Technology due diligence in PE: the red flags that now move price

Bain's 2026 midyear private equity report describes a market in which the maths of buyouts has hardened. A deal that required only 5% annual EBITDA growth to generate a 2.5x return a decade ago now requires closer to 10% to 12%. Holding periods are approaching seven years, and PE firms are sitting on around 33,000 unsold portfolio companies. Buyers have less room for error, and every item that slows growth or adds cost is examined.

Technology is where that scrutiny concentrates. Bain reports that tech deal value slumped by 70% from the fourth quarter of 2025 to the first quarter of 2026, as fewer large software transactions cleared, and that software valuations in PE portfolios fell roughly 8% overall through 31 March. The decline was 4.2% in Europe against 8.9% in the US. Software buyers are therefore pricing both the growth they expect and the disruption they fear.

For a CIO or CTO preparing a company for sale, the implication is that technology is no longer a supporting section of the information memorandum. It is a driver of value and, to a buyer, a source of risk to growth. A buyer who must find 10% to 12% annual EBITDA growth will want to know whether the platform can support it, whether the product roadmap is realistic and whether the cost of running the estate will rise.

What to do: write down the three growth assumptions in your equity story that depend on technology, and test each. Can the platform scale to double the volume? Can the team ship the roadmap at the pace assumed? Can you add customers without proportionately adding cost to serve? If the honest answer to any is uncertain, that is where a buyer will probe, and where a price adjustment is most likely.

McKinsey's research on technical debt gives the clearest framing. It reports that CIOs estimate tech debt amounts to 20 to 40 per cent of the value of their entire technology estate, that it accounts for about 40 per cent of IT balance sheets, and that companies pay an additional 10 to 20 per cent on top of the costs of any project to address it. Some 30 per cent of CIOs surveyed believe more than 20 per cent of the technical budget meant for new products is diverted to resolving issues related to it.

These numbers translate directly into diligence. A buyer's technology team will estimate remediation cost, usually by reviewing the architecture, code quality, end-of-life components, hosting arrangements and the proportion of engineering time spent on maintenance. The result is a cost to modernise, which can be set against the price. It is also a drag on the growth plan, because engineers spent clearing debt are not building product. Both effects reach the model.

McKinsey also finds that as much as 71 per cent of the impact from business transformations depends on technology. That is the buyer's logic in a sentence: a value-creation plan that depends on digital improvements, pricing engines, integrations or data products is only as good as the platform it runs on. If the platform cannot take the load, the plan's returns are at risk, and a buyer will price that risk before signing.

The implication for sellers is to treat technical debt as a balance sheet item. Catalogue it, by system, by cause and by remediation cost. Distinguish debt that is a conscious trade-off from debt that is neglect. Show which items are already funded in the budget and which are not. A buyer who sees a schedule, an owner and a funded plan will usually discount for the unfunded portion only. A buyer who finds the debt on their own will assume it is larger.

Sellers sometimes fear that disclosing debt invites a discount. In practice the discount for undisclosed risk is larger, because the buyer prices uncertainty at the upper end of the range. Disclosure with a plan converts uncertainty into a bounded cost. The structure of the register matters: separate debt that constrains growth, such as a platform that cannot scale, from debt that only increases running cost. The first is a threat to the equity story; the second is an operating improvement that a buyer may be happy to own. Making that distinction is the job of the CTO, and it is where technical judgement adds the most value.

IBM's Cost of a Data Breach report put the global average cost of a breach at US$4.44 million in 2025 and US$4.99 million in 2026, a 12 percent increase. In the US, the average rose from a record US$10.22 million to a record US$11.5 million per incident. The 2026 report finds that the mean time to identify and contain a breach rose to 247 days, and that breach lifecycles longer than 200 days averaged US$5.65 million, up from US$5.01 million the year before.

The relationship between speed and cost is a diligence question. A target with no tested incident response plan, limited logging or no security operations capability is likely to take longer to detect and contain a breach, and therefore to face a higher bill. Buyers use these figures to translate a qualitative finding into a financial one, such as an exposure of several million dollars that can be addressed through a retention, an indemnity or a funded remediation plan.

The UK data suggest that findings will be common. The government's Cyber Security Breaches Survey 2025/26 found that 43% of businesses reported a breach in the previous 12 months, rising to 65% of medium and 69% of large businesses. Only 31% had formally assigned board-level responsibility for cyber security and only 25% had a formal incident response plan. A buyer seeing these gaps in a target is seeing the norm, but the norm is not what they will pay for.

What to do: before diligence, test the five controls buyers check first. Is there a tested incident response plan? Is multi-factor authentication universal? Are backups immutable and restored on a schedule? Is privileged access controlled and logged? Is there a board owner for cyber risk? Close the cheap gaps immediately, and prepare an evidence pack with dates, owners and test results. Documented controls reduce the buyer's assumed worst case.

Buyers also compare the cost of fixing cyber and legacy weaknesses with the cost of the value-creation plan itself. Deloitte's 2026 cost transformation survey found that 55% of leaders pursuing AI cost reduction admit their current IT platforms are not ready to deploy these tools. The same logic applies to a buyer's thesis: if the platform is not ready for the automation and AI that underpin the savings case, the modelled cost reductions will arrive late or not at all. A target that can show its platform is ready, or has a funded path to readiness, supports a higher price because it makes the buyer's plan credible.

The same UK survey found that only 15% of businesses reviewed the risks posed by their immediate suppliers, and only 6% scrutinised the wider supply chain. This matters in diligence for two reasons. First, a target's critical systems often depend on a small number of vendors whose resilience is unknown. Second, buyers increasingly ask for a map of third-party dependencies and the contractual rights that go with them.

A target that cannot identify its critical suppliers, their security obligations and the exit routes is carrying risk it has not measured. That risk shows up as a diligence request that the seller cannot answer quickly, which lengthens the process and weakens negotiating leverage. It can also show up as concentration risk: one cloud provider, one payment processor or one outsourced development team on which the business depends entirely.

Software businesses face a further form of third-party exposure through open-source and licensed components. Diligence teams will examine licence terms, vulnerabilities in dependencies and the provenance of code written by contractors. An undocumented dependency or an incompatible licence can become a representation-and-warranty issue and sometimes a condition of closing, because it affects the buyer's right to use and commercialise the product.

The implication is to build a third-party register before the process starts. List the vendors, the systems they support, the data they hold, the contract term and the exit plan. Rank them by criticality. Review the top ten for security assurances and concentration. This is not expensive, and it answers a category of diligence question that otherwise generates delay. It also helps the business, independent of any transaction.

AI adds risk categories that were not in the standard diligence template. IBM's 2026 report found that incidents involving shadow AI, the unapproved use of AI tools by workers, more than doubled to 43 percent, compared with 20 percent the year before. IBM's 2025 report found that 63 percent of breached organisations either had no AI governance policy or were still developing one. Buyers are therefore asking where employees use AI tools, what data they enter, and what policy governs it.

The first question is governance. Does the target know which AI tools staff and engineers use? Is customer or proprietary data entered into external models? Are there rules on acceptable use, training data rights and output review? A target without answers faces possible data leakage, intellectual property contamination and regulatory exposure. Buyers will price this in the same way they price weak security: as a probable cost plus a management distraction.

The second question is disruption, and it is particularly acute for software. Bain's data show that software valuations in PE portfolios declined roughly 8% overall through 31 March, and tech deal value fell sharply. Buyers are asking whether the product's moat survives cheaper development and AI-native competitors. A seller needs a credible answer on defensibility: proprietary data, embedded workflows, integrations, regulatory standing or distribution that AI does not erode.

What to do: create an AI inventory and a short usage policy before diligence. Record which AI tools are used, by whom and for what, and what data they touch. Prepare a one-page view of how AI affects the product's competitive position and cost base. Where AI is already improving margins or speed, quantify it. Evidence of disciplined adoption is a positive finding, and it supports the equity story rather than merely containing risk.

Technology diligence increasingly extends to trade controls, particularly for software and hardware businesses with international customers. PwC's 2024 Global Economic Crime Survey found that 59% of executives agree export controls have grown more complex in the last two years. The Department of Justice announced that Cadence Design Systems agreed to plead guilty and pay aggregate penalties and forfeiture of more than US$140 million after exporting design tools at least 59 times to a listed Chinese university. A buyer will ask whether the target classifies its products, screens end users and controls technical transfers, because a historic violation can travel with the company. Sellers should be ready with a classification register and screening records.

Not every red flag moves the headline price. In our framework, findings fall into four outcomes. A price adjustment is appropriate where the cost to fix is known and the seller should bear it. A retention or escrow is appropriate where the cost is uncertain but bounded. A specific indemnity or warranty fits where the risk is a discrete event, such as a past breach. A condition or a 100-day plan fits where the fix is a matter of sequencing and ownership.

The distinction matters because sellers and buyers negotiate differently on each. Price chips are zero-sum and contentious. A funded remediation plan is a shared project with an owner. Retentions and indemnities protect the buyer while leaving the headline price intact. An experienced seller will steer findings toward structures that preserve value, and will resist an across-the-board discount for a risk that can be bounded.

The sorting also depends on evidence. A weak control that has been tested and has a plan is a different finding from an untested control with no owner. A past breach that has been investigated, remediated and independently verified is a different finding from a suspected one. The more complete the evidence, the more likely the finding is classified as manageable. Documentation is therefore a form of negotiating leverage, not an administrative burden.

What to do: build a findings register for your own business with columns for the issue, evidence, cost to fix, owner, timeline and the outcome you would propose. Present it proactively, as part of the data room. It signals competence, shortens the diligence timeline and positions the seller as the party that frames the discussion. In a market where buyers are cautious and holding periods are long, that framing matters.

A last point on sequencing: decide with the deal team which findings should be raised with the buyer in the first management meeting and which should wait for the data room. Raising a material issue early, with the evidence and the plan, shows control and tends to shorten the later negotiation. Holding it back until the buyer discovers it invites the assumption that other issues are being withheld, and that assumption is expensive. Agree the disclosure order with advisers well before launch.

The practical sequence is simple. Six months before a process, commission an independent review covering architecture and scalability, security and resilience, data and privacy, AI use, engineering practice, and third-party dependencies. Use the findings to build a costed register, as above. Fix the quick wins within weeks, fund the medium-term items in the budget, and prepare an explanation for those that will remain at the point of sale.

Preparation also changes how the management team presents. A CTO who can speak confidently about debt, security and roadmap capacity, with figures, builds credibility with the buyer's technical advisers. A CTO who is surprised by a question undermines it. Rehearse the sessions, name a single owner for each diligence workstream and agree who may speak to the buyer's advisers. Consistency matters because inconsistent answers raise suspicion.

Buyers in the UK and Europe can also take comfort from the fact that valuations have been adjusting. Bain reports that European software marks fell 4.2% compared with 8.9% in the US, so European software assets have been less affected, but that does not exempt them from technology scrutiny. If anything, a market with fewer deals will reward the assets that are best prepared, because buyers have more choice and less appetite for surprises.

What to do now: appoint a diligence lead, set a budget for the independent review, and agree a timetable with the CEO and CFO. Share the register with the board. Decide in advance what you will fix before launch and what you will disclose. This is information for planning, not investment advice. Karter McKinley supports the preparation work, and companies should take advice from their corporate finance and legal advisers on the transaction itself.

Finally, treat the diligence as a rehearsal for ownership. Under private equity ownership, technology leaders will be asked to deliver a modernisation plan against a fixed timetable and budget. The assessment you run before sale is the first draft of that plan. Teams that have already costed their debt, mapped their dependencies and tested their controls start ownership with credibility and room to invest. Teams that have not often find the first year consumed by catch-up work that was visible, and priced, in diligence.

Karter McKinley supports CIOs and CTOs under our AI and Technology implementation service: running a pre-sale technology review, building the findings register, scoping remediation and preparing management for buyer diligence. Our role is to prepare and execute alongside the company's corporate finance and legal advisers. This is information, not investment or legal advice.