For investors, acquirers and boards
Technical Due Diligence
Before you invest in or buy a technology business, find out what is really behind the demo.
One of our CTOs leads the review, backed by our CIO and CTO network. You get a red, amber, green report with every finding priced, ready for the investment committee in two to three weeks.
What the Data Room Will Not Tell You
The pitch deck says it scales
Nobody on the deal team can tell whether the platform will handle ten times the customers, or whether it needs a rebuild the moment the money lands.
The code may not be what it seems
Large parts may be AI-generated, copied from open source with licence conditions, or understood by only one engineer.
Security and privacy are a black box
A breach after settlement becomes your problem. You need to know how the target protects personal information before you sign.
Key people could walk
If the founding CTO leaves after the earn-out, does anyone else know how production works? Key-person risk rarely shows up in the data room.
Deal-Ready in Two to Three Weeks
A fixed fee agreed before we start, sized to the target. One CTO is accountable for the review from scoping to the final report.
Scope and access
We agree the questions that matter to your deal, sign the NDA and get read access to code, cloud accounts, documentation and the people who run the platform.
Review
A CTO from our team reviews architecture, code, security, cloud costs and the roadmap, and interviews the engineering leads. Specialists from our CIO and CTO network join where the target needs it.
Red, amber, green report
Findings ranked by deal impact, the cost to fix each one, and the questions to put to the vendor before signing. Written for the investment committee, with an appendix for engineers.
First 100 days
If you proceed, we can turn the findings into a 100-day technology plan and provide a fractional CTO or CIO to lead it.
Seven Areas We Review
Each area gets a red, amber or green rating, with the evidence and the cost to fix anything material.
| Area | What we check |
|---|---|
| Architecture and scalability | Can the platform carry the growth in the business plan, and what breaks first? |
| Code quality and technical debt | How maintainable is the code, how much is AI-generated, and what would it cost to fix the worst parts? |
| Security and privacy | Access control, secrets, patching, incident history and how personal information is handled under the Privacy Act. |
| Team and key-person risk | Who knows what, how the team ships, and what happens if one or two people leave. |
| IP, licences and open source | Who owns the code, which open-source licences apply, and whether any create obligations for the buyer. |
| Cloud and run costs | Current spend, how it scales with customers, and savings that are realistic in the first year. |
| Roadmap credibility | Whether the product roadmap matches the team, budget and architecture that exist today. |
How Our Technical Due Diligence Works
Most technical due diligence fails in one of two ways. It is either a checklist that misses what matters, or a long engineering report the investment committee cannot use. Ours is led by a CTO who has sat on both sides of the table, and it is written to support a decision.
Start from the deal
We begin with the investment thesis. If the deal depends on international expansion, we look hard at scalability and data residency. If it depends on margin, we look at run costs and the engineering headcount needed to keep the product alive.
Look at the real system
Slides and architecture diagrams are where we start, not where we stop. We read the code, check the cloud accounts, run dependency and licence scans, and talk to the engineers who carry the pager. That is where the real risks show up.
Price the findings
Every material finding comes with an estimate of what it would cost and how long it would take to fix. That lets you adjust the price, add conditions or warranties, or walk away with evidence.
What You Walk Away With
The report is built to be read by an investment committee in 20 minutes and acted on by an engineering team afterwards.
Executive summary with a clear view
A one-page red, amber, green summary across the seven review areas, with our overall view on technology risk for this deal.
Priced findings register
Each material finding with evidence, deal impact, an estimated cost and time to fix, and a suggested treatment such as a price adjustment, condition or warranty.
Questions for the vendor
A short list of questions and document requests to close the open items before signing.
Engineering appendix
The technical detail behind each finding, so the target's team or your own engineers can verify and act on it.
Optional 100-day plan
If the deal goes ahead, a prioritised plan for the first 100 days covering stabilisation, security and team.
We are independent of the target and do not sell remediation as a condition of the review. If the technology is sound, the report will say so.
Is Technical Due Diligence Right for Your Deal?
This service suits deals where technology is a material part of the value, or a material part of the risk.
A good fit if
- ✓You are a VC or PE investor assessing a software or tech-enabled business.
- ✓You are acquiring a company and need to understand integration effort and hidden technical liabilities.
- ✓You are a board member or lender who needs an independent view of a technology-heavy business.
- ✓You are a founder preparing for a raise or sale and want to fix issues before investors find them.
Probably not the right time if
- ·You need a formal penetration test or certification audit. We can scope one with a specialist partner as part of the review.
- ·Technology is a minor part of the business and a short management interview will cover it.
Not sure how deep the review needs to go? Book a call and we will help you size it to the deal.
How This Plays Out in Practice
Getting a Platform Investor-Ready Before a $12M Series B
A Sydney SaaS company lost its CTO with a Series B four months away. Investors were asking hard questions about technical debt and reliability, and the data room had no architecture documentation, security review or scaling plan. We stabilised the platform, rebuilt the deployment pipeline and ran weekly reviews against the lead investor's diligence checklist. The round closed, and a reliability covenant was removed from the term sheet during diligence. We now run the same checklist from the investor side.
Frequently Asked Questions
What does technical due diligence cover?
Our reviews cover seven areas: architecture and scalability, code quality and technical debt including AI-generated code, security and privacy, team and key-person risk, IP and open-source licences, cloud and run costs, and roadmap credibility. Each area gets a red, amber or green rating with the findings and the cost to fix them.
How long does technical due diligence take?
Most reviews take two to three weeks from access to final report. We can run a faster first-pass review in about a week when a deal timetable requires it, then follow up on the open items before signing.
How much does technical due diligence cost?
It is a fixed fee agreed before we start, sized to the target. The main drivers are the size of the codebase, the number of products and platforms, and how quickly the deal team needs the report.
Who does the review?
One of our CTOs leads every review and writes the report. Where the target needs specialist depth, such as a regulated industry, a large data platform or a complex security posture, we bring in senior advisors from our CIO and CTO network under the same lead.
Do you review AI-generated code?
Yes. Many software companies now write a large share of their code with AI tools. We check how that code is reviewed and tested, whether it introduces security weaknesses, and whether the team can maintain it without the original prompts and people.
Will the target company know what you find?
That is your call. Most investors share a summary of the findings with the target to resolve open questions before signing. The full report belongs to you.
Know the Technology Risk Before You Sign
Book a call with the deal timetable and a short description of the target. We will tell you how deep the review needs to go and when you can have the report.