How Much Does Technical Due Diligence Cost in 2026?

In 2026, published prices for technical due diligence run from about $5,000–$35,000 for a light code review or red-flag check, through $15,000–$75,000 for a full review by a specialist firm (Upsilon, Kompella), to $60,000–$150,000 or more for a platform acquisition or a Big Four team, by one boutique’s estimate. The price is set by how many products, codebases and engineers are in scope, how deep the review goes (team interviews, security testing, open-source license scans), and how fast the deal needs the report.

Key takeaways

• Few firms publish prices. The numbers below come from the handful that do, and they are all vendor numbers. We found no published Big Four fees.
• Scope sets the price. One specialist charges $7,500 for one product and up to 10 engineers, and from $15,000 for 11–40 engineers or SOC 2 / HIPAA scope.
• Most reviews take 1–4 weeks (MEV quotes 2–4). The usual bottleneck is getting time with the target’s engineers, not reading the code.
• Open-source licensing is a common finding. Black Duck’s 2026 audit data found license conflicts in 68% of codebases, up from 56% a year earlier.
• Failing costs more than passing. In private M&A without deal insurance, the median indemnity escrow in 2025 was 10% of the price. Findings you could have fixed beforehand give the buyer a reason to ask for more.
• AI adds new questions: which model providers you depend on, what data you send them, and who owns code that an AI tool mostly wrote.

What technical due diligence is, from both sides

Buy-side diligence is commissioned by an investor or acquirer before they commit money. An outside reviewer gets read-only access to the code and cloud accounts, interviews the technical lead and a few engineers, and writes a report for the investment committee. It answers two questions: is the technology what the deck says, and what will it cost to fix what isn’t?

Sell-side diligence, or readiness, is the same review commissioned by the company before the investor’s team arrives. It’s an internal assessment you fix from, or a vendor due diligence (VDD) report you hand to buyers. RingStone, which sells this work, recommends starting internal readiness 6–18 months before a planned capital event and producing the buyer-facing report 1–3 months before.

The depth scales with the deal. madewithlove, a studio that says it has audited 190+ startups, offers a “shallow audit” with up to 4 interviews for seed rounds and a “deep audit” with up to 8 interviews and an in-depth code review for Series A/B or M&A, both in about two weeks. At seed, the question is whether the team can build. Later, it’s what the codebase will cost to own.

What it costs: published prices by deal type

Published prices are scarce. Most specialist firms quote per deal, and we found no Big Four fee schedules. The table uses only figures firms publish themselves. Every number in it is a vendor number, and where a vendor estimates what other firms charge, it’s labeled as an estimate.

DD type	Typical scope	Published price	Timeline	Usually bought by
Light review / red-flag check	Code, architecture and security skim; a short interview; deal-breakers only	$5,000 for a two-week standard plan (Upsilon); $5,000–$30,000 (MEV); $10,000–$35,000 red-flag review (estimate, Sparkle)	Days to 4 weeks	Seed investors, small acquisitions, a go/no-go call
Standard review, one product	Code, architecture, infrastructure, security, team; scored report	$7,500 for one product and up to 10 engineers (Reyem); 5-day review $12,000–$18,000 (Growth Shuttle)	5 days to 2 weeks	Series A/B investors, small PE add-ons
Full review, growth round or mid-market M&A	Several codebases or cloud estates, more interviews, compliance scope, remediation costed in engineer-weeks	From $15,000 for 11–40 engineers or SOC 2 / HIPAA scope (Reyem); $15,000–$75,000 per deal (Kompella); $35,000–$95,000 (estimate, Sparkle)	2–8 weeks	Growth and PE investors, strategic acquirers
Platform acquisition / Big Four	Full technology, security and integration review, can be bundled with financial DD	$60,000–$150,000+ for platform diligence; $50,000–$150,000+ for a Big Four team (both estimates, Sparkle)	2–3+ weeks	Large PE funds, corporate M&A
Sell-side readiness / VDD	The same review, commissioned by the company, plus a fix plan	Pre-LOI assessment from $5,000, three to five days (Growth Shuttle); others quote on request (RingStone)	3–5 days (light) to 4–6 weeks (full VDD)	Founders before a raise or sale

The cheapest published options are sized for one product and a small team, which is what most seed and Series A startups have. Work past the scope is billed hourly: Reyem charges $350 an hour, and Papermark, a data-room vendor, estimates $300–$600 for specialist firms and $400–$700 for Big Four practices. Senior US agency engineering runs about $100–$250 an hour (our rates guide), so the premium pays for reports investors trust.

What moves the price

• Number of products and codebases. Each repository and cloud account adds review time. Reyem re-quotes if undisclosed codebases turn up mid-engagement.
• Team size. More engineers means more interviews and more history to read.
• Compliance scope. SOC 2, HIPAA or regulated data moves you to the higher tier at most firms.
• Depth. A license scan, penetration testing or a costed remediation plan each add days.
• Deal clock. A five-day turnaround means the reviewer clears their calendar, and the price reflects it.

Most of these are fixed fees, which suits diligence: you know the cost up front and the reviewer has no reason to stretch the work (more in our guide to fixed price vs. time and materials vs. retainer). Also check how the fee is set. Reyem says its fee is never a percentage of the deal, with no success fee. A reviewer paid only if the deal closes has a reason to soften the report.

Who does it

Provider	Strengths	Watch out for
Specialist tech DD firms	Repeatable process, reports written for investment committees, fixed fees	Quality depends on the individual reviewer; ask who will do the work
Big Four and large consultancies	Can be bundled with financial and tax diligence; brand comfort for lenders	The highest price estimates; ask how much of the review senior people do
Fractional CTOs and independent consultants	Fast and affordable for a seed-stage check	One person’s view; report format varies
Software agencies and studios	Engineers who build systems daily; often the most practical fix plans	A possible conflict if they hope to win the remediation work

A firm that will also quote the fix has a reason to find problems, but it also has to stand behind its estimates. Ask any reviewer in writing whether they’ll bid on the remediation, and if so, have them price it separately.

What’s in a full report

A full report should let a non-technical partner make a decision. Kompella lists six parts: an investment summary; an architecture and scaling assessment; code and delivery health; security, data and compliance; team and key-person analysis; and a remediation plan with each finding costed in engineer-weeks. RingStone’s buyer-facing VDD report runs 40–80 pages. If a report lists problems without a cost and an order to fix them in, it isn’t finished.

What diligence usually finds

Open-source license and security problems

Black Duck’s 2026 Open Source Security and Risk Analysis (OSSRA) report is the closest thing to a public dataset of diligence findings. It is drawn from 947 commercial codebases audited by Black Duck, including 197 M&A transactions, between November 2024 and October 2025. Black Duck sells these audits, so read it as vendor research, but the sample is real deal work. Its findings, from the report summary and the full report:

• 68% of codebases had open-source license conflicts, up from 56%, the largest one-year jump in the report’s history.
• 8% of components had no detectable license, and 11% had custom or modified licenses that need individual legal review.
• 87% had at least one known vulnerability, 78% had high-risk ones and 44% had critical ones. The mean was 581 vulnerabilities per codebase, up 107%.
• 93% contained components with no development activity in two years, and 92% had components four or more years out of date.

The report says it plainly: “A GPL violation discovered during M&A due diligence can derail an acquisition.” A copyleft library deep in your core product may mean rewriting that part before close, or a buyer pricing that rewrite into the deal.

Scalability and delivery

The common engineering findings are less dramatic and more expensive: architecture that can’t handle the planned growth, heavy technical debt, undocumented systems and unclear ownership (MEV’s list). Some reviewers price these directly. Growth Shuttle estimates $40,000–$80,000 of post-close work to add a missing CI pipeline (vendor estimate). Numbers like that come off your valuation or go into a plan the buyer controls.

Key-person risk

If one engineer is the only person who can deploy, knows where the secrets are, or understands the billing code, the report will say so. Kompella interviews two or three engineers outside leadership where the deal allows, partly to test this. The fix is cheap if you start early: runbooks, shared access, and a second person who has done a release.

AI and LLM risks

Diligence checklists now have an AI section. madewithlove’s audit, for example, checks whether guardrails and code review exist for AI use, where source code may be sent, whether AI spending matches use, and dependence on a single model provider. Expect questions in four areas:

• Vendor lock-in. If the product only works with one model from one provider, a price change or deprecation is a business risk. Be ready to show how you’d switch, how you’d know a replacement model is good enough, and your cost per request.
• Data handling. What goes into prompts, and where it’s stored. Defaults vary by provider. OpenAI’s API, for instance, doesn’t train on API data by default but keeps abuse-monitoring logs for up to 30 days, and zero data retention needs OpenAI’s prior approval. If you promise enterprise customers that their data stays put, your provider settings have to match the promise.
• Application security. The OWASP Top 10 for LLM Applications 2025 is the common reference. For most products, prompt injection, sensitive information disclosure, excessive agency and unbounded consumption matter most.
• AI-generated code. Testing more than 100 LLMs on 80 coding tasks, Veracode found that the generated code introduced security vulnerabilities in 45% of cases. OSSRA adds a license angle: a snippet from an AI assistant can come from a GPL-licensed project with nothing in the code to show it, and only 54% of organizations evaluate AI-generated code for IP and license risk.

There’s also an ownership question. The US Copyright Office concluded in January 2025 that AI output is protected only where a human author determined the expressive elements, “but not the mere provision of prompts.” For a codebase mostly written by AI with light human editing, a buyer’s counsel may ask how much of it you can claim. That’s a question for a lawyer, but expect the engineering version too: which parts were generated, and which a person reviewed and rewrote.

If your product was built mostly with Lovable, Bolt, Replit or Cursor, the failure patterns are predictable, and we cover them, with costs, in how much it costs to fix a vibe-coded app.

What failing diligence costs

There’s no good public dataset on how often technical findings kill deals. What is documented is what happens to the terms.

Price cuts. After Yahoo disclosed its data breaches mid-deal, Verizon cut the price for Yahoo’s operating business by $350 million, to about $4.48 billion, and Yahoo agreed to cover 50% of certain post-closing cash liabilities from the breaches. That’s a public-company example, but the mechanism is the same at any size: a known, unfixed problem becomes a negotiation over who pays.

Escrows and holdbacks. SRS Acquiom’s 2026 study of more than 2,300 private-target acquisitions found that in 2025, deals without representations and warranties insurance had a median general indemnity escrow of 10.0% of transaction value, against 0.5% for deals with insurance. The median survival period for general claims was 12 months. A finding the seller can’t fix before close gives the buyer a reason to push for the high end of that range, or for a specific indemnity tied to that issue.

Inherited problems. Marriott acquired Starwood in 2016. The breach in Starwood’s reservation system had started in 2014, was found in 2018, and affected up to 339 million guests. The UK regulator fined Marriott £18.4 million in October 2020. Marriott said it had only been able to do limited due diligence on Starwood’s systems. The fine covered Marriott’s conduct after GDPR took effect, not the diligence itself, but the buyer inherited the problem either way.

Delays. Fixing a license conflict or a missing tenant boundary during exclusivity means weeks of work while the buyer waits, and every week is another chance to renegotiate. At seed and Series A the cost is harder to measure: the investor passes.

How to prepare: a readiness checklist

Do this a quarter before you open a data room. Most items take a day or less. The ones that don’t are the ones you want to find now.

1. Code ownership. Every repository lives in a company-owned GitHub or GitLab organization. Every employee and contractor who wrote code signed an IP assignment. Missing assignments are a legal fix, and they take time to collect.
2. A software bill of materials. GitHub can export an SBOM in SPDX format from the dependency graph. Generate one per repository.
3. A license scan. Run ScanCode Toolkit or a commercial scanner over the code, not just the manifest files, and look for GPL, AGPL and “no license” in anything you ship or host.
4. Dependency upgrades. Patch critical and high vulnerabilities, and replace abandoned packages on core paths.
5. Secrets. Nothing in the repository history, nothing in client bundles. Rotate anything that was ever exposed.
6. Access control. Test that one customer can’t read another’s data, at the database level, not just in the UI. For Supabase apps, our production-readiness checklist has the specific checks.
7. A two-page architecture document. Components, data flows, where personal data lives, third-party services.
8. Backups that have been restored. A backup you’ve never restored is a hope, not a backup.
9. Tests and CI on the money paths. Signup, billing, the core workflow. Reviewers look at whether deploys are automated and reversible.
10. A bus-factor check. A second person can deploy, rotate a key and restore the database, and has done it.
11. An AI inventory. Every model and provider you call, what data goes to each, the retention settings, monthly spend, and how you’d switch.
12. A note on AI-generated code. Which parts were generated, which were reviewed, and what tests cover them.
13. Security history. Past incidents, how you handled them, and any customer security questionnaires you’ve completed. An incident you disclose with its fix reads better than one the reviewer finds.
14. Cloud cost per customer. Know it, and know how it changes at 10x usage. With LLM calls in the product, it’s an obvious question.

If you’re the buyer

Ask the reviewer five things before you sign: who personally does the work, whether the fee is fixed, whether they’ll bid on remediation, whether the report costs every finding, and whether you can see a sample report. Some firms offer one up front; madewithlove, for example, has a downloadable sample.

Getting ready before the data room opens

A buyer’s reviewer will find what’s in your code either way. Better that you find it first, while there’s time to fix it.

Our AI-App Rescue Audit is built for that first look, especially for codebases written with Lovable, Bolt, Replit, Cursor or v0. It costs $1,490 fixed and takes 72 hours. Senior engineers review access control and secrets, the data model and backups, infrastructure and monthly cost, and performance under realistic load. You get a severity-ranked report with the fix for each finding, a 45-minute walkthrough, and a refactor-or-rebuild verdict with a fixed quote. If we find fewer than five material issues, you get a full refund. If you book the follow-on Stabilization Sprint (from $7,500, two weeks) within 30 days, the audit fee is credited in full.

To be clear about the limits: it’s preparation, not a substitute for the investor’s own diligence. It doesn’t include team interviews or an investment-committee report, so run the license scan from the checklist above alongside it.

Diligence doesn’t end at the report. It leaves a remediation backlog and follow-up questions from investors. If you don’t have a senior engineer to own that work, our Senior Team Retainer gives you one: $6,000 a month for 30 senior hours or $9,500 for 50, cancel anytime. Or book a call and tell us what the deal timeline looks like.