Global Private Equity Report

Is Your Tech Due Diligence Good Enough?

The buyout world is dominated by technology deals, but due diligence is still catching up at many firms.

By Hank Chen, Jonny Holliday, and Robert Pierce

First published on marzo 07, 2022
min read


At a Glance Technology deals represent 31% of all buyouts—and a much higher percentage if you count deals where tech is central to value creation. Yet only a small percentage of buyers perform due diligence aimed at underwriting tech-specific risks and opportunities. The firms getting it right ensure that tech diligence is thesis driven, integrated closely with commercial diligence, and tied directly to the value-creation plan. This article is part of Bain’s 2022 Global Private Equity Report Explore the report It seemed like a slam dunk. That was the initial impression when a large private equity firm began its commercial due diligence of a fintech market leader recently. The target controlled almost half of its addressable market, was growing at 15% annually, and had net margins in the 17% range. The deal team was so impressed with the company, in fact, that it was setting up to bid a premium. Then the tech diligence report arrived. It turned out that the target’s leaky security protocols had led to a recent ransomware attack and a breach of most of the company’s customer contracts. The target was also leasing services on outdated tech infrastructure that was being discontinued within a year, raising critical questions about its ability to continue delivering results. What seemed like a sure winner suddenly appeared toxic. The buyers walked away, feeling fortunate they had dodged a bullet. The potential for technology to make or break a deal in private equity has never been greater than it is today. As digital disruption transforms industries across the global economy, it’s fair to say that almost any company is a tech company in one way or another. Yet too many private equity investors still view technology due diligence as a check-the-box exercise or fail to integrate it into a holistic effort to assess risk and underwrite value. While Bain & Company research shows that buyout firms almost always perform comprehensive tech due diligence for deals involving pure-play software companies, those deals represent less than 15% of the overall market. For buyouts generally, the rate is closer to 9%, despite the fact that 31% of all buyouts last year involved technology companies and a much larger percentage targeted nontech companies for which technology is a central part of the value proposition (see Figures 1 and 2). Indeed, PitchBook data shows that deals for these tech-enabled companies have tripled over the past five years. Figure 1 After a decade of steady growth, deals for pure-play technology companies now comprise 31% of all buyouts Figure 2 Buyouts of tech-enabled businesses have tripled over the past five years The sponsors getting tech due diligence right recognize that, when it comes to underwriting technology’s impact on risk and opportunity, what sufficed even a few years ago is no longer adequate. Just as the tech function itself has moved out of the back room to become a strategic centerpiece for many companies, the most effective way to evaluate a target’s technology capability has had to evolve as well. It used to be that tech due diligence meant bringing a trusted CTO along on a standard diligence assignment to kick the tires in the server room and verify that the enterprise resource planning and accounting systems weren’t a liability. Today it requires understanding how technology is being used throughout the company to improve performance and mitigate risk. Raising the bar Technology very often determines the competitiveness of a company’s business model. It can be central to product offerings and how they are brought to market—from supply chain to sales strategy. Most companies would be sitting ducks today if they didn’t know how to use data and analytics to improve interactions with customers or understand more about their behavior. They would be vulnerable to cyberattack if they weren’t marshaling the right tools to protect themselves and their customers. Strong tech due diligence encompasses six broad areas of a business: product evaluation and roadmap, technology and architecture, cybersecurity, data and analytics, organization and processes, and technology benchmarking (see Figure 3). Any or all of these may come into play depending on the deal and industry, and the right priority areas ultimately will depend on what the investor intends to do with the asset. But the kind of tech due diligence that leads to the most informed investment decisions has several key characteristics. It is closely tied to the deal thesis. While the average tech diligence today is less perfunctory than it used to be, that doesn’t guarantee it is focused on the right set of questions. Investors often complain that the tech report they get back from the diligence team is a list of observations, not a set of contextual insights. It is often brimming with tech jargon that may or may not be relevant to the deal thesis or investment decision. Strong tech diligence has to be tied to the deal thesis from the outset; it is no different from commercial diligence in this respect. While the average tech diligence today is less perfunctory than it used to be, that doesn’t guarantee it is focused on the right set of questions. The first question, then, is: How do we expect to create value at this target company? The next: Is the right technology in place to enable our thesis, and, if not, will the cost of building new capabilities or expertise deliver on the required investment? Consider a deal to combine two healthcare information companies that provide credentialing services to hospitals and pharmacies. The pair served similar types of customers but across different geographies, and the deal team was betting that merging them would create a larger, more efficient competitor with stronger overall technology and services. The biggest technological challenge for both companies was collecting, translating, and cleaning up data from multiple sources. Yet they appeared to have complementary strengths. Company A had developed the best process for ingesting data, while Company B seemed to have the better overall technology for delivering services. The investment thesis was to migrate the data ingestion process from A to B and to otherwise standardize B’s technology platforms. A thesis-driven approach to the tech due diligence effort, however, provided some surprising insights. Company B did, in fact, have the best customer-facing services. But they were built on top of an aging, duplicative set of platforms. The overall architecture lacked a single source of truth, and the code was bloated, with tens of thousands of stored procedures and more than 10 million lines of code across seven platforms. Company A, on the other hand, had already migrated much of its back-end technology to the cloud and had built a modern, secure architecture supported by strong software development processes. The findings turned the deal thesis on its head—and in a good way. Instead of migrating data ingestion from A to B, the deal team saw significantly more value in moving Company B’s superior front-end services to A and decommissioning B’s platforms. It is integrated with commercial due diligence. For top-tier firms, tech due diligence never stands on its own. Not only is it linked explicitly to the deal thesis, but it is also integrated with the broader due diligence effort. This improves communication and gives deal teams the clearest possible view of the critical interdependencies between strategy, finance, operations, and enabling technology. Rather than simply asking how much it will cost, the inquiry becomes “What specific doors will this SaaS strategy open for us commercially, and is that realistic given our time frame and objectives?” Questions like these were critical when a private equity firm recently assessed a business process outsourcing company that provided human resource management services. Already a strong competitor, the target had built a platform between large companies and their benefit providers to help employees directly manage their health plans, 401(k)s, and other benefits via an 800 number, online, or through their mobile devices. The platform was strong enough, but management believed the future lay in cutting back on human interaction—and improving service—by strategically deploying artificial intelligence (AI) and machine learning. The plan was to optimize a virtual assistant system that was smart enough to reliably help employees navigate their benefit plans without sending them down too many dead ends. Evaluating the AI system’s potential was at the heart of the tech diligence effort. That involved bringing in an expert with a proprietary framework for analyzing the impact and maturity of the AI capability, to determine if it could deliver what the company said it could. The team evaluated the company’s technology stack, its intellectual property, its data scientists, and other aspects of the system. The conclusion: The company was well on its way to building a differentiated capability. An insight like that is important on its own in terms of mitigating risk. But by integrating the accumulated knowledge of the tech due diligence into the broader evaluation of the company’s prospects, it becomes much more. It allows the deal team to assess more precisely what the technology makes possible in the marketplace. Is the AI good enough to represent an imposing barrier to entry to other competitors? Would it allow the company to price more aggressively and grow faster than the rest of the market? Answers to these questions feed into the financing model, giving the team much greater confidence in its cash flow projections and coverage assumptions. By creating a single, unified set of insights, rather than a collection of distinct reports, integrated due diligence generates the quickest and most ironclad answer to the ultimate question: Do we want to buy this company or don’t we? By creating a single, unified set of insights, integrated due diligence generates the most ironclad answer to the ultimate question: Do we want to buy this company or not? It flows into the value-creation plan. Integrated due diligence should also provide foundational insights as PE investors shift into value-creation mode. But it doesn’t always happen that way. General partners often find that the learning accumulated during the diligence process gets lost or diluted as the firm takes ownership. This is a vestige of the old check-the-box system, where tech due diligence, if it happened at all, was largely defensive. Once the transaction closed, the deal team would throw the diligence reports over the wall to a team run by the operating partner. They typically would be filed away under “good hygiene” rather than directly informing the emerging value-creation plan. As tech due diligence becomes a central element of formulating investment strategy, however, top-tier investors view it as the first round in a continuous cycle of learning that extends throughout the ownership period and helps develop the most compelling exit story. 31 of all buyouts now involve pure-play technology companies When one private equity firm invested more than $2 billion to carve out a developer of operating system software from a much larger company, a key challenge was evaluating how the target could revamp its R&D process. The new owners had very ambitious goals for revenue and earnings growth, and they suspected they would have to both sharpen and accelerate product development to get there. After performing the initial due diligence for the deal, an external team of technical experts embarked on a set of diagnostic interviews in the field that led to specific recommendations for improving R&D efficiency as part of the value-creation plan. But it also led to something else: a frank conversation with management and the board, explaining that the existing product roadmap—no matter how quickly it was implemented—would never allow the company to reach its targets organically. The tech team saw a clear path to success, but it involved acquiring new products and capabilities that would allow the company to compete at a higher level—something the deal team hadn’t counted on. This transformed the value-creation plan into an M&A strategy. Over the next several years, the tech team shifted back into diligence mode and helped the sponsor vet several add-on deals that would extend the company into next-gen IT services. The result: It now offers a complete stack of solutions that compete effectively against industry stalwarts like IBM and VMware. That led to a strong IPO exit, giving the private equity owner the return it had hoped for. The emerging imperative Even for a native tech company, questions of what’s possible technologically and within what time frame aren’t easy to answer. But they are part of business as usual. This is hardly the case for companies in traditional industries or for the industry-focused deal teams seeking to understand their prospects. As value creation becomes increasingly wrapped up in how a company deploys digital technology to improve operations, sharpen product development, or deepen relationships with customers, an integrated, thesis-driven approach to due diligence is especially critical. More often than not, this inquiry focuses on data and cybersecurity. It’s hard to imagine a more prosaic, analog industry than self-storage. Most storage outlets are mom-and-pop businesses where the technology infrastructure consists of a desktop PC with Excel installed. Yet, like any number of traditional sectors, storage is rapidly digitalizing. And that teed up a private equity process for a company that was pursuing a radical shift in how storage outlets manage their businesses. The company was using acquisitions to build an online platform that provided two kinds of capability: a marketplace for storage vacancies that outlets could plug into, and a self-service portal for storage customers to manage their rental units. From a market perspective, this was a powerful idea with lots of momentum. But it also presented a question that private equity investors encounter all the time: Is this push into a transformative new technology scalable and secure? The challenge in this case was that the company had acquired a number of smaller vendors that had to be set up on a single platform. Data, including sensitive customer information, had to be cleaned up and migrated from local systems to a cloud-based architecture. The target was very entrepreneurial and had quickly developed a solution that worked for a company of a given size. But the diligence had to establish whether the new cloud architecture could smoothly scale and whether cybersecurity systems were in place to protect a much larger system—the kind hackers love. The transformation of regular businesses into tech-enabled businesses has become commonplace across the global economy. This is creating vibrant opportunities for buyout firms, but it is also presenting new and unfamiliar risks. For any deal in which technology and software may be key to driving value (more and more will qualify), general partners need to ask several questions: How much does the asset’s underlying technology platform play into value creation, both now and in the future? Are we investing in technology due diligence that is proportionate to the perceived value? Do we have the experience—or know where to get it—to truly understand the technological nuances in this particular space and to develop unique insights? Is our tech diligence integrated with the broader commercial and financial due diligence effort, so the insights and recommended actions are consistent with where the value lies? Are these insights flowing directly into the value-creation plan to jump-start delivery on the investment thesis post-acquisition? Top-tier firms are finding that these issues are critical to evaluating companies in an economy defined by digital disruption. They are at the heart of a rigorous approach to tech due diligence that is thesis driven, tightly integrated with the broader diligence effort, and a critical source of insight during ownership. Read the Next Section Private Equity’s Inflation Challenge More from the report Letter from Hugh MacArthur: A Year for the Record Books The Private Equity Market in 2021: The Allure of Growth Chasing Disruption: The Brave New World of Growth Investing How Private Equity Keeps Winning in Software Raising Sector Strategy to the Next Level Is Your Tech Due Diligence Good Enough? Private Equity’s Inflation Challenge Read our 2022 Global Private Equity Report Explore the full report Download the PDF

At a Glance

Technology deals represent 31% of all buyouts—and a much higher percentage if you count deals where tech is central to value creation.
Yet only a small percentage of buyers perform due diligence aimed at underwriting tech-specific risks and opportunities.
The firms getting it right ensure that tech diligence is thesis driven, integrated closely with commercial diligence, and tied directly to the value-creation plan.

It seemed like a slam dunk.

That was the initial impression when a large private equity firm began its commercial due diligence of a fintech market leader recently. The target controlled almost half of its addressable market, was growing at 15% annually, and had net margins in the 17% range. The deal team was so impressed with the company, in fact, that it was setting up to bid a premium.

Then the tech diligence report arrived. It turned out that the target’s leaky security protocols had led to a recent ransomware attack and a breach of most of the company’s customer contracts. The target was also leasing services on outdated tech infrastructure that was being discontinued within a year, raising critical questions about its ability to continue delivering results. What seemed like a sure winner suddenly appeared toxic. The buyers walked away, feeling fortunate they had dodged a bullet.

The potential for technology to make or break a deal in private equity has never been greater than it is today. As digital disruption transforms industries across the global economy, it’s fair to say that almost any company is a tech company in one way or another.

Yet too many private equity investors still view technology due diligence as a check-the-box exercise or fail to integrate it into a holistic effort to assess risk and underwrite value. While Bain & Company research shows that buyout firms almost always perform comprehensive tech due diligence for deals involving pure-play software companies, those deals represent less than 15% of the overall market. For buyouts generally, the rate is closer to 9%, despite the fact that 31% of all buyouts last year involved technology companies and a much larger percentage targeted nontech companies for which technology is a central part of the value proposition (see Figures 1 and 2). Indeed, PitchBook data shows that deals for these tech-enabled companies have tripled over the past five years.

After a decade of steady growth, deals for pure-play technology companies now comprise 31% of all buyouts

Buyouts of tech-enabled businesses have tripled over the past five years

The sponsors getting tech due diligence right recognize that, when it comes to underwriting technology’s impact on risk and opportunity, what sufficed even a few years ago is no longer adequate. Just as the tech function itself has moved out of the back room to become a strategic centerpiece for many companies, the most effective way to evaluate a target’s technology capability has had to evolve as well.

It used to be that tech due diligence meant bringing a trusted CTO along on a standard diligence assignment to kick the tires in the server room and verify that the enterprise resource planning and accounting systems weren’t a liability. Today it requires understanding how technology is being used throughout the company to improve performance and mitigate risk.

Raising the bar

Technology very often determines the competitiveness of a company’s business model. It can be central to product offerings and how they are brought to market—from supply chain to sales strategy. Most companies would be sitting ducks today if they didn’t know how to use data and analytics to improve interactions with customers or understand more about their behavior. They would be vulnerable to cyberattack if they weren’t marshaling the right tools to protect themselves and their customers.

Strong tech due diligence encompasses six broad areas of a business: product evaluation and roadmap, technology and architecture, cybersecurity, data and analytics, organization and processes, and technology benchmarking (see Figure 3).

Any or all of these may come into play depending on the deal and industry, and the right priority areas ultimately will depend on what the investor intends to do with the asset. But the kind of tech due diligence that leads to the most informed investment decisions has several key characteristics.

It is closely tied to the deal thesis. While the average tech diligence today is less perfunctory than it used to be, that doesn’t guarantee it is focused on the right set of questions. Investors often complain that the tech report they get back from the diligence team is a list of observations, not a set of contextual insights. It is often brimming with tech jargon that may or may not be relevant to the deal thesis or investment decision. Strong tech diligence has to be tied to the deal thesis from the outset; it is no different from commercial diligence in this respect.

While the average tech diligence today is less perfunctory than it used to be, that doesn’t guarantee it is focused on the right set of questions.

The first question, then, is: How do we expect to create value at this target company? The next: Is the right technology in place to enable our thesis, and, if not, will the cost of building new capabilities or expertise deliver on the required investment?

Consider a deal to combine two healthcare information companies that provide credentialing services to hospitals and pharmacies. The pair served similar types of customers but across different geographies, and the deal team was betting that merging them would create a larger, more efficient competitor with stronger overall technology and services.

The biggest technological challenge for both companies was collecting, translating, and cleaning up data from multiple sources. Yet they appeared to have complementary strengths. Company A had developed the best process for ingesting data, while Company B seemed to have the better overall technology for delivering services. The investment thesis was to migrate the data ingestion process from A to B and to otherwise standardize B’s technology platforms.

A thesis-driven approach to the tech due diligence effort, however, provided some surprising insights. Company B did, in fact, have the best customer-facing services. But they were built on top of an aging, duplicative set of platforms. The overall architecture lacked a single source of truth, and the code was bloated, with tens of thousands of stored procedures and more than 10 million lines of code across seven platforms. Company A, on the other hand, had already migrated much of its back-end technology to the cloud and had built a modern, secure architecture supported by strong software development processes.

The findings turned the deal thesis on its head—and in a good way. Instead of migrating data ingestion from A to B, the deal team saw significantly more value in moving Company B’s superior front-end services to A and decommissioning B’s platforms.

It is integrated with commercial due diligence. For top-tier firms, tech due diligence never stands on its own. Not only is it linked explicitly to the deal thesis, but it is also integrated with the broader due diligence effort. This improves communication and gives deal teams the clearest possible view of the critical interdependencies between strategy, finance, operations, and enabling technology. Rather than simply asking how much it will cost, the inquiry becomes “What specific doors will this SaaS strategy open for us commercially, and is that realistic given our time frame and objectives?”

Questions like these were critical when a private equity firm recently assessed a business process outsourcing company that provided human resource management services. Already a strong competitor, the target had built a platform between large companies and their benefit providers to help employees directly manage their health plans, 401(k)s, and other benefits via an 800 number, online, or through their mobile devices. The platform was strong enough, but management believed the future lay in cutting back on human interaction—and improving service—by strategically deploying artificial intelligence (AI) and machine learning. The plan was to optimize a virtual assistant system that was smart enough to reliably help employees navigate their benefit plans without sending them down too many dead ends.

Evaluating the AI system’s potential was at the heart of the tech diligence effort. That involved bringing in an expert with a proprietary framework for analyzing the impact and maturity of the AI capability, to determine if it could deliver what the company said it could. The team evaluated the company’s technology stack, its intellectual property, its data scientists, and other aspects of the system. The conclusion: The company was well on its way to building a differentiated capability.

An insight like that is important on its own in terms of mitigating risk. But by integrating the accumulated knowledge of the tech due diligence into the broader evaluation of the company’s prospects, it becomes much more. It allows the deal team to assess more precisely what the technology makes possible in the marketplace. Is the AI good enough to represent an imposing barrier to entry to other competitors? Would it allow the company to price more aggressively and grow faster than the rest of the market?

Answers to these questions feed into the financing model, giving the team much greater confidence in its cash flow projections and coverage assumptions. By creating a single, unified set of insights, rather than a collection of distinct reports, integrated due diligence generates the quickest and most ironclad answer to the ultimate question: Do we want to buy this company or don’t we?

By creating a single, unified set of insights, integrated due diligence generates the most ironclad answer to the ultimate question: Do we want to buy this company or not?

It flows into the value-creation plan. Integrated due diligence should also provide foundational insights as PE investors shift into value-creation mode. But it doesn’t always happen that way. General partners often find that the learning accumulated during the diligence process gets lost or diluted as the firm takes ownership.

This is a vestige of the old check-the-box system, where tech due diligence, if it happened at all, was largely defensive. Once the transaction closed, the deal team would throw the diligence reports over the wall to a team run by the operating partner. They typically would be filed away under “good hygiene” rather than directly informing the emerging value-creation plan. As tech due diligence becomes a central element of formulating investment strategy, however, top-tier investors view it as the first round in a continuous cycle of learning that extends throughout the ownership period and helps develop the most compelling exit story.

of all buyouts now involve pure-play technology companies

When one private equity firm invested more than $2 billion to carve out a developer of operating system software from a much larger company, a key challenge was evaluating how the target could revamp its R&D process. The new owners had very ambitious goals for revenue and earnings growth, and they suspected they would have to both sharpen and accelerate product development to get there.

After performing the initial due diligence for the deal, an external team of technical experts embarked on a set of diagnostic interviews in the field that led to specific recommendations for improving R&D efficiency as part of the value-creation plan. But it also led to something else: a frank conversation with management and the board, explaining that the existing product roadmap—no matter how quickly it was implemented—would never allow the company to reach its targets organically. The tech team saw a clear path to success, but it involved acquiring new products and capabilities that would allow the company to compete at a higher level—something the deal team hadn’t counted on.

This transformed the value-creation plan into an M&A strategy. Over the next several years, the tech team shifted back into diligence mode and helped the sponsor vet several add-on deals that would extend the company into next-gen IT services. The result: It now offers a complete stack of solutions that compete effectively against industry stalwarts like IBM and VMware. That led to a strong IPO exit, giving the private equity owner the return it had hoped for.

The emerging imperative

Even for a native tech company, questions of what’s possible technologically and within what time frame aren’t easy to answer. But they are part of business as usual. This is hardly the case for companies in traditional industries or for the industry-focused deal teams seeking to understand their prospects. As value creation becomes increasingly wrapped up in how a company deploys digital technology to improve operations, sharpen product development, or deepen relationships with customers, an integrated, thesis-driven approach to due diligence is especially critical. More often than not, this inquiry focuses on data and cybersecurity.

It’s hard to imagine a more prosaic, analog industry than self-storage. Most storage outlets are mom-and-pop businesses where the technology infrastructure consists of a desktop PC with Excel installed. Yet, like any number of traditional sectors, storage is rapidly digitalizing. And that teed up a private equity process for a company that was pursuing a radical shift in how storage outlets manage their businesses.

The company was using acquisitions to build an online platform that provided two kinds of capability: a marketplace for storage vacancies that outlets could plug into, and a self-service portal for storage customers to manage their rental units. From a market perspective, this was a powerful idea with lots of momentum. But it also presented a question that private equity investors encounter all the time: Is this push into a transformative new technology scalable and secure?

The challenge in this case was that the company had acquired a number of smaller vendors that had to be set up on a single platform. Data, including sensitive customer information, had to be cleaned up and migrated from local systems to a cloud-based architecture. The target was very entrepreneurial and had quickly developed a solution that worked for a company of a given size. But the diligence had to establish whether the new cloud architecture could smoothly scale and whether cybersecurity systems were in place to protect a much larger system—the kind hackers love.

The transformation of regular businesses into tech-enabled businesses has become commonplace across the global economy. This is creating vibrant opportunities for buyout firms, but it is also presenting new and unfamiliar risks. For any deal in which technology and software may be key to driving value (more and more will qualify), general partners need to ask several questions:

How much does the asset’s underlying technology platform play into value creation, both now and in the future?
Are we investing in technology due diligence that is proportionate to the perceived value?
Do we have the experience—or know where to get it—to truly understand the technological nuances in this particular space and to develop unique insights?
Is our tech diligence integrated with the broader commercial and financial due diligence effort, so the insights and recommended actions are consistent with where the value lies?
Are these insights flowing directly into the value-creation plan to jump-start delivery on the investment thesis post-acquisition?

Top-tier firms are finding that these issues are critical to evaluating companies in an economy defined by digital disruption. They are at the heart of a rigorous approach to tech due diligence that is thesis driven, tightly integrated with the broader diligence effort, and a critical source of insight during ownership.

Read the Next Section

Private Equity’s Inflation Challenge