Technical due diligence is the single most consequential workstream in technology M&A — yet only one in four CEOs conducts it routinely. This 150-point framework covers 12 domains from code quality and cybersecurity to IP licensing and integration readiness, scored on a 1–5 scale with weightings calibrated to your investment thesis. Companies performing rigorous TDD are 2.8× more likely to achieve successful deal outcomes, and at $50K–$150K for mid-market deals, a single material finding routinely delivers 20–100× ROI.
What you'll learn
- A complete 150-point checklist across 12 technical domains, scored and weighted
- Cost ranges and timelines for TDD engagements by deal size ($15K–$500K+)
- The findings that kill deals and cut prices — with real dollar impacts
- How PE firms vs. strategic acquirers approach TDD differently
- Scoring frameworks and tools used by top diligence providers
- A severity-tiered system for prioritizing what you find
What does technical due diligence actually evaluate?
TDD examines a target across 12 core domains. Technology issues drive roughly 30% of failed mergers, so each domain maps directly to deal risk.
Codebase and architecture form the foundation. Assessors examine coding standards, modularity, tech stack currency, architectural decision records, and dependency mapping. Tools like SonarQube quantify technical debt in developer-days and flag code duplication. A well-documented modular architecture with trunk-based development and automated quality gates is the gold standard; monolithic legacy code with high cyclomatic complexity and no documentation is the nightmare.
Security posture receives outsized attention. IBM reports the average data breach costs $4.35 million, and 80% of acquirers discover previously unknown security issues during integration. The Marriott/Starwood acquisition is the cautionary tale: attackers had been in Starwood's network for two years before the 2016 deal, ultimately exposing 383 million guest records and costing approximately $200 million in penalties.
IP ownership and open-source compliance are among the most data-rich areas. Black Duck's 2025–2026 audit found open source in 99–100% of codebases, with an average of 2,778–3,550 components per transaction. More critically, 94% of transactions contained license conflicts, 97% included unpatched vulnerable components, and 78% harbored at least one high-risk vulnerability with active exploits. Copyleft contamination — GPL code embedded in proprietary products — can kill deals outright.
Team and talent assessment evaluates organizational health through bus-factor analysis, knowledge concentration metrics, turnover rates, and compensation benchmarking. Key-person dependencies where critical knowledge resides in a single engineer are among the most frequently cited red flags.
How long does technical due diligence take, and what does it cost?
| Deal size (enterprise value) | TDD timeline | TDD cost range |
|---|---|---|
| Small (<$10M) | 2–4 weeks | $15,000–$35,000 |
| Mid-market ($10M–$100M) | 3–6 weeks | $35,000–$95,000 |
| Large ($100M–$1B) | 4–8 weeks | $50,000–$150,000 |
| Mega ($1B+) | 8–16 weeks | $150,000–$500,000+ |
Provider type shapes cost significantly. Boutique specialists (Crosslake, West Monroe, AKF Partners) charge $150–$400/hour. Big 4 firms bill $400–$700/hour. MBB strategy firms command $500–$1,000+/hour. The true all-in cost — accounting for internal team time, access provisioning, and deal delays — runs 3–5× the consulting fee. A well-organized data room reduces adviser costs by 25–35%, saving $10,000–$70,000 on a typical mid-market deal.
What findings kill deals and cut prices?
TDD uncovers material issues with striking regularity. An estimated 85% of deals see purchase price reductions during due diligence, and 50% of technology deals see buyers walk away entirely.
With 94% of M&A transactions containing license conflicts and an average of 786 vulnerabilities per transaction, this is rarely a clean bill of health. GPL contamination in proprietary products can force complete code rewrites. Missing IP assignment agreements from former contributors create ownership ambiguity that threatens the core asset being acquired.
Technical debt silently inflates post-acquisition costs by 30–50%. The industry benchmark Technical Debt Ratio (TDR) should sit below 5%, but many organizations operate at 10% or higher. A 12-month backlog requiring three additional senior engineers translates to $600,000–$900,000 at current market rates.
Accenture's research shows cybersecurity DD routinely uncovers issues requiring $8 million+ in remediation. Verizon's acquisition of Yahoo saw undisclosed data breaches lead to a $350 million price reduction on a $4.48 billion deal. In one RSM case study, a PE firm spent $2 million outside its post-merger integration budget on cybersecurity upgrades that proper TDD would have identified.
Architecture that won't scale past 2× current load without major refactoring is a common finding — typically requiring "12 months and $5 million in investment." In one CohnReznick case, TDD uncovered outdated technology and poorly structured code generating unprofitable revenue, resulting in the buyer renegotiating to acquire at one-fifth the original asking price.
Severity tiers for findings
How do scoring frameworks work?
The most effective approaches score on a graduated scale (never Boolean yes/no) with weightings adjusted to the investment thesis.
Crosslake's TechIndicators® is the largest proprietary benchmark, built from 6,000+ prior tech M&A transactions informing over $30 billion in PE investment decisions. It scores targets 0–100 across nine domains, benchmarked against similarly sized companies within the same industry.
DORA metrics have become the industry standard for engineering performance. Based on research covering 32,000+ professionals, the framework classifies teams across four dimensions: deployment frequency, lead time for changes, change failure rate, and failed deployment recovery time. Elite performers are twice as likely to meet organizational performance goals.
PE firms vs. strategic acquirers: different approaches to the same data
| Dimension | PE Firms | Strategic Acquirers |
|---|---|---|
| Primary lens | Thesis-driven; every finding translates to dollar impact on deal model | Synergy identification and integration compatibility |
| Hold period | 3–7 years with exit in mind | Permanent integration |
| Staffing | Heavy reliance on third-party advisors and standardized playbooks | Internal staff with industry-specific knowledge |
| Key risk | May miss integration nuance | May overlook issues due to assumed familiarity |
| Key metric | EBITDA improvement levers, unbudgeted CapEx/OpEx | Technology asset incorporation and team retention |
The 150-point checklist
Score each item on a 1–5 Likert scale with weightings adjusted to your investment thesis. A deviation of more than one point between domains signals potential technical debt or cultural misalignment.
- System architecture documented and current12345
- Clear separation of concerns and domain boundaries12345
- Microservices vs. monolith appropriateness for scale12345
- API design standards and versioning discipline12345
- Database architecture and query optimization12345
- Caching strategy and implementation12345
- Message queue/event-driven architecture where appropriate12345
- Multi-tenancy design and tenant isolation12345
- Configuration management and feature flagging12345
- Service discovery and load balancing12345
- Architectural decision records maintained12345
- Technology stack currency (frameworks within support windows)12345
- Dependency mapping and circular dependency absence12345
- Horizontal scaling capability demonstrated12345
- Vertical scaling limits understood and documented12345
- Graceful degradation under failure conditions12345
- Stateless service design for scalability12345
- Data partitioning and sharding strategy12345
- Architecture review process in place12345
- Technical roadmap aligned with business growth projections12345
- Static analysis scores (SonarQube or equivalent)12345
- Code duplication rate (<10% threshold)12345
- Cyclomatic complexity within acceptable ranges12345
- Test coverage percentage (>60% minimum, >80% target)12345
- Unit test quality and meaningful assertions12345
- Integration test coverage for critical paths12345
- End-to-end test automation12345
- Code review process and approval requirements12345
- Coding standards documented and enforced12345
- Technical debt tracked and quantified (TDR <5%)12345
- Refactoring cadence and dedicated capacity12345
- Dead code and deprecated feature cleanup12345
- Documentation quality (inline, API, architectural)12345
- Build reproducibility and determinism12345
- Dependency management and version pinning12345
- Error handling consistency and logging standards12345
- Performance profiling and optimization history12345
- Legacy code migration plan (if applicable)12345
- Security framework alignment (NIST CSF, ISO 27001, CIS)12345
- SOC 2 Type II certification status12345
- Penetration testing frequency and remediation tracking12345
- Vulnerability scanning (SAST/DAST) in CI/CD pipeline12345
- Identity and access management (IAM) maturity12345
- Multi-factor authentication across all systems12345
- Encryption at rest and in transit12345
- Key management practices12345
- Incident response plan documented and tested12345
- Security incident history and breach notifications12345
- Third-party/vendor security assessment program12345
- Security awareness training program12345
- Zero Trust architecture implementation progress12345
- Network segmentation and firewall rules12345
- Data Loss Prevention (DLP) controls12345
- Regulatory compliance status (GDPR, HIPAA, PCI-DSS, CCPA)12345
- Privacy-by-design implementation12345
- Security logging, monitoring, and SIEM capability12345
- Cloud vs. on-premises vs. hybrid architecture12345
- Infrastructure-as-Code maturity (Terraform, CloudFormation)12345
- Multi-region or multi-AZ deployment12345
- Disaster recovery plan with tested RTO/RPO12345
- Backup strategy and restoration testing12345
- Cloud cost management and FinOps practices12345
- Resource utilization and right-sizing12345
- Autoscaling configuration and validation12345
- Network architecture and connectivity12345
- CDN and edge computing strategy12345
- Container orchestration maturity (Kubernetes)12345
- Environment parity (dev/staging/production)12345
- Infrastructure monitoring and alerting12345
- Capacity planning documentation12345
- Cloud provider lock-in assessment and exit costs12345
- CI/CD pipeline automation level12345
- Deployment frequency (DORA metric)12345
- Lead time for changes (DORA metric)12345
- Change failure rate (DORA metric)12345
- Mean time to recovery (DORA metric)12345
- Release management and rollback capability12345
- Feature flag management12345
- Branch strategy and merge discipline12345
- Automated quality gates in pipeline12345
- Environment provisioning automation12345
- Monitoring and observability stack (logs, metrics, traces)12345
- On-call and incident management process12345
- CTO/VP Engineering capability and vision alignment12345
- Engineering organizational structure effectiveness12345
- Technical leadership pipeline and succession planning12345
- Engineering manager span of control12345
- Cross-functional collaboration (product-engineering-design)12345
- Decision-making process for technical choices12345
- Communication patterns and meeting cadence12345
- Engineering culture and values alignment12345
- Remote/distributed team effectiveness12345
- Vendor and contractor management12345
- Budget ownership and financial literacy12345
- Change management capability12345
- Key-person dependency ("bus factor") assessment12345
- Knowledge distribution across codebase12345
- Voluntary turnover rate (trailing 12 months)12345
- Compensation benchmarking vs. market12345
- Skills inventory vs. future requirements gap12345
- Hiring pipeline and recruitment effectiveness12345
- Onboarding process maturity12345
- Retention risk for critical personnel post-acquisition12345
- Data architecture design and unified identifiers12345
- Data governance model and policies12345
- Data quality metrics (completeness, accuracy, consistency)12345
- Master data management maturity12345
- Data lineage and provenance tracking12345
- Analytics and BI capability maturity12345
- AI/ML model governance (if applicable)12345
- Data privacy controls and consent management12345
- Data retention and lifecycle policies12345
- Data migration complexity assessment12345
- IP ownership documentation and assignment agreements12345
- Patent portfolio coverage and value12345
- Software Bill of Materials (SBOM) maintained12345
- Open-source license conflict inventory12345
- Copyleft license contamination assessment12345
- Third-party code usage and licensing compliance12345
- AI-generated code license implications tracked12345
- Trademark and trade secret protection12345
- Non-compete and non-solicitation agreements12345
- Change-of-control clause review in vendor contracts12345
- Defect density and trending12345
- Production incident frequency and severity12345
- Customer-reported bug volume and resolution time12345
- Performance benchmarks under load12345
- SLA/SLO definitions and compliance history12345
- Accessibility compliance (WCAG)12345
- Internationalization and localization readiness12345
- Mobile platform coverage and quality12345
- User experience consistency and design system12345
- Product analytics and instrumentation12345
- Technology strategy documented and aligned with business12345
- Product roadmap feasibility given current capabilities12345
- Historical delivery track record vs. commitments12345
- R&D spending as percentage of revenue (benchmarked)12345
- Build vs. buy decision framework12345
- Innovation pipeline and experimentation culture12345
- Competitive technology positioning12345
- Technology partnerships and ecosystem12345
- Emerging technology adoption strategy (AI, ML, etc.)12345
- Technical vision alignment with acquirer's strategy12345
- API ecosystem readiness for integration12345
- Data portability and migration path12345
- Authentication and SSO compatibility12345
- Vendor contract transferability12345
- Technical team retention incentive structure12345
- 100-day integration plan feasibility12345
- Post-close remediation cost estimate (total)12345
How to decide in the next 30 days
Need a TDD partner for your next deal?
Sphere's technical due diligence practice has supported PE firms and strategic acquirers across financial services, healthcare, and manufacturing — delivering findings in the compressed timelines deal processes demand.
Frequently Asked Questions
TDD evaluates 12 core domains: software architecture, code quality and technical debt, cybersecurity and compliance, infrastructure and cloud, SDLC and DevOps practices, organization and leadership, team and talent, data architecture, IP and open-source licensing, product quality, strategy and roadmap, and integration readiness. Each domain is scored on a graduated scale and weighted according to the investment thesis, with findings categorized into critical, high, medium, and low severity tiers.
The 150-point framework in this article is designed as a working checklist. Score each item on a 1–5 Likert scale during conversational interviews and technical review sessions, adjusting category weights to your specific deal. For PE-backed acquisitions, weight security, IP/licensing, and architecture more heavily. For strategic acquisitions, increase the weight on integration readiness and team/talent.
Start by scoping the assessment against your investment thesis — not every deal needs equal depth in all 12 domains. Typical engagements run in parallel phases: data room review, management interviews, and technical deep dives (code scanning, architecture review, security testing, infrastructure audit) happening simultaneously over 2–6 weeks. Findings are scored, financially quantified, and organized into a severity-tiered report with a 100-day remediation roadmap.
Timelines range from 2–4 weeks for small deals (<$10M enterprise value) to 8–16 weeks for mega-deals ($1B+). PE deal processes routinely demand completed assessments within 2–3 weeks of LOI signing. The biggest timeline variable is data room readiness — well-organized targets can compress the process significantly, while disorganized targets extend it and increase costs by 25–35%.
Top providers like Crosslake, West Monroe, and AKF Partners assess code quality (static analysis, test coverage, technical debt ratio), security posture (vulnerability scans, penetration testing, compliance certifications), infrastructure maturity (DORA metrics, cloud architecture, disaster recovery), IP cleanliness (open-source license conflicts, patent coverage, SBOM completeness), and organizational health (key-person risk, team skills, engineering culture). Findings are benchmarked against industry-specific databases — Crosslake's TechIndicators®, for example, draws on 6,000+ prior transactions.
Costs range from $15,000–$35,000 for small deals to $150,000–$500,000+ for mega-deals. Boutique specialists charge $150–$400/hour, Big 4 firms bill $400–$700/hour, and MBB strategy firms command $500–$1,000+/hour. The true all-in cost — including internal team time, access provisioning, and deal delays — typically runs 3–5× the consulting fee. At these levels, TDD routinely delivers 20–100× ROI through a single material finding.
The four highest-impact finding categories are: open-source and IP risks (94% of deals have license conflicts), cybersecurity deficiencies (remediation averaging $8M+), technical debt (inflating post-acquisition costs by 30–50%), and architecture limitations that won't scale past 2× current load without major investment. In extreme cases — like the Verizon/Yahoo deal — findings lead to $350 million price reductions.
Absolutely. More than 50% of TDD engagements reveal significant unbudgeted IT funding requirements that materially change deal models. At $35,000–$95,000 for a mid-market engagement, a single finding — such as $2M in unbudgeted cybersecurity remediation or IP ownership gaps — can return multiples of the investment. Sell-side vendor due diligence has also surged, with 66% of PE leaders saying they're more likely to buy targets with completed TDD.