Technical due diligence
Diligence sized for the cheque you are writing.
Technical due diligence gets skipped at seed and Series A, and not because it stops mattering. The firms that do it well are built for a different deal size: weeks of lead time, a minimum fee that makes no sense against a small round, and a report that arrives after the term sheet is signed.
So the work falls to a partner's technical friend. Unpaid, unaccountable, and gone by the time the findings matter.
This is that work done properly, at a fixed scope and a fixed fee, in days rather than weeks.
What gets missed
- 01A large engineering team with weak throughput.
- 02An AI claim that turns out to be a vendor API and a presentation.
- 03Architecture that holds at a thousand users and not at fifty thousand.
- 04A security posture nobody has tested since the seed round.
- 05One engineer who understands the payment path, and no one else.
- 06Technical debt priced into the plan as though it were free.
The same report, every time
A standard shape matters more than it sounds. It makes two companies comparable, it makes a second opinion cheap, and it means nothing is quietly left out because it was awkward to look at.
- 01
Architecture and platform
How the system is put together, where it will bend under load, and what it would cost to change.
- 02
Code quality and delivery
Throughput against team size, test coverage where it counts, and how quickly a change reaches production.
- 03
Security posture
Dependencies, secrets handling, access control, and the exposure that comes with the regulatory position.
- 04
Scale and cost
What happens at the next order of magnitude, and what the infrastructure bill does on the way there.
- 05
Team and key-person risk
Who actually holds the knowledge, what leaves with them, and whether the organisation can hire against the plan.
- 06
A 90-day remediation plan
Sequenced, costed and owned, so the findings turn into a first board conversation rather than a list of concerns.
Three ways to buy it
Screening review
$6,000
Five working days
A fast read on whether the technology supports the thesis. Repository and infrastructure analysis, one engineering interview, and a findings memo with the risks that would change the decision.
Seed, and any deal where the question is go or no-go.
Full diligence
$15,000
Ten working days
The complete report across all six sections, interviews with the engineering leadership and key individuals, and a 90-day remediation plan the company can act on.
Series A, and any round where the platform is the investment case.
Portfolio monitoring
$2,500
Per month, quarterly re-scans
Quarterly re-scans across the portfolio, tracked against the baseline from the first report. What changed, what was promised last quarter, and what is getting worse rather than better.
Funds with enough technology-intensive companies that surprises are expensive.
This is a fixed scope at a fixed fee. Advisory and leadership engagements are shaped around the problem and are not priced this way.
What is automated, and what is not
Buyers of assurance are entitled to know which parts of a judgment were made by a machine. The split here is deliberate and it does not move.
Machine-assisted
- Repository scanning and structural analysis.
- Dependency, licence and vulnerability review.
- Documentation and commit-history review.
- First-draft findings against the scoring rubric.
Judgment, and mine
- Whether the architecture suits the business, not just the traffic.
- The engineering interviews, and what the answers leave out.
- Which findings would change the decision and which are noise.
- The remediation sequence, and what it realistically costs.
- The sign-off. My name is on the report.
Independence, access and limits
- Conflicts
- I am an independent consultant, with no position, advisory relationship or competing mandate in any company I am asked to assess. If one ever arises with a particular target, I will say so before the engagement begins and decline the work.
- Access and data handling
- The founder is not the buyer, and their code is the most sensitive thing they have. Read-only access, a written scope of what is examined, and deletion on a defined schedule. [CONFIRM THE PROCESSING LOCATION, ANY THIRD-PARTY MODEL USE, AND THE RETENTION PERIOD.]
- What the report is
- A view that informs an investment decision. It is not a certification, not a guarantee, and not a substitute for legal or financial diligence. Findings reflect what the access allowed and the period examined. [CONFIRM WORDING WITH COUNSEL.]
Send me the deal you are unsure about.
Tell me the stage, the sector and the technology question behind the thesis. If the work does not need doing, I will say so.
Start a Conversation