Technical due diligence that holds up in the data room.
Buyer-side and sell-side technical due diligence for investors, acquirers, and the companies they are looking at. I review the architecture, security, team, delivery, cost, and AI claims, and write a report you can put in front of a committee. Two to three weeks. I do this diligence for our family office and as technical advisor to DeepWork Capital's Fund 3 portfolio. In 2024 I led the integration of an acquired AI company at IBM, so I know what the report has to answer after the deal closes.
Six areas, each with a finding and a fix
Every area gets a risk rating, what it costs to remediate, and whether it belongs in the price, the purchase agreement, or the 100-day plan.
Architecture
What breaks at 10x. Single points of failure, data model debt, the parts that will need a rewrite, and whether the stack is one you can hire for.
Security
Auth, secrets, access control, backups, logging, and incident history. Compliance posture: SOC 2, PCI, HIPAA, or whatever the customers require.
Team
Who holds the knowledge, who is a flight risk, how decisions get made, and whether the org can survive the founder or the lead engineer leaving.
Delivery
How code gets from a ticket to production. Testing, CI/CD, release cadence, and how much of the roadmap the team actually ships.
Cost
Cloud, vendors, licenses, and people. Where the spend is, what's duplicated, and what the margin looks like after the fixes.
AI claims
What's actually shipped versus what the deck says. Models, evals, data rights, unit costs, and what happens when the model is wrong.
A report the committee can act on
- Findings ranked by risk. Critical, important, and noted. Each with evidence, not opinion.
- Cost to remediate. People, time, and money for each finding, so the deal team can decide what goes in the price.
- Questions for the agreement. Reps, warranties, escrow, and the conditions worth negotiating.
- Inputs to the 100-day plan. What to fix first after close, and who should own it. See post-acquisition integration.
- A readout. A call with the deal team to walk the findings and answer the questions the report raises.
Find it before the buyer does
A sell-side review ahead of a raise or sale surfaces the issues on your schedule, with a remediation plan you control. The buyer's review then confirms what you already told them.
If the review finds a leadership gap, I can cover it as interim CTO through the transaction. If it finds security or compliance gaps on the critical path, including SOC 2, I can own closing them as part of that engagement.
Two to three weeks, start to readout
The timeline depends on the size of the codebase and how quickly access is granted. Small teams and narrow questions go faster.
Scoping call
The deal, the question the committee needs answered, the timeline, and what access is possible. A fixed scope and price follow.
Access and interviews
Repos, infrastructure, dashboards, and documents. Interviews with the technical leaders and the engineers who hold the knowledge.
Review
Hands-on review of the code, architecture, security posture, delivery process, costs, and the AI implementation. Follow-up questions as they come up.
Report and readout
The written report, a readout with the deal team, and answers to the questions it raises. The report is yours for the data room.
Both sides of the table
Most diligence is written by people who have never had to live with the result. I have.
As an investor, through our family office and as technical advisor to DeepWork Capital's Fund 3 portfolio, I write the memo and then watch what happens to the company. As the M&A Integration Lead at IBM in 2024, I owned the systems, team, and product integration of an acquired pattern-based AI company and delivered it on schedule with the acquired team retained. As a CTO, I've been on the receiving end of a buyer's review.
That is what makes the report useful after close, not just before it.
Direct investments and technical advisor to DeepWork Capital's Fund 3 portfolio.
M&A Integration Lead for an acquired AI company. On schedule, team retained.
Platform from idea to 200,000+ monthly active users with a five-person team at Hook Security, a venture-backed cybersecurity SaaS company.
Technical due diligence questions
What does technical due diligence cover?
Architecture, security, the team, how work gets delivered, what the technology costs to run, and whether the AI claims hold up. Each area gets a finding, a risk rating, and what it would take to fix.
How long does technical due diligence take?
Two to three weeks from access to readout. Faster for a small team or a narrow question.
What is the deliverable?
A written report that holds up in a data room: findings ranked by risk, the cost to remediate each one, and the questions to carry into the purchase agreement or the term sheet. Plus a readout call with the deal team.
Buyer-side or sell-side?
Both. Buyer-side, I work for the investor or acquirer. Sell-side, I work for the company ahead of a raise or sale so there are no surprises in the buyer's review, and the fixes happen on your schedule instead of theirs.
How do you assess AI claims?
By looking at what is actually shipped: the models, the evals, the data, the unit costs, and what happens when the model is wrong. I ship AI in products myself, so a demo doesn't settle it.
Who have you done technical due diligence for?
Our family office's direct investments, DeepWork Capital's Fund 3 portfolio as technical advisor, and at IBM, where I led the integration of an acquired AI company in 2024 and lived with what the diligence had and hadn't found.
What does technical due diligence cost?
Scoped per engagement after a call, based on the size of the codebase, the team, and the question the deal team needs answered. Fixed for the engagement once scoped.
Have a deal in motion?
Tell me the timeline. You'll have a scope and a price within a few days.