Prices Deal Risk in EBITDA
- A Crosslake Alternative That Fits the Deal in Front of You
Sell-side and vendor diligence
Diligence as value protection
- Engineering Team Assessment Due Diligence That Predicts Whether the Plan Ships
- Software Due Diligence for Private Equity: The Findings That Move a Purchase Price
- Pricing Power Diligence: Testing Whether a Business Can Raise Prices
- Sales Team Diligence: What to Inspect in the People, Pipeline and Process
- Digital Due Diligence: Website, Martech, Analytics and Revenue Infrastructure
- GTM Due Diligence: The Revenue Questions Financial Models Miss
- Due Diligence as Value Protection and Investment Governance
Related guides
Start a conversation
Bring the asset, the deal stage and the decision in front of you
A short note is the fastest way to a useful first call. Sponsors, operating partners and leadership teams of $30M to $500M companies.