Why technology due diligence matters

In a mid-market deal, technology is where the unpleasant surprises hide. A dependent legacy system, a single engineer who understands the whole platform, unlicensed software, or a security posture that would not survive a breach can each turn an attractive target into an expensive problem after completion. Technology due diligence exists to find those risks before the deal closes, price them, and give the deal team a clear view of what integration or remediation will actually cost.

The checklist, by domain

• Architecture and scalability: will the systems support the growth the plan assumes?
• Security and compliance: what is the real posture, and are there latent breaches or gaps?
• Technical debt and key-person risk: how much rebuild is deferred, and who holds the knowledge?
• Data and intellectual property: is critical data owned, protected and transferable?
• Contracts and licensing: are software and cloud agreements assignable, and is everything licensed?
• Team and delivery: can the people and processes deliver the roadmap the value creation plan needs?
• Cost and cloud spend: is technology spend understood, controlled and free of surprises?
• Integration or separation readiness: how hard, and how costly, will Day 1 and beyond actually be?

Sell-side versus buy-side

The same domains matter on both sides, but the purpose differs. On the buy-side, due diligence protects the acquirer from paying for risk it cannot see and informs the integration plan. On the sell-side, running it before you go to market lets you fix the obvious problems, evidence your strengths, and avoid value being chipped away in negotiation by findings you could have addressed first.

Why technology and security belong together

Splitting technology and cybersecurity into separate workstreams misses the risks that live between them. The security posture is a function of how the technology is built and run, and the biggest post-deal shocks tend to sit at that intersection. Assessing both through one lens, as our technology due diligence does, gives the deal team a single, coherent view rather than two partial ones.

Getting independent assessment

Due diligence carries most weight when it is independent and conducted by someone who has held the CIO and CISO seats rather than only advised from outside them. That is the difference between a checklist ticked and a judgement a deal team can rely on, delivered in the weeks a deal timeline allows.

Why Starkhorn

Starkhorn is led by Daniel J. Jacobs, who has spent over 20 years in technology and security, 15 of them in leadership roles, including Interim Group Technology Director at VetPartners, the BC Partners-backed veterinary group, and CIO and CISO at Jardine Motors Group. He is the author of The Strategy Bridge and holds PRINCE2, ITIL Foundation and full membership of the Institute of Interim Management.

Daniel has led technology and security integrations across private-equity-backed and multi-site businesses, and assesses a target the way an operator does: not just what is wrong, but what it will cost to put right and how hard the integration will be.

Frequently asked questions