When to run it
A signed LOI, a data room, and an IC date that leaves no time for an interview-led technology review.
Two weeks to IC.Inspect the system, not the story.
Technology diligence before investment committee
The playbook in one paragraph
A deal is heading to investment committee and the technology picture is a management deck. Ana reads the whole codebase, cloud and contract set in the data room and returns an evidence-linked view of risk and value-creation levers.
Works with
- Virtual data room
- Read-only access to target repositories and cloud accounts
- Contract set
What Ana needs from you
- Deal thesis and value-creation plan
- Scope agreed with the target
- IC date and report format
How Ana runs it
Step by step.
5 steps from trigger to done - each one visible to your team as it happens.
- 01
Ingest everything
Ana reads every repository, cloud account and contract provided - the full population, not a sample.
- 02
Assess the system
Code quality and debt, architecture and coupling, security exposure, cloud configuration and cost, and delivery health are analyzed and scored.
- 03
Cross-reference legal and technical
Ana links technical findings to contracts - open-source licenses, change-of-control clauses, customer commitments - so the risk picture is joined up.
- 04
Size the levers
Findings are framed for the thesis: what it costs to fix, what blocks the plan, and where modernization or cost savings could create value.
- 05
Write the IC report
Every finding in the report cites its source - file, resource or clause - so the deal team can defend it.
Who approves what
Approval gates
- Access to target systems
- Target management, read-only
- Report release
- Deal team lead
- Sharing with lenders or co-investors
- Deal team
What you get
Deliverables
- 01Evidence-linked technology risk report
- 02Contract and license cross-reference
- 03Remediation cost ranges and value-creation levers
- 04IC-ready summary
What usually goes wrong
And how Ana handles it.
Risk
Sampling misses the issue that matters
The full population is reviewed - every repo, account and contract provided.
Risk
Findings without proof
Every finding links to the artifact it came from.
FAQ
Common questions.
No. Diligence is read-only and scoped with the target.
Keep going
Related playbooks.
Private equity
Running a portfolio-wide vulnerability program
Operating partners need to know which portfolio companies carry real cyber risk and whether it is going down. Ana normalizes findings across companies, ranks them by real exposure, routes fixes to named owners and verifies closure.
Read the playbook →Private equity
The first 100 days: a technology baseline
The deal has closed and the value-creation plan depends on technology. Ana builds a baseline of code, cloud, cost and delivery health in the first weeks, so the 100-day plan rests on evidence and progress can be measured.
Read the playbook →Software
Upgrading a framework across dozens of services
A major framework or runtime version is going end-of-life and it touches every service. Ana plans the migration, upgrades each service in its own branch, fixes what breaks, and hands your team small, tested pull requests instead of one terrifying diff.
Read the playbook →See it in your stack
Run this playbook on your systems.
Thirty minutes, your repositories and cloud, one real instance of this job.