Hacker News Reader

Comment by mbesto | Hacker News Reader

Since this documentation heavily refers to Technical Due Diligence processes, I thought I'd offer an "AmA" since this is what I do for a living (personally have conducted 400+ Tech DD projects).

Disclaimer - I'm not a GitLab employee and they are not a client of mine, but their documented processes are very synonymous with what I do.

View on HN

I’m curious about your career path. Did you start by doing it in-house and then go into consulting? Are you at a big consultancy or do you run your own specialty DD consultancy?

I love this question since my career path is so irregular. It'll take some time so lemme write a more detailed response in a bit.

Also interested on your answer. I'd love to work on this full-time!

Thirding. I've done a little of this as part of a job a while back and I think I'd really like doing more of it. Curious what kind of demand-volume there is for it, and especially if there are any adjacent services that people are willing to pay for (e.g. more social, looking into the management & process side of a tech org). Avenues for breaking in with sales for this, that kind of thing, would be greatly appreciated.

I'll answer this in two parts:

Me:

I personally have a very atypical career so please take this with a grain of salt. That being said, I think my weird background helped me to excel in this space

Here is my professional background

   - SAP Consultant working for SAP (Data Analytics & Reporting)
   - (Entrepreneur) Web Design Agency (failed)
   - SAP Consulting (3rd Party Partner)
   - (Entrepreneur) Startup (failed)
   - Management Consulting (we were doing about ~15 IT Due Diligence projects a year when I joined)
   - Left previous firm and started my own firm (Renna Partners), which exclusively focused on IT/Tech DDs (previous firm did IT strategy + DD was a small part of the overall biz)
   - Sold my firm to my competitor (Crosslake), which is who I work for now

Experience that led to this type of work:

I started as a consultant in SAP's support group. Oddly, at a young age this gave me exposure to the technical/operational challenges of M&A as I sat in on a high profile customer who bought SAP and BOBJ integrated products before the company merged, and then had to deal with the companies/tech talk to each other post close. This was more "in the trenches" than it was strategic, but it help formulate how I thought about the strategy of M&A for companies. I then taught myself to code when I tried doing a web design agency and a startup. Failed miserably, but gave me a ton of empathy about what its like to be a (1) a founder (2) an engineer and (3) a business operator. After my last startup failed, I called an old friend of mine and luckily they were hiring. Their IT DD practice was small (it was 1-2 people) but growing. I came on and basically acted as a junior partner with one of the partners who led the practice. We quickly grew that to supporting ~100 deals/year. The company wasn't strategic about the work (they wanted large scale IT strategy gigs), so we split off and I start my own firm that focused solely in on IT/Tech DD. I then sold that company to my biggest competitor. I'm now an MD/Executive at that firm. My experience with hands on development, owning/operating a business, M&A, mix of enterprise software + implementation, and consulting (this can't be understated, there is a ton of value in knowing "how to be a consultant") is probably what really helped me excel in this space. Oh and now that I've sold a company myself, I have even more perspective :)

Typical person:

There are usually two types of personas that fit well: career consultants in tech M&A (think E&Y, West Monroe, KPMG, etc.) and operational leaders (e.g. seasoned CTOs, VP of Engineering, Head of Product, etc.). People who have done both are IDEAL. Personally I look for "athletes" or T-Shaped people. You need to be able to get very technical and then translate this to a financial person who doesn't know the difference between Java and JavaScript, which is a very unique skill in itself.

P.S. I have a huge demand Product people (market + technical) who want to help do Product Due Diligence + Product Strategy consulting. Please reach out if you're interested.

Here is a link if you want to apply: https://jobs.lever.co/crosslaketech/7b2e42ec-d873-443f-b30f-...

I love the idea of doing independent technical due diligence work after enjoying doing software auditing and investigations in my current job. Looking at Gitlab's processes it seems like company structure, finances and legal checks make up a lot of the investigation. The software/infra/tech side seems quite short (Gitlab suggest their early technical diligence should be turned around in 2-3 days).

Do you think there's enough demand out there to have a company that does just technical (e.g. software quality, security) due diligence?

> Do you think there's enough demand out there to have a company that does just technical (e.g. software quality, security) due diligence?

My company (used to, we've grown to do other things) only do Tech DD and we've done really well, so the answer is yes. According to Pitchbook there are about ~3,000 software company acquisitions every year - so that might tell you how much potential business there is.

There are consultancies who provide these DD services certainly as a line of business, if not their entire business. Like any other professional services enterprise, a lot of it depends on your network and ability to generate new business, especially in the early days. If you're not in the position to do it yourself, perhaps there are opportunities to get involved on a contractor basis with firms that do.

AMA Question - Does a process like this help you make better acquisitions, or is there still an art in picking the right startup at the right time for a business?

My firm doesn't acquire the companies themselves, we work with companies (like Gitlab) or private equity firms who acquire businesses to help them understand the technology. So our clients pick the startup and they usually have a thesis for acquisition. During diligence it's their opportunity to confirm or deny that thesis, and as an objective, third party set of expert eyes we can help them do that.

What's the rate of your reject rate, and what are the most common deal breakers, bad signs? It'd be helpful.

So we just advise on things that might constitute as "red flags", however ultimately our clients make the decision to break a deal. I would say its about 5%~10% rejection rate (some clients are more risky than others), and it's very rare that tech alone is the deal breaker. When tech is an issue, it's usually combined with some business issue (example - it takes 3 months to onboard a new client and the company has little automation for data migration, so they won't scale well)

Thanks!

* What are the most common gotchas?

* What tools do you use to do the technical due diligence?

* What would you suggest to prepare for it?

* What would acing it look like?

I'm not OP, but when I experienced due dilligence the thing I found counter-intuitive was that 'looking really good at everything' isn't actually the best approach.

As an example - it might be better that the company doing Due Dilligence finds you awful at sales during the DD phase, because they will see that you got revenue despite poor sales technique and they will see it as an easy target for improvement / 'to generate value'. Companies want to identify ways that they would be able to help the company they are aquiring.

Not sure if this applies to Technical DD, but thought it was interesting enough to share!

Yes, that's called 'hidden upside'. You can of course also disclose this before DD. As a rule, surprises during the DD process are to be avoided if you can, even positive ones (because you may lose out on a bid from a party that would have bid if they had been aware of it).

source: yaddp.

Exactly this. You don't pass or fail Tech DD...it's more to provide comfort to the buyer.

OP is specifically talking about tech due diligence which is specific within due diligence in general.

One thing that appear in tech due diligence is quality of the technical architecture and implementation, and security risks associated.

And: quality of the people... if there is one distinguishing factor it is that one. Bad tech can be fixed, and if there is a competent team that got put in charge of a pile of tech debt then there is hope.

* What are the most common gotchas?

Surprises! We don't like surprises, and nor do our clients. From a tech perspective - dated tech, unmanageable (or no clarity of) tech debt, NIH syndrom

* What tools do you use to do the technical due diligence?

OSS scanning and security scans mostly

* What would you suggest to prepare for it?

I'l try to answer this simply, which is - read GitLabs documentation and if you have similar and more importantly - actually operate this way, then you'll be more than prepared.

* What would acing it look like?

As I mentioned below, there is no pass/fail. Acing it is - be honest, be prepared, and have a plan (not for the tech dd itself, but rather a plan for your business).

Do you look at codebase quality?

As in, have someone good at Language X go through the target's repos and deliver a verdict on how good the actual code is, and how well it's organized etc?

More or less yes. The tooling for this is getting much better.

What makes something like outdated tech a "surprise", rather than just "reality"? As in it was actively hidden from you, or just not something anyone thought worth mentioning until it came time to plow through the code?

"Surprise" could be interpreted a few different ways. Here's an example to elaborate:

- Company being acquired ("Target") built a web based application in the mid-2000's using VB.NET and each client installed the software. It requires a desktop widget to be installed at their clients locations to talk back to the VB.NET web backend. In 2016 they switched their licensing model from perpetual license to subscription and now the web application is hosted by the target and not the clients.

- Target tells acquirer they have a "SaaS" application.

So, now its a VB. NET web app with single tenants hosted on the Target's data centers. Not untenable, but the acquirer was probably expecting a multi-tenant SaaS web app in a more generally supported web framework.

And, yes I've absolutely seen this case (or something very similar) in the wild.

Excellent topic, my company also does technical due diligence. Even so, beyond acquisition, regarding investments we see that founders networking and promises take over technical capabilities. Not the same for pure acquisitions. Shameless plug: [1]

It would he great if the HN community could comment more about this topic beyong the Gitlab's article.

[1] Fundamental Analysis of Web3 Technologies: https://blog.coinfabrik.com/fundamental-analysis-of-web3-tec...

> Customer list with name, monthly revenue, contract termination date and any other fields if relevant.

Could you compare and contrast this analysis for companies with a small number of large customers, vs a large number of small customers? What are you looking for? What are examples of good or bad surprises?

These are more business/commercial questions, but they typically manifest themselves in Tech DD when it comes to implementation, which is what we might look at.

Do you have an example of your work? I'm curious what a report looks like, having done only a couple of 'code reviews' myself (that is, I got a codebase and three days to write a report on how it could be improved, not very formal at all).

I'd love to share this, but unfortunately our reports belong to our clients so it would be really hard for to disclose an example to the public.

Do you know of any documents similar to what you do that have been disclosed to the public, or is this a sub-industry that us completely opaque to outsiders?

It would be interesting if you did some open source project of sufficient size or something. (Unless it’s not a one-to-one or something)

I've been a part of a few of these, and it really just depends. Overall, though, the report will break down the company into a bunch of different categories (and not just from a code/tech stack standpoint). Sometimes you'll get a point-rating (1-10 or whatever) or a market-based rating (e.g. degrees worse, comparable or better than their competition in a category).

The audit may encompass anything from code quality, technical debt, tech stack, architecture, infrastructure, to the product roadmap, licensing of dependencies, corporate structure, hiring/retention of talent, etc. It really just depends on what the company paying for the DD asks for (which could be either side, and that also matters a lot).

Each category in the final report will have a summary, a score, notes about risks/opportunities, suggestions on how to improve, what things are strengths, etc. It can be really, really long, and often it's broken up and worked on by multiple people based on their area(s) of expertise. Usually you'll see a high-level summary chart at the end of the report that just kind of puts everything in front of you.

This is a very good summary of what deliverables look like.

What does your company charge for standard B2B SaaS acquisition technical DD?

Unfortunately, I can't disclose that, but I can tell you what market rates tend to be. I've seen firms in this space charge anything from $10k to $150k per deal. The lower end tends to be the "one man shop" and the larger end tends to be more established advisory firms who work on large and or complex deals.

That sounds… cheap. Like that’s less than the monthly take home for a single non descript engineer.

Quite the contrary. The projects last 2~3 weeks.

Where are you making $150k a month and are you hiring?

> the larger end tends to be more established advisory firms who work on large and or complex deals.

I'd assume the higher end includes the auditing company holding a pile of compliance certs. Those can be pretty expensive to pick up.

Yeah I think having an hourly rate would have been more useful, but I appreciate their reply regardless.

I’ve done DD for a small SaaS acquisition. But from the sell side. It was a decent amount of work providing access, diagrams, answering questions, etc. I would think anywhere from $150-$300/hour depending on the deal size.

AMA question: I've never personally been through this process, but I assume go-to-market DD is typically part of the process. Are there specialized firms that handle that side of the equation?

Can you be more specific? Do you mean like doing a DD on the product and sales strategy of the company that is being acquired?

Yes, DD on sales and marketing strategy to understand if the underlying economics are sustainable.

How do you measure success? Do you follow up on these companies later on (acquired or not).

Good question - we have a rating system where we compare companies on a variety of dimensions. If we find areas that need help post close, our clients engage us to work with the company.

If you want to do an AmA you should probably do some answering... I don't feel like hijacking your thread but really, those are important questions.

More than happy for you to answer as well - I respect your opinion on this topic.

P.S. - don't really appreciate the snarky "you should do some answering"... as a fellow busy professional, I'm answering when I have the time to do so.

It wasn't snarky, more that if you're going to do an AmA that kind of puts the ball in your court and you really should use the opportunity because if you don't have time now then it might be better to do this as a separate 'Ask HN' or something to that effect.

This subject is very dear to a lot of the HN crowd and of course you as the initiator of that process should get the first shot at answering these questions, they are all super relevant and very practical. You might even want to do a formal write-up of the answers you get in a blog post.

It might not have intended to be snarky but theres really only one way you can take "you should probably do some answering".

HN threads can die rather quickly and it would be a real loss of an opportunity. But fine, next time I'll just STFU.

You posted this 1 hour after he originally posted? Yikes, chill out

Reply on news.ycombinator.com