$350M
Off the purchase price
Undisclosed data breaches surfaced during late-stage diligence, after the price had been agreed rather than before.
Source: Verizon / Yahoo, 2017
Technical diligencefor private capital
Institutional-grade software intelligence, from acquisition to exit.
Every software deal is priced on a codebase nobody read
$30M
Unbudgeted, post-close
A platform acquisition where the target's ERP could not integrate. Found after signing, so it could not be negotiated into the price.
Source: RSM case file
5–25%
Off the agreed price
Software transactions are re-traded on 30–40% of deals, once the buyer surfaces code, security or licensing exposure during diligence.
Source: PitchBook aggregate data
Architecturally unable to see your code
The target initiates the assessment, authorises the environment directly, and receives a signed record of everything that happened inside it. Our inability to reach the source is enforced by the architecture, not asserted by policy.
1 of 4Provable isolation
Neither Exira nor the cloud provider can see inside
The analysis engine is built, signed and locked to one verified version before anything starts. It runs on hardware that keeps its memory encrypted while the work happens, closed to the operators of the machine it runs on as much as to us. The target confirms the environment is running that approved version before releasing anything to it.
Access is never issued to us
The target authorises the environment directly. The key covers only the repositories it selects, and its private half is created inside the environment and can never be copied out, so it is cryptographically bound to that single run and worthless anywhere else. Exira is never a party to it. It lapses when the checkout finishes, and the target can withdraw it sooner.
Source never leaves the environment it lands in
The repository is pulled over an encrypted connection straight from the target's own provider into storage that exists only for that run. Nothing routes through Exira. Analysis happens where the code already sits: inside the environment it is processed as data rather than run, and nothing the repository asserts can change how that analysis behaves.
The report leaves. The environment is destroyed
Findings leave as a structured register, validated against a published schema. Evidence travels as file paths, line ranges and content hashes, so the report points at code without ever containing any. The environment and its keys are then destroyed, and the target receives a signed, tamper-evident audit record: what was authorised, what ran, what left, and when it was torn down.
Eleven modules, checked against each other
Each module reads one part of the codebase. The findings that move a price usually sit where two of them meet, so every assessment cross-checks them before it reports.
Key-person dependency
We find the systems that depend on a handful of engineers, including people who have already left the company.
Security & vulnerability posture
We measure dependency exposure and how quickly patches land, then check how secrets are handled and which controls the pipeline enforces.
Scalability & cloud architecture
We map the services and how data moves between them, then assess how the design would cope with ten times the load.
Engineering organisation health
We judge delivery pace and engineering discipline from the repository history, which shows how the team really reviews and tests its work.
Compliance & regulatory posture
We separate obligations enforced in code from those that exist only in policy documents, and flag what must be verified outside the codebase.
IP & licensing risk
We check every dependency licence against how the product is distributed, and identify what carries through the transaction.
Technology modernisation risk
We compare runtime, framework and platform versions with their end-of-support dates and list the upgrades that are already overdue.
AI & ML readiness
We judge whether AI is central to the product or added on later, looking at provider dependence, evaluation practice and the underlying data.
Integration compatibility
We map the interfaces the product exposes and relies on, and estimate the true cost of integrating it with an acquirer's systems.
FinOps & cloud cost efficiency
We trace infrastructure spend back to the design decisions behind it and check whether cost controls exist in the code.
Technical debt
We quantify the deferred work in the codebase and convert it into the engineering months needed to clear it.
Weighted by what moved a price
Our models are fine-tuned on completed assessments and the deal outcomes that followed. An independent critic reviews every conclusion before it reaches you.
A real assessment, redacted
Each finding is given a disposition and a remediation estimate in engineering months, and points to the evidence behind it.
Assessment reportJune 2026 · 11 modules
Analysed
44,499commits
17,942files
552contributors
1.23Mlines of code
Reported46findings
3cross-module
2to verify
2deal-blocking
F-0131
F-0127
F-0118
F-0092
F-0071
F-0064
F-0055
F-0043
F-0031
F-0028
Material risk across two modules
Three infrastructure migrations running at once
The event streaming backbone, the caching and job-queue layer and the identity data-access layer are all mid-migration at the same time. Each migration is justified and well run, with dual-write patterns keeping old and new systems in sync. The concern is that all three are open together. That adds operational complexity and leaves room for data inconsistency until each one is closed out.
- Disposition
- Close out or price in before signing
- Remediation
- Streaming 1–2 months, cache 1–2 months, identity 2–3 months
- Evidence
- 3 references: dual-write helpers, migration config, routing fallback
- Critic review
- Upheld, severity unchanged, no contradicting evidence
Book a demo to see the full assessment
One engine, four moments
At this cost and turnaround, technical diligence stops being something you commission once and becomes a screen, then a monitor, then a defence.
Look before you commit
Run it on targets you would never resource a full engagement for. Firms doing this aren't just faster; they see more of the market.
Findings while price is open
Architecture, security, licensing and remediation cost in engineering months, while there is still a number to move.
Drift, tracked
Scheduled re-runs track debt accumulation, security drift and technical covenant signals months before they reach revenue.
Find it before they do
The same assessment, read from the other side: what a buyer's diligence would surface, while remediation is still a sprint.
2–3 weeks
Hours
Fits inside exclusivity
$40K–$300K
A fraction
Viable earlier in the funnel
Sampled scope
Eleven modules
Same coverage every run
One snapshot
Scheduled
Through hold, into exit