7 ms·

Since this documentation heavily refers to Technical Due Diligence processes, I thought I'd offer an "AmA" since this is what I do for a living (personally have

• wslh 4y ago
  Excellent topic, my company also does technical due diligence. Even so, beyond acquisition, regarding investments we see that founders networking and promises take over technical capabilities. Not the same for pure acquisitions. Shameless plug: [1] It would he great if the HN community could comment more about this topic beyong the Gitlab's article. [1] Fundamental Analysis of Web3 Technologies: https://blog.coinfabrik.com/fundamental-analysis-of-web3-technologies/ https://blog.coinfabrik.com/fundamental-analysis-of-web3-tec...
• ericb 4y ago
  Thanks! * What are the most common gotchas? * What tools do you use to do the technical due diligence? * What would you suggest to prepare for it? * What would acing it look like?
  • Closi 4y ago
    I'm not OP, but when I experienced due dilligence the thing I found counter-intuitive was that 'looking really good at everything' isn't actually the best approach. As an example - it might be better that the company doing Due Dilligence finds you awful at sales during the DD phase, because they will see that you got revenue despite poor sales technique and they will see it as an easy target for improvement / 'to generate value'. Companies want to identify ways that they would be able to help the company they are aquiring. Not sure if this applies to Technical DD, but thought it was interesting enough to share!
    • jacquesm 4y ago
      Yes, that's called 'hidden upside'. You can of course also disclose this before DD. As a rule, surprises during the DD process are to be avoided if you can, even positive ones (because you may lose out on a bid from a party that would have bid if they had been aware of it). source: yaddp.
      • mbesto 4y ago
        Exactly this. You don't pass or fail Tech DD...it's more to provide comfort to the buyer.
    • wslh 4y ago
      OP is specifically talking about tech due diligence which is specific within due diligence in general. One thing that appear in tech due diligence is quality of the technical architecture and implementation, and security risks associated.
      • jacquesm 4y ago
        And: quality of the people... if there is one distinguishing factor it is that one. Bad tech can be fixed, and if there is a competent team that got put in charge of a pile of tech debt then there is hope.
  • mbesto 4y ago
    * What are the most common gotchas? Surprises! We don't like surprises, and nor do our clients. From a tech perspective - dated tech, unmanageable (or no clarity of) tech debt, NIH syndrom * What tools do you use to do the technical due diligence? OSS scanning and security scans mostly * What would you suggest to prepare for it? I'l try to answer this simply, which is - read GitLabs documentation and if you have similar and more importantly - actually operate this way, then you'll be more than prepared. * What would acing it look like? As I mentioned below, there is no pass/fail. Acing it is - be honest, be prepared, and have a plan (not for the tech dd itself, but rather a plan for your business).
    • biztos 4y ago
      Do you look at codebase quality? As in, have someone good at Language X go through the target's repos and deliver a verdict on how good the actual code is, and how well it's organized etc?
      • mbesto 4y ago
        More or less yes. The tooling for this is getting much better.
    • ollien 4y ago
      What makes something like outdated tech a "surprise", rather than just "reality"? As in it was actively hidden from you, or just not something anyone thought worth mentioning until it came time to plow through the code?
      • mbesto 4y ago
        "Surprise" could be interpreted a few different ways. Here's an example to elaborate: - Company being acquired ("Target") built a web based application in the mid-2000's using VB.NET and each client installed the software. It requires a desktop widget to be installed at their clients locations to talk back to the VB.NET web backend. In 2016 they switched their licensing model from perpetual license to subscription and now the web application is hosted by the target and not the clients. - Target tells acquirer they have a "SaaS" application. So, now its a VB. NET web app with single tenants hosted on the Target's data centers. Not untenable, but the acquirer was probably expecting a multi-tenant SaaS web app in a more generally supported web framework. And, yes I've absolutely seen this case (or something very similar) in the wild.
• paulgb 4y ago
  I’m curious about your career path. Did you start by doing it in-house and then go into consulting? Are you at a big consultancy or do you run your own specialty DD consultancy?
  • mbesto 4y ago
    I love this question since my career path is so irregular. It'll take some time so lemme write a more detailed response in a bit.
    • thiago_fm 4y ago
      Also interested on your answer. I'd love to work on this full-time!
      • yamtaddle 4y ago
        Thirding. I've done a little of this as part of a job a while back and I think I'd really like doing more of it. Curious what kind of demand-volume there is for it, and especially if there are any adjacent services that people are willing to pay for (e.g. more social, looking into the management & process side of a tech org). Avenues for breaking in with sales for this, that kind of thing, would be greatly appreciated.
  • mbesto 4y ago
    I'll answer this in two parts: Me: I personally have a very atypical career so please take this with a grain of salt. That being said, I think my weird background helped me to excel in this space Here is my professional background - SAP Consultant working for SAP (Data Analytics & Reporting) - (Entrepreneur) Web Design Agency (failed) - SAP Consulting (3rd Party Partner) - (Entrepreneur) Startup (failed) - Management Consulting (we were doing about ~15 IT Due Diligence projects a year when I joined) - Left previous firm and started my own firm (Renna Partners), which exclusively focused on IT/Tech DDs (previous firm did IT strategy + DD was a small part of the overall biz) - Sold my firm to my competitor (Crosslake), which is who I work for now Experience that led to this type of work: I started as a consultant in SAP's support group. Oddly, at a young age this gave me exposure to the technical/operational challenges of M&A as I sat in on a high profile customer who bought SAP and BOBJ integrated products before the company merged, and then had to deal with the companies/tech talk to each other post close. This was more "in the trenches" than it was strategic, but it help formulate how I thought about the strategy of M&A for companies. I then taught myself to code when I tried doing a web design agency and a startup. Failed miserably, but gave me a ton of empathy about what its like to be a (1) a founder (2) an engineer and (3) a business operator. After my last startup failed, I called an old friend of mine and luckily they were hiring. Their IT DD practice was small (it was 1-2 people) but growing. I came on and basically acted as a junior partner with one of the partners who led the practice. We quickly grew that to supporting ~100 deals/year. The company wasn't strategic about the work (they wanted large scale IT strategy gigs), so we split off and I start my own firm that focused solely in on IT/Tech DD. I then sold that company to my biggest competitor. I'm now an MD/Executive at that firm. My experience with hands on development, owning/operating a business, M&A, mix of enterprise software + implementation, and consulting (this can't be understated, there is a ton of value in knowing "how to be a consultant") is probably what really helped me excel in this space. Oh and now that I've sold a company myself, I have even more perspective :) Typical person: There are usually two types of personas that fit well: career consultants in tech M&A (think E&Y, West Monroe, KPMG, etc.) and operational leaders (e.g. seasoned CTOs, VP of Engineering, Head of Product, etc.). People who have done both are IDEAL. Personally I look for "athletes" or T-Shaped people. You need to be able to get very technical and then translate this to a financial person who doesn't know the difference between Java and JavaScript, which is a very unique skill in itself. P.S. I have a huge demand Product people (market + technical) who want to help do Product Due Diligence + Product Strategy consulting. Please reach out if you're interested.
• DishyDev 4y ago
  I love the idea of doing independent technical due diligence work after enjoying doing software auditing and investigations in my current job. Looking at Gitlab's processes it seems like company structure, finances and legal checks make up a lot of the investigation. The software/infra/tech side seems quite short (Gitlab suggest their early technical diligence should be turned around in 2-3 days). Do you think there's enough demand out there to have a company that does just technical (e.g. software quality, security) due diligence?
  • mbesto 4y ago
    > Do you think there's enough demand out there to have a company that does just technical (e.g. software quality, security) due diligence? My company (used to, we've grown to do other things) only do Tech DD and we've done really well, so the answer is yes. According to Pitchbook there are about ~3,000 software company acquisitions every year - so that might tell you how much potential business there is.
    • deleted 4y ago
      [deleted]
  • awad 4y ago
    There are consultancies who provide these DD services certainly as a line of business, if not their entire business. Like any other professional services enterprise, a lot of it depends on your network and ability to generate new business, especially in the early days. If you're not in the position to do it yourself, perhaps there are opportunities to get involved on a contractor basis with firms that do.
• kinnth 4y ago
  AMA Question - Does a process like this help you make better acquisitions, or is there still an art in picking the right startup at the right time for a business?
  • mbesto 4y ago
    My firm doesn't acquire the companies themselves, we work with companies (like Gitlab) or private equity firms who acquire businesses to help them understand the technology. So our clients pick the startup and they usually have a thesis for acquisition. During diligence it's their opportunity to confirm or deny that thesis, and as an objective, third party set of expert eyes we can help them do that.
• jacquesm 4y ago
  If you want to do an AmA you should probably do some answering... I don't feel like hijacking your thread but really, those are important questions.
  • mbesto 4y ago
    More than happy for you to answer as well - I respect your opinion on this topic. P.S. - don't really appreciate the snarky "you should do some answering"... as a fellow busy professional, I'm answering when I have the time to do so.
    • sieabahlpark 4y ago
      [dead]
    • jacquesm 4y ago
      It wasn't snarky, more that if you're going to do an AmA that kind of puts the ball in your court and you really should use the opportunity because if you don't have time now then it might be better to do this as a separate 'Ask HN' or something to that effect. This subject is very dear to a lot of the HN crowd and of course you as the initiator of that process should get the first shot at answering these questions, they are all super relevant and very practical. You might even want to do a formal write-up of the answers you get in a blog post.
      • esskay 4y ago
        It might not have intended to be snarky but theres really only one way you can take "you should probably do some answering".
        • jacquesm 4y ago
          HN threads can die rather quickly and it would be a real loss of an opportunity. But fine, next time I'll just STFU.
  • weird-eye-issue 4y ago
• CSDude 4y ago
  What's the rate of your reject rate, and what are the most common deal breakers, bad signs? It'd be helpful.
  • mbesto 4y ago
    So we just advise on things that might constitute as "red flags", however ultimately our clients make the decision to break a deal. I would say its about 5%~10% rejection rate (some clients are more risky than others), and it's very rare that tech alone is the deal breaker. When tech is an issue, it's usually combined with some business issue (example - it takes 3 months to onboard a new client and the company has little automation for data migration, so they won't scale well)
• ryanSrich 4y ago
  What does your company charge for standard B2B SaaS acquisition technical DD?
  • mbesto 4y ago
    Unfortunately, I can't disclose that, but I can tell you what market rates tend to be. I've seen firms in this space charge anything from $10k to $150k per deal. The lower end tends to be the "one man shop" and the larger end tends to be more established advisory firms who work on large and or complex deals.
    • ramraj07 4y ago
      That sounds… cheap. Like that’s less than the monthly take home for a single non descript engineer.
      • mbesto 4y ago
        Quite the contrary. The projects last 2~3 weeks.
      • eddsh1994 4y ago
        Where are you making $150k a month and are you hiring?
        • weird-eye-issue 4y ago
          > the larger end tends to be more established advisory firms who work on large and or complex deals.
          • yamtaddle 4y ago
            I'd assume the higher end includes the auditing company holding a pile of compliance certs. Those can be pretty expensive to pick up.
      • ryanSrich 4y ago
• Cthulhu_ 4y ago
  Do you have an example of your work? I'm curious what a report looks like, having done only a couple of 'code reviews' myself (that is, I got a codebase and three days to write a report on how it could be improved, not very formal at all).
  • mbesto 4y ago
    I'd love to share this, but unfortunately our reports belong to our clients so it would be really hard for to disclose an example to the public.
    • NineStarPoint 4y ago
      Do you know of any documents similar to what you do that have been disclosed to the public, or is this a sub-industry that us completely opaque to outsiders?
    • deleted 4y ago
      [deleted]
    • code_runner 4y ago
      It would be interesting if you did some open source project of sufficient size or something. (Unless it’s not a one-to-one or something)
  • twodave 4y ago
    I've been a part of a few of these, and it really just depends. Overall, though, the report will break down the company into a bunch of different categories (and not just from a code/tech stack standpoint). Sometimes you'll get a point-rating (1-10 or whatever) or a market-based rating (e.g. degrees worse, comparable or better than their competition in a category). The audit may encompass anything from code quality, technical debt, tech stack, architecture, infrastructure, to the product roadmap, licensing of dependencies, corporate structure, hiring/retention of talent, etc. It really just depends on what the company paying for the DD asks for (which could be either side, and that also matters a lot). Each category in the final report will have a summary, a score, notes about risks/opportunities, suggestions on how to improve, what things are strengths, etc. It can be really, really long, and often it's broken up and worked on by multiple people based on their area(s) of expertise. Usually you'll see a high-level summary chart at the end of the report that just kind of puts everything in front of you.
• coreyrab 4y ago
  AMA question: I've never personally been through this process, but I assume go-to-market DD is typically part of the process. Are there specialized firms that handle that side of the equation?
  • mbesto 4y ago
    Can you be more specific? Do you mean like doing a DD on the product and sales strategy of the company that is being acquired?
    • coreyrab 4y ago
      Yes, DD on sales and marketing strategy to understand if the underlying economics are sustainable.
• brugidou 4y ago
  How do you measure success? Do you follow up on these companies later on (acquired or not).
  • mbesto 4y ago
    Good question - we have a rating system where we compare companies on a variety of dimensions. If we find areas that need help post close, our clients engage us to work with the company.
• deleted 4y ago
  [deleted]
• di456 4y ago
  > Customer list with name, monthly revenue, contract termination date and any other fields if relevant. Could you compare and contrast this analysis for companies with a small number of large customers, vs a large number of small customers? What are you looking for? What are examples of good or bad surprises?
  • mbesto 4y ago
    These are more business/commercial questions, but they typically manifest themselves in Tech DD when it comes to implementation, which is what we might look at.