Software due diligence is an independent review of the software a company runs on: its code, architecture, engineering team, security and the cost of keeping it all running. For a private equity buyer it answers one question before signing: will this technology carry the investment thesis, and what will it cost to make it do so?
Introduction
Most deal teams know what financial and legal due diligence will tell them. Software is harder to read. A product can demo beautifully and still sit on a codebase nobody dares to change, a cloud bill that grows faster than revenue, or a single engineer who holds the whole platform in their head. None of that shows up in the data room's slide deck.
Software due diligence closes that gap. It looks beneath the product at how the software is built, who builds it and what it will take to scale it under new ownership. Done well, it turns technology from a black box into numbers an investment committee can act on: risks with a cost, opportunities with a value, and a plan for the first 100 days.
What software due diligence covers
A thorough review looks at the software from the board level down to the code. At RingStone, every engagement runs through the same six areas, with AI and cybersecurity threaded through all of them:
- Strategy and roadmap: does the product roadmap support the growth case in the model, and is it funded?
- Architecture, AI, data and code: can the platform scale to the plan, how much technical debt does it carry, and is the code maintainable by someone other than its authors?
- Customer support and services: how much of the product's quality depends on people working around it?
- Organization and leadership: is the engineering team the right size and shape, and where are the key-person risks?
- SDLC and ability to execute: how code moves from idea to production, how often it ships, and how often it breaks.
- IT infrastructure: hosting, cloud cost, resilience and the true cost of running the platform.
Two threads run across every area. Cybersecurity asks how exposed the business is today and what a breach would cost. AI asks whether the company's AI claims hold up, and where AI could lift margin or growth after close.
Software due diligence and technical due diligence
The two terms are often used for the same work. Technical due diligence is the broader name: it covers any business where technology matters to the deal, including companies where technology enables the business rather than being the product. Software due diligence is the sharper focus when the software is the product, such as a SaaS platform, a marketplace or an AI-native company. There the weight moves to architecture, the AI and machine learning stack, code quality and scalability.
In practice the method is the same. What changes is where the hours go.
When to run it
There are three moments in a deal when software due diligence pays for itself:
- Before you bid (buy-side): a fast outside-in or red flag review tells you whether to pursue the deal at all, often before you have full access. Once you have a letter of intent, a full review sizes the risks and feeds the price.
- Before you sell (sell-side): sell-side technical due diligence lets a seller find and fix issues before buyers do, so the story holds up in the data room and the price holds up at signing.
- After close: the same findings become the first 100-day plan. A review that ties every finding to an action and a cost is the starting point for value creation rather than a report that sits in a folder.
Red flags that change the price
Most software has issues. The ones that matter in a deal are those that change the investment case. These come up again and again:
- Technical debt with no plan to pay it down, so every new feature costs more than the last.
- A platform that cannot scale to the plan without a rebuild nobody has priced.
- Key-person dependency: one or two engineers who understand the core system, with no documentation behind them.
- Open source and IP exposure: licenses that conflict with how the product is sold, or code the company does not clearly own.
- Security gaps that a buyer's insurer, or an attacker, will find first.
- Cloud costs growing faster than revenue, which quietly erode the margin in the model.
- AI claims that are thinner than the pitch, where "AI-powered" means a wrapper around a third-party model.
None of these has to kill a deal. Each has a cost, a timeline and an owner, and the point of the review is to put those on the table before the price is fixed.
What a good report gives the deal team
A software due diligence report is only useful if the investment committee can read it. The format that works starts with an executive summary, then a bird's-eye view of risks and opportunities by area, then the supporting detail for technical reviewers. Most important is a backlog of risks and opportunities, each with an estimated cost or impact and a recommended action.
That backlog is what turns findings into decisions: what to negotiate on price, what to fix in the first 100 days, and what to fund in the plan. You can see the exact format in RingStone's sample report.
Who should do the review
The best reviews are done by people who have run software companies. A senior CTO or CPO who has sat in the seat they are assessing knows the difference between a real risk and noise, and can judge a team's ability to deliver in a day of interviews rather than a month. RingStone's practitioners average more than 20 years of operating experience, and every engagement is led by a partner-level practitioner from kick-off to report.
Frequently asked questions
How quickly can a review start?
RingStone starts most engagements within five business days, and red flag and outside-in reviews often within 48 hours.
Can you assess software without access to the code?
Yes. An outside-in review uses public data, expert networks, code analysis on whatever is accessible and structured hypothesis testing to give an informed read before full access is granted.
Is software due diligence only for software companies?
No. Any company whose value depends on its systems benefits, but for tech-enabled businesses the review shifts its weight from the product's code to enterprise IT, integrations, data flows and infrastructure.
Conclusion
Software is often the largest asset in a deal and the least understood. Software due diligence gives a buyer a clear view of what they are acquiring, and gives a seller the chance to tell that story on their own terms. With 1,500+ engagements delivered across private equity, venture capital and M&A, RingStone has seen how the same few software issues decide deals. If you have a deal in front of you, talk to us about what to look at first.