Rethinking Tech Diligence
Software businesses search fund entrepreneurs find often share some common characteristics. Many are generationally behind in their tech stack and lack a clear product road map. It's also not uncommon to find companies in maintenance mode, focused more on cash flow than product development. And let's not forget about security – it's often lagging behind best practices.
The goal of tech diligence isn't to find a perfect company – that doesn't exist. The goal of diligence is to uncover as much as possible as early as possible, turning the unknowns into knowns before you take ownership. This will help you determine if you need to ask for concessions from the seller, share in the cost of addressing any identified problems, or even walk away from the deal altogether.
So where do you focus? We recommend four key areas:
People. Watch out for inflexible leaders, knowledge concentration, and siloed communication. While these issues can often be resolved by bringing in the right talent, it's crucial to first identify and understand them—especially before and after making personnel changes.
Process. How a company does anything is how they do everything. It is common to find many gaps in how the company is managed across functions. The good news is that process problems are typically easily fixed once the right leaders are in place. That being said, pay special attention to customer onboarding/implementation and support, as problems in these areas are often symptoms of problems upstream in sales and product development.
Product. Pay attention to outdated technology stacks, aging or out-of-support components, excessive customization, and inflexible architecture. The technology stack should support your goals, helping attract and retain talent, and scaling with your growth needs—not hinder them.
Security. Check for cybersecurity insurance, endpoint protection, regular testing (both penetration and application), and compliance training. We’ve seen too many cases where companies face dire threats soon after being acquired due to overlooked security vulnerabilities.
