When companies buy software businesses, financial statements can sometimes tell only part of the story. Sure, you've got the revenues, margins and liabilities, but what of the technology itself? Software due diligence has long been part of tech transactions, particularly when software represents a significant share of a company's value.
But the questions buyers need to answer are expanding especially as artificial intelligence becomes part of software development, including coding. The technology can contain licensing issues, security vulnerabilities and what is known as technical debt—the future cost of extra work caused by choosing short-term fixes or shortcuts over optimal, long-term solutions— that may affect how a deal is executed after completion. Buyers need to establish not only what technology they are acquiring, but how it was developed and whether it can support the assumptions behind the deal.
"We're also seeing this from the other side of the transaction. Startups are more frequently requesting software audits before an acquirer approaches them, so they can validate that their IP is defensible and address potential issues before diligence begins," said Aaron Branson, chief growth officer at software audit firm FossID. "That’s a strong indication of how important code provenance, particularly in the context of AI-assisted development, has become in M&A [Mergers and Acquisitions]." Black Duck, a software security company that provides tools for analyzing open-source software and assessing technology risk, describes software due diligence as a way for buyers to identify legal, security and operational risks before a transaction closes.
Black Duck's 2026 M&A research found open-source software in 98 percent of the software it audited and in 100 percent of the M&A transactions represented in its research. License conflicts were found in 94 percent of transactions, while 97 percent contained unpatched vulnerabilities. The figures come from Black Duck's own audits and are not representative of every technology acquisition.
Nevertheless, the findings illustrate the range of issues buyers can encounter when examining the technology behind a software business. Joris Limousin, founder of tech due diligence firm DueDelta, said investors are increasingly focused on what technical findings mean for the investment itself. That assessment can cover architecture, security, technical debt, engineering teams and third-party components.
Limousin said the significance of a finding can vary depending on the company's product, operating model and size or maturity. Artificial intelligence adds another layer of complexity to this evaluation. Buyers may need to establish how AI tools are governed, what information has been shared with external models and whether generated code has gone through the same review, testing and security controls as other software.
Extract — continue reading at the source.
