What tech due diligence finds in a business you're buying.
Technical due diligence surfaces the parts of a business the financials hide: who really owns the code, whether one person holds it all in their head, how the software was built, and what it would cost to keep running. In lower-middle-market deals these findings routinely move valuations by 3 to 12% of enterprise value. This guide walks through each finding, what it does to a deal, and how a buyer or seller gets ahead of it before it becomes a surprise.
01 / What the review is really looking for
Tech due diligence answers one question a spreadsheet cannot: if you owned this software next quarter, could you run it, defend it, and sell it again?
A financial review tells you the business makes money. A technical review tells you whether the thing making the money is durable or held together by one person and a set of undocumented decisions. For a buyer, that is the difference between a clean transition and a hundred-day scramble. For a seller, it is the difference between the price on the letter of intent and the price after the buyer's engineer looks under the hood. The review reads the same signals either way. This guide is written for all three readers who care about them: the owner running the business today, the seller preparing to exit, and the acquirer running diligence against a deadline.
The findings cluster into seven areas. Key-person risk, code ownership, security and compliance posture, AI-generated code, scalability and technical debt, licensing and IP, and handover readiness. The rest of this page takes each one in turn, then shows what it costs the deal and how to get in front of it.
Buying or selling now? See tech due diligence and the definition of technical due diligence.
02 / The seven findings, in order
These are the findings that most often change a number or a term in a lower-middle-market software deal.
- 01
Key-person IT risk.
- One person holds the critical system knowledge in their head, with no documentation and no second pair of hands.
- Roughly a third of lower-middle-market companies carry this risk. It is the single most common finding, and the hardest to see from the outside.
- If that person leaves after close, the buyer inherits software nobody left can safely change.
- 02
Undocumented or unowned code.
- The repository, deployment, and infrastructure sit in a former contractor's accounts, not the company's.
- There is no written record of how the system is built, so onboarding a new engineer takes months instead of weeks.
- Diligence confirms exactly what the company legally owns, which is often less than the seller assumes.
- 03
Security and compliance posture.
- Customers, insurers, or the acquirer are asking for SOC 2 readiness or ISO 27001, and there is no evidence the controls exist.
- The trigger that matters is a real party asking, not a regulatory deadline. EU high-risk AI duties were deferred to 2027 and 2028, and Colorado repealed its AI Act before it took effect.
- A gap here does not kill a deal, but it becomes a condition of closing and a line item in the hundred-day plan.
- 04
AI-generated code that shipped fast.
- Code written quickly with AI tools can carry security issues that no one reviewed. Veracode found 45% of AI-generated code ships with at least one OWASP Top-10 vulnerability.
- The speed that helped the business grow can leave a review surface no one has audited.
- Diligence reads the real code, not the demo, to see whether it holds up. See is AI-generated code safe to ship.
- 05
Scalability and technical debt.
- The system works at today's volume but has shortcuts that will cost real money to unwind as the business grows.
- Technical debt is not a reason to walk away. It is a number to put in the model and a plan to put in the first year.
- The review sizes it so neither side is surprised by it later.
- 06
Licensing and IP ownership.
- Third-party libraries with restrictive licenses, or code built by contractors without a clean assignment of rights, can put the IP the buyer is paying for in question.
- Open-source components with the wrong license terms can force a rewrite or a renegotiation.
- Diligence traces the chain of ownership so the thing being sold is really the seller's to sell.
- 07
Handover and escrow readiness.
- Can the code, docs, and access transfer cleanly at close, or is the transition itself a risk?
- Where a full transfer is not possible day one, source-code escrow holds the code so the buyer is protected if the seller disappears.
- A clean handover is what turns a signed deal into a running business the next morning.
03 / What each finding costs the deal, and how to get ahead of it
Every finding maps to a specific effect on price or terms, and every one has a move that gets you in front of it.
Read the table two ways. If you are buying, the middle column is your negotiation. If you are selling, the right column is your homework, done before the buyer's engineer arrives. Technology findings routinely adjust valuations by 3 to 12% of enterprise value in $2M to $20M-revenue deals, so the difference between finding these first and finding them in the data room is real money.
| What diligence finds | What it costs the deal | How to get ahead of it |
|---|---|---|
| Key-person IT risk | Retention holdback, earnout tied to the person, or a lower price | Document the system and cross-train a second owner before diligence |
| Undocumented or unowned code | Closing condition to transfer accounts; deal stalls until it clears | Move the repo, infra, and deployment into company accounts now |
| Missing SOC 2 or ISO evidence | Condition of closing, plus a remediation line in the 100-day plan | Get readiness in order when a customer or insurer first asks |
| AI-generated code, unreviewed | Security remediation cost priced into the model | Run a code review so the surface is audited before it is scrutinized |
| Scalability and technical debt | Discount for future engineering cost, or a delayed integration | Size the debt and hand the buyer a credible first-year plan |
| Licensing and IP gaps | Reps and warranties, escrow, or a rewrite before close | Confirm clean assignment and license terms ahead of the review |
| Handover risk | Extended transition services and a slower, riskier close | Prepare a clean handover package, with escrow where needed |
Score a target yourself with the tech due diligence scorecard, then read how the full review works.
04 / The numbers behind the review
Three figures explain why technical diligence pays for itself in a lower-middle-market deal.
These are the levers, in order. A finding that moves a valuation by single-digit percent of enterprise value on a multi-million-dollar deal dwarfs the cost of the review that found it. The point of diligence is not to kill the deal. It is to price it honestly.
- Valuation swing from tech findings$2M to $20M-rev deals
- 3 to 12%
- Lower-mid-market firms with key-person IT riskIndustry data
- ~1 in 3
- AI-generated code shipping an OWASP Top-10 issueVeracode, 2025
- 45%
Typical search-fund and holdco targets run near 30 to 40 employees at around $16M purchase prices, and services businesses are the most common. See how the finding on undocumented code plays out in our guide to taking over software from a previous developer.
05 / One artifact, both sides of the deal
A short paid audit is the same document a buyer uses for diligence and a seller uses to prepare for exit.
We run this as an audit, a fixed-scope read of the code, ownership, security posture, and handover readiness that ends in a written call with a fixed number attached. On the buy side, it is your technical diligence: an independent read of what you are buying, in plain language you can act on. On the sell side, it is exit-readiness: you find and fix the findings before a buyer does, so nothing at the table is a surprise that costs you price. Same review, same artifact, different timing.
- ✓You get a plain-language report, not a wall of jargon a non-technical owner cannot use.
- ✓Every finding is tied to what it does to the deal and what it takes to fix, with a number.
- ✓Where the finding is a rescue job, we scope the fix as a fixed-price software rescue so you know the cost before you commit.
- ✓The audit is backed by our Value Guarantee: on a pre-screened fit, at least 10x the fee in value you agree is real, or it is free.
The audit runs directionally $5,000 to $15,000 and is credited in full toward any build or remediation that follows. For a buyer it is a rounding error against a seven-figure purchase. For a seller it is cheap insurance against a discount at the table.
Start the review as a software audit, or read what it stands behind on our guarantees page.
06 / Common questions
What is on a technical due diligence checklist?
A technical due diligence checklist covers seven areas: key-person IT risk, code ownership and documentation, security and compliance posture such as SOC 2 readiness, AI-generated code that may carry security issues, scalability and technical debt, licensing and IP ownership, and handover or escrow readiness. Each item maps to a specific effect on price or deal terms. The review reads the actual code and accounts, not the demo, so a buyer knows what they are buying and a seller knows what a buyer will find.
How much can tech due diligence change a valuation?
In lower-middle-market deals, technology findings routinely adjust valuations by 3 to 12% of enterprise value in businesses with $2M to $20M in revenue. A single finding, like critical knowledge sitting in one person's head or code the company does not fully own, can trigger a holdback, an earnout, or a discount. On a seven-figure purchase, that swing dwarfs the cost of the review that found it, which is why buyers and sellers both run diligence early rather than at the table.
What is the most common finding in an SMB software review?
Key-person IT risk is the most common and the hardest to see from the outside. Roughly a third of lower-middle-market companies carry it, meaning critical system knowledge lives in one person's head with no documentation and no second owner. If that person leaves after close, the buyer inherits software nobody left can safely change. The fix is to document the system and cross-train a second owner before diligence begins, which turns a red flag into a non-issue.
Is AI-generated code a problem in due diligence?
It can be. Code written quickly with AI tools can ship security issues no one reviewed. Veracode found in 2025 that 45% of AI-generated code ships with at least one OWASP Top-10 vulnerability. The speed that helped a business grow can leave a code surface that has never been audited. Diligence reads the real code to see whether it holds up. The finding is not automatically a deal-breaker; it is a remediation cost to price into the model or fix before the review.
Can the same audit work for both buying and selling?
Yes. A short paid audit is the same artifact both sides of a deal use. On the buy side it is your technical diligence, an independent read of what you are buying. On the sell side it is exit-readiness, so you find and fix the findings before a buyer does and nothing at the table costs you price. The audit runs directionally $5,000 to $15,000, is credited toward any build or fix that follows, and ends in a plain-language report with a number attached to every finding.
Is there a regulatory deadline forcing this now?
No, and any vendor selling you on a legal deadline is not being straight. EU high-risk AI duties were deferred to December 2027 and August 2028, and Colorado repealed its AI Act before it took effect. The trigger that matters is a real party asking: a customer, an insurer, or an acquirer requesting SOC 2 readiness or a clean technical review. Diligence is worth running when a deal is on the table, not because a statute is coming.
Last updated June 2026 · Talk with Felipe
Your build
Taking on new builds
Have something in mind?
Tell us what you're making. We reply within a day with a fixed price and a date.