# Tech Due Diligence

> Technical due diligence for M&A transactions covering infrastructure, application architecture, code quality, technical debt, security posture, team capabilities, and IP evaluation. USE THIS SKILL when the user asks about tech DD, technology stack assessment, technical debt quantification, code quality review for acquisitions, integration complexity analysis, or post-close technology investment planning. Classifies all findings as Deal Breaker / Significant Risk / Manageable / Non-Issue.

- Skill: `kaakati/tech-due-diligence` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kaakati/tech-due-diligence`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kaakati/tech-due-diligence/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Kaakati (https://skillmd.com/u/kaakati)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kaakati/tech-due-diligence

---


# Technology Due Diligence

## Required Inputs

- **Target Company**: Name and brief description of the acquisition target.
- **Deal Thesis**: Strategic rationale for the acquisition (talent, technology, market, product).
- **Transaction Type**: Buy-side, sell-side, or merger.
- **Acquirer Technology Stack**: High-level description of the acquirer's current technology environment.
- **Available Access**: What materials/access are available (data room, codebase, interviews, documentation).
- **Timeline**: DD period duration and key milestones.

## Execution Steps

### 1. Scope Definition and Planning

Define DD scope based on deal thesis. Technology DD covers seven workstreams:

| Workstream | Key Questions | Priority by Deal Thesis |
|---|---|---|
| **Infrastructure** | Hosting, cloud, networking, DR, cost structure | All deals |
| **Application Architecture** | Patterns, coupling, scalability, modernization needs | Product/technology acqui-hires |
| **Code Quality & Tech Debt** | Maintainability, test coverage, dependency health | All deals |
| **Data & Analytics** | Data assets, quality, architecture, privacy compliance | Data-driven acquisitions |
| **Security & Compliance** | Vulnerabilities, access controls, certifications, breach history | All deals |
| **Team & Process** | Skills, processes, bus factor, DevOps maturity | Talent acquisitions |
| **IP & Proprietary Technology** | Patents, trade secrets, open-source exposure, licensing | Technology acquisitions |

**Access request list** (send to target within 48 hours):
- System architecture diagrams and documentation
- Codebase access (read-only repository access or code samples)
- Infrastructure inventory and cloud spend reports (12 months)
- Security audit reports and penetration test results (last 2 years)
- Incident logs and post-mortem reports (last 12 months)
- CI/CD pipeline configuration and deployment history
- Team org chart with roles, tenure, and skill profiles
- IP filings, patent portfolio, and open-source dependency manifests
- SLA/SLO dashboards and uptime reports
- Third-party vendor contracts and licensing agreements

### 2. Infrastructure Assessment

Evaluate the target's infrastructure foundation.

**Cloud & Hosting Evaluation:**

| Dimension | Assessment Criteria | Maturity Level (1-5) |
|---|---|---|
| Hosting model | On-premises / colocation / single cloud / multi-cloud | |
| Infrastructure as Code | Manual provisioning → fully automated IaC (Terraform, Pulumi) | |
| Environment parity | Dev/staging/prod consistency and isolation | |
| Disaster recovery | RPO/RTO targets, tested failover procedures | |
| Cost management | Tagging, reserved instances, right-sizing, FinOps practices | |
| Networking | VPC design, CDN, DNS, load balancing, edge strategy | |
| Monitoring | Infrastructure monitoring coverage and alerting | |

**Cloud Spend Analysis:**
- Monthly cloud spend trend (12 months): growth rate vs. revenue growth rate
- Top 10 cost drivers by service
- Reserved/committed vs. on-demand spend ratio
- Projected spend at 2x and 5x current load

**Cloud Readiness Score** (if on-premises):

| Factor | Weight | Score (1-5) | Weighted |
|---|---|---|---|
| Application cloud-native readiness | 25% | | |
| Data migration complexity | 20% | | |
| Regulatory/compliance constraints | 15% | | |
| Network dependency on physical location | 15% | | |
| Team cloud skills | 15% | | |
| Third-party integration portability | 10% | | |
| **Total** | **100%** | | **/5.0** |

### 3. Application Architecture Assessment

Evaluate architecture patterns, fitness, and modernization needs.

**Architecture Pattern Classification:**

| Pattern | Strengths | Risks to Assess |
|---|---|---|
| **Monolith** | Simple deployment, data consistency | Scaling limits, deployment coupling, team bottlenecks |
| **Modular Monolith** | Bounded contexts, simpler ops than microservices | Module coupling integrity, migration readiness |
| **Microservices** | Independent scaling/deployment, team autonomy | Distributed complexity, data consistency, operational overhead |
| **Serverless** | Auto-scaling, no server management | Vendor lock-in, cold starts, observability gaps |
| **Hybrid** | Pragmatic evolution | Inconsistent patterns, integration complexity |

**Architecture Quality Scorecard (the "-ilities"):**

| Dimension | Assessment Criteria | Score (1-5) | Evidence |
|---|---|---|---|
| **Scalability** | Horizontal scaling capability, statelessness, async processing | | |
| **Reliability** | Fault tolerance, graceful degradation, chaos engineering readiness | | |
| **Maintainability** | Code modularity, documentation, onboarding time for new devs | | |
| **Security** | Defense in depth, secure defaults, input validation, encryption | | |
| **Observability** | Logging, metrics, tracing, alerting coverage | | |
| **Performance** | Response times, throughput, resource efficiency | | |
| **Extensibility** | Plugin/API extensibility, configuration flexibility | | |

**Scalability Stress Analysis:**

| Metric | Current State | 2x Load | 5x Load | 10x Load | Bottleneck |
|---|---|---|---|---|---|
| Requests/sec | | | | | |
| Database connections | | | | | |
| Storage growth/month | | | | | |
| Concurrent users | | | | | |
| Data processing volume | | | | | |

### 4. Code Quality and Technical Debt Quantification

**Code Analysis Metrics:**

| Metric | Target | Actual | Assessment |
|---|---|---|---|
| Test coverage (unit) | >70% | | |
| Test coverage (integration) | >40% | | |
| Cyclomatic complexity (avg) | <10 | | |
| Code duplication | <5% | | |
| Dependency freshness | <6 months behind | | |
| Known vulnerability count (CVEs) | 0 critical, 0 high | | |
| Documentation coverage | >60% public APIs | | |
| Build time | <10 minutes | | |
| Deployment frequency | Daily or better | | |

**Technical Debt Classification:**

| Category | Description | Quantification Method |
|---|---|---|
| **Deliberate-Prudent** | Conscious trade-offs with documented rationale | Estimated remediation cost |
| **Deliberate-Reckless** | Known shortcuts without justification | Estimated remediation cost + ongoing cost of delay |
| **Accidental-Prudent** | Better approach discovered after implementation | Migration effort estimate |
| **Accidental-Reckless** | Poor practices due to lack of knowledge | Rewrite effort estimate |

**Technical Debt Quantification Formula:**

```
Total Tech Debt Cost = Sum of (Remediation Effort in person-months x Loaded Cost per person-month)
Tech Debt Ratio = Tech Debt Cost / Total Codebase Rewrite Cost
```

- Tech Debt Ratio < 5%: Healthy
- Tech Debt Ratio 5-15%: Manageable with dedicated allocation
- Tech Debt Ratio 15-30%: Significant; requires remediation roadmap
- Tech Debt Ratio > 30%: Potential deal breaker; may warrant rewrite assessment

**Dependency Risk Assessment:**
- Count of direct and transitive dependencies
- Licenses: copyleft (GPL) vs. permissive (MIT, Apache) -- flag copyleft in commercial products
- Abandoned dependencies (no commits in 12+ months)
- Single-maintainer critical dependencies
- Known CVEs by severity

### 5. Security Posture Review

**Security Assessment Matrix:**

| Domain | Key Controls | Status | Finding Severity |
|---|---|---|---|
| **Authentication** | MFA, SSO, password policy, session management | | |
| **Authorization** | RBAC/ABAC, least privilege, segregation of duties | | |
| **Data Protection** | Encryption at rest and in transit, key management | | |
| **Network Security** | Firewall rules, segmentation, DDoS protection | | |
| **Application Security** | OWASP Top 10, SAST/DAST in CI, dependency scanning | | |
| **Compliance** | SOC 2, ISO 27001, GDPR, HIPAA, PCI-DSS (as applicable) | | |
| **Incident Response** | IR plan, breach notification, forensic capability | | |
| **Access Management** | Provisioning/deprovisioning, access reviews, privileged access | | |
| **Vulnerability Management** | Scanning cadence, patching SLAs, remediation tracking | | |
| **Breach History** | Past incidents, root causes, remediation completeness | | |

**Compliance Gap Analysis:**
For each applicable regulation, document:
- Current compliance status (compliant / partial / non-compliant)
- Gap description
- Remediation effort estimate
- Timeline to compliance
- Cost estimate

### 6. Development Team and Process Assessment

**Team Composition Analysis:**

| Role | Headcount | Avg Tenure | Key Person Risk | Replacement Difficulty |
|---|---|---|---|---|
| Engineering leadership | | | | |
| Backend engineers | | | | |
| Frontend engineers | | | | |
| DevOps/SRE | | | | |
| Data engineers | | | | |
| QA/Test engineers | | | | |
| Security engineers | | | | |

**Bus Factor Analysis:**
- Identify components/systems with single-person knowledge
- Score: 1 = single person, 2 = two people, 3+ = adequate coverage
- Any component with bus factor of 1 = Significant Risk finding

**DevOps Maturity Assessment (1-5 scale):**

| Practice | Level 1: Ad Hoc | Level 3: Defined | Level 5: Optimizing | Current |
|---|---|---|---|---|
| Version control | Some code in VCS | All code in VCS, branching strategy | Trunk-based, feature flags | |
| CI/CD | Manual builds | Automated build and test | Full CD, canary/blue-green | |
| Testing | Manual only | Automated unit + integration | Full pyramid, chaos engineering | |
| Monitoring | Basic uptime checks | APM, log aggregation | Full observability, AIOps | |
| Incident response | Ad hoc firefighting | Runbooks, on-call rotation | Automated remediation, SLOs | |
| Infrastructure | Manual provisioning | IaC for most resources | GitOps, immutable infrastructure | |
| Security | Periodic audits | SAST/DAST in pipeline | Shift-left, continuous compliance | |

### 7. IP and Proprietary Technology Evaluation

**IP Portfolio Assessment:**

| IP Asset | Type | Protection Status | Competitive Advantage | Risk |
|---|---|---|---|---|
| | Patent / Trade Secret / Copyright | Filed / Granted / Pending | High / Medium / Low | |

**Open-Source Exposure Analysis:**
- Copyleft dependencies in proprietary code (GPL, AGPL, LGPL risk)
- Contribution agreements (CLA) in place for OSS contributions
- Open-source components in core differentiating technology
- License compliance tooling in CI/CD pipeline

### 8. Integration Complexity Analysis

**Integration Assessment with Acquirer Stack:**

| Integration Domain | Target Stack | Acquirer Stack | Compatibility | Migration Effort |
|---|---|---|---|---|
| Cloud platform | | | | |
| Programming languages | | | | |
| Databases | | | | |
| Authentication/Identity | | | | |
| CI/CD tooling | | | | |
| Monitoring/Observability | | | | |
| Communication/Collaboration | | | | |
| Data platforms | | | | |

**Integration Effort Estimate:**

| Phase | Duration | Team Size | Cost Range | Dependency |
|---|---|---|---|---|
| Assessment & Planning | 4-6 weeks | 3-5 | | None |
| Quick wins (identity, comms) | 6-8 weeks | 4-6 | | Planning complete |
| Core integration | 3-6 months | 8-15 | | Quick wins complete |
| Full harmonization | 6-18 months | 10-20 | | Core complete |

### 9. Technology Investment Requirements (18-Month Post-Close)

**Investment Categories:**

| Category | Estimated Investment | Priority | Timeline | Rationale |
|---|---|---|---|---|
| Technical debt remediation | | | | |
| Security hardening | | | | |
| Infrastructure modernization | | | | |
| Integration costs | | | | |
| Team augmentation/retention | | | | |
| Tooling and licensing | | | | |
| Architecture evolution | | | | |
| **Total 18-Month Estimate** | | | | |

### 10. Finding Classification and Synthesis

Classify every finding using the technology DD severity matrix:

| Severity | Definition | Examples | Valuation Impact |
|---|---|---|---|
| **Deal Breaker** | Fundamentally undermines the technology value proposition or creates unacceptable risk | Undisclosed data breach, no IP ownership, critical unfixable architecture flaw, key-person departure imminent | Walk away or fundamental restructure |
| **Significant Risk** | Material issue requiring investment or restructuring; impacts valuation | Tech debt ratio >25%, single cloud region with no DR, bus factor of 1 on core platform, compliance gaps | Price adjustment $X-Y range |
| **Manageable** | Known issue with clear remediation path and bounded cost | Outdated dependencies, incomplete test coverage, documentation gaps, minor compliance items | Factor into integration budget |
| **Non-Issue** | Observed but not material; standard for stage/industry | Normal tech debt levels, common architectural patterns, standard tooling gaps | No impact |

## Output Template

```markdown
# Technology Due Diligence Report: [Target Company]

**Prepared for**: [Acquirer] | **Date**: [Date] | **Confidentiality**: Strictly Confidential

## Executive Summary

**Overall Technology Risk Rating**: [Deal Breaker / Significant Risk / Manageable / Non-Issue]

**Technology Maturity Level**: [1-5] - [Ad Hoc / Managed / Defined / Quantified / Optimizing]

[3-5 sentence summary of the technology estate, key strengths, and critical concerns.]

### Finding Summary
| Severity | Count | Key Items |
|---|---|---|
| Deal Breaker | X | [Brief descriptions] |
| Significant Risk | X | [Brief descriptions] |
| Manageable | X | [Brief descriptions] |
| Non-Issue | X | -- |

### Estimated Post-Close Technology Investment: $[X]M - $[Y]M (18 months)

## 1. Infrastructure Assessment
**Maturity Level**: [1-5]
[Findings with severity classification]

## 2. Application Architecture Assessment
**Architecture Pattern**: [Monolith / Microservices / Serverless / Hybrid]
**Architecture Quality Score**: [X]/5.0
[Findings with severity classification]

## 3. Code Quality & Technical Debt
**Test Coverage**: [X]% | **Tech Debt Ratio**: [X]%
[Findings with severity classification]

## 4. Security Posture
**Compliance Status**: [Certifications held and gaps]
[Findings with severity classification]

## 5. Development Team & Processes
**Team Size**: [X] | **DevOps Maturity**: [1-5]
**Critical Bus Factor Risks**: [Components with bus factor = 1]
[Findings with severity classification]

## 6. IP & Proprietary Technology
**Patent Portfolio**: [X patents filed/granted]
**Open-Source Risk**: [Low / Medium / High]
[Findings with severity classification]

## 7. Integration Complexity
**Overall Integration Effort**: [Low / Medium / High / Very High]
**Estimated Timeline**: [X] months to full harmonization
[Integration roadmap and cost estimates]

## 8. Technology Investment Requirements (18-Month Post-Close)
| Category | Low Estimate | High Estimate | Priority |
|---|---|---|---|
| [Category] | $[X] | $[Y] | [Critical/High/Medium] |
| **Total** | **$[X]M** | **$[Y]M** | |

## Detailed Findings Register

| # | Finding | Workstream | Severity | Remediation | Est. Cost | Timeline |
|---|---|---|---|---|---|---|
| 1 | [Description] | [Area] | [Severity] | [Action] | $[X] | [Weeks] |

## Recommendations

### Proceed with Transaction (Conditions)
1. [Condition 1 with rationale]
2. [Condition 2 with rationale]

### Price Adjustment Considerations
- [Item]: $[X]-$[Y] adjustment basis

### Integration Planning Priorities (First 90 Days)
1. [Priority action]
2. [Priority action]
3. [Priority action]
```

## Quality Checks

- [ ] All seven workstreams assessed with evidence-based findings.
- [ ] Every finding classified as Deal Breaker / Significant Risk / Manageable / Non-Issue.
- [ ] Technology maturity level (1-5) assigned with supporting evidence per workstream.
- [ ] Architecture "-ilities" scored individually with justification.
- [ ] Technical debt quantified in dollar terms (range, not point estimate).
- [ ] Security posture reviewed against applicable compliance frameworks.
- [ ] Bus factor identified for all critical components.
- [ ] Integration complexity assessed against acquirer's specific tech stack.
- [ ] 18-month investment estimate provided as a range with breakdown.
- [ ] Executive summary can stand alone for deal team decision-making.
- [ ] Scalability assessed at 2x, 5x, and 10x current load.
- [ ] Open-source license risks flagged (copyleft in commercial code).
- [ ] Cloud readiness scored if on-premises migration is anticipated.
- [ ] All cost estimates carry confidence levels (High/Medium/Low).