SOFTWARE DUE DILIGENCE

Know What You Are Buying

When you acquire or invest in a software company, much of what you pay for is its software. From the outside, that software is hard to judge: demos, architecture diagrams, and management’s answers show the product as the company sees it. A serious vulnerability, or a security design that does not hold up, can mean a breach after closing, a rebuild of core parts of the product, and customers who lose trust. We review its source code before you sign, so that you know whether you are paying for an asset or a liability.

What We Look For

We look for vulnerabilities that an attacker could exploit, such as missing authorization checks, injection flaws, or ways to reach other customers’ data, and for the patterns behind them: whether authentication and authorization are designed into the product or added as an afterthought, how the data of different customers is kept apart, and how secrets are handled. A single vulnerability can be fixed. A pattern that runs through the whole code base tells you what the next years of development will cost.

We also check the company’s claims against the code. If the product is described as multi-tenant, as encrypting customer data, or as built on technology of its own rather than on third-party services, the code shows whether that is true.

Findings You Can Act On

In M&A and investments, a finding is not bad news: it is information you have before the price is agreed rather than after. For each serious issue, our report explains what it means for the business and what fixing it will take. With that, you can decide whether to go ahead, negotiate the price, or agree with the company on what must be fixed, and by when.

Our Experience

We have reviewed the code of software companies for buyers before an acquisition. In each case, we found serious vulnerabilities, and the seller had to invest in an overhaul of the product’s security. The same approach runs through all our security assessments: we start from the code, find the root cause of each vulnerability, and explain it so that it can be fixed.

Before You Sell or Raise

Companies can commission the same review before going to market or raising funding, to find and fix issues on their own terms instead of having them raised in the buyer’s or investor’s due diligence.