Pre-Close Technical Due Diligence for Software Acquisitions.
Unvarnished codebase, cloud architecture, and AI pipeline audits for B2B SaaS targets under active LOI. 4-to-5-day sprint turnaround. Starting at $20,000.
Survey Checklists vs. Ground-Truth Diligence
Legacy diligence relies on self-reported questionnaires filled out by target engineering managers and reviewed by non-technical generalists. CyberBear verifies production code directly.
Questionnaires & Junior Staff
- × Self-Reported Answers: Deal teams receive polished survey answers from the seller's CTO without independent code verification.
- × Junior Staff Hand-offs: Diligence interviews and document scanning are farmed out to junior generalists or offshore teams.
- × Bloated Timelines: Takes 3 to 4 weeks, burning precious days off the deal exclusivity window.
- × Abstract Recommendations: Yields generic slide decks without dollarized CapEx schedules for purchase price negotiation.
Automated AST Packing & Dual-Engine Audit
- ✓ Automated AST Code Packing: Full repository ingest using
repomixinto structured AST contexts for deep semantic and static analysis. - ✓ Dual-Engine Deep Analysis: Cross-validating architectural patterns, security controls, and copyleft licenses directly against the git tree.
- ✓ Direct Principal Review: Delivered exclusively by Dr. Andrew Adams, CISSP (Doctorate in Computer Science). Zero junior analyst hand-offs.
- ✓ 4-Day Sprint & Dollarized CapEx: Completed in 4 to 5 days under active LOI, converting technical debt into financial models for escrow holdbacks.
What We Audit: 4 Core Pillars
Every technical due diligence sprint investigates four foundational dimensions of the target company's software asset, infrastructure posture, and intellectual property.
Multi-Tenant Isolation
Verifying that enterprise customer data is mathematically and architecturally segregated across shared databases, caching tiers, and API routing layers.
- • Row-Level Security (RLS) & tenant identifier scoping
- • Cross-tenant data bleed risks in background job queues & cache keys
- • JWT claims verification, session token scoping, and API authorization gates
Cloud & IAM Blast Radius
Evaluating the blast radius of target cloud infrastructure (AWS/GCP/Azure) to uncover runaway costs, catastrophic single-point failures, or privilege escalation paths.
- • Infrastructure-as-Code hygiene (Terraform/OpenTofu drift & manual edits)
- • Wildcard IAM privileges (
*.*) and cross-account assume-role chains - • Hardcoded secrets in git history, unencrypted buckets, and public egress
Open-Source & IP Contamination
Protecting transaction valuation by identifying viral copyleft licenses, dual-licensing traps, or uncredited third-party components embedded in proprietary code.
- • Direct and transitive copyleft liabilities (AGPL-3.0, GPL-2.0, SSPL)
- • Software Bill of Materials (SBOM) generation & stale library risks
- • Proprietary IP boundaries and clean-room asset verification
Adversarial AI Architecture
For targets marketing AI or embedding generative features: auditing whether the underlying models are defensible, secure, and isolated from customer privacy liability.
- • RAG vector data boundaries & tenant separation in Pinecone/Milvus/pgvector
- • Model egress leakage and training data retention agreements with LLM vendors
- • Prompt injection resilience and uncontrolled tool-use agent execution
Deliverables (IC-Ready & Financialized)
We translate engineering debt directly into investment committee terms: quantifiable risks, scalability ceilings, and dollar-denominated CapEx models.
5-Page Investment Committee Brief
A high-density, concise memorandum crafted specifically for General Partners, Investment Committee members, and Operating Partners. Zero fluff.
Day-1 to Day-100 Remediation CapEx Schedule
Engineering debt translated directly into contractor hours, FTE requirements, and concrete dollar figures enabling purchase price adjustments or escrow holdbacks.
4-Day Sprint Timeline Under Active LOI
Designed specifically to execute inside compressed deal exclusivity windows without disrupting target operations.
Data Room Access & Ingestion
Mutual NDA execution. Provisioning read-only GitHub/GitLab access, AST repo packing via repomix, and cloud IAM read-only role setup.
Extraction & CTO Walkthrough
90-minute structured technical walkthrough with target CTO/VP Engineering. Dual-engine deep codebase analysis, AST dependency graphing, and copyleft scans.
Threat Modeling & CapEx
Multi-tenant boundary verification, IAM attack path mapping, AI vector pipeline audit, and translation of identified issues into dollarized remediation schedules.
IC Memo & Readout Call
Final 5-page Investment Committee Brief delivery. 45-minute executive readout call with Deal Partners, VPs, and Operating Executives to field live Q&A.
Evaluating a software target under active LOI?
Time is the enemy of closed transactions. Secure your 4-day sprint turnaround before exclusivity windows expire. All intakes are strictly confidential and protected under our standard Mutual NDA.
Diligence Sprint Request Logged
Thank you. Dr. Adams will review your target profile and respond within 1 business day with our standard mutual NDA and data room provisioning instructions.