Platform IntelligencePlatform Intelligence

Due Diligence

What Investors Should Ask Before Buying a Software Business

A concise due diligence question set for platform, team, process, security, and roadmap risk.

Buying a software business means buying more than the product. It means buying the platform, the team, the delivery process, the security posture, the roadmap constraints, and the operational habits that keep the product running.

The right questions make hidden risk visible before the deal closes.

Platform Questions

Investors should ask:

  • What are the core systems and dependencies?
  • Which parts of the platform are most critical to revenue?
  • What will break first as the business grows?
  • Which components are hard to change?
  • What is the realistic cost of modernisation?

The answer should connect architecture to the investment thesis.

Delivery Questions

Delivery health reveals whether the company can keep improving the product.

Ask how often the team releases, how releases are tested, how incidents are handled, and whether roadmap commitments match actual engineering capacity.

A team that ships safely and learns from production has more options than a team relying on heroics.

Security Questions

Security diligence should ask how sensitive data is protected, how access is controlled, how dependencies are updated, and whether customer security requirements can be met.

For enterprise or regulated products, security maturity can affect revenue directly.

Team Questions

Technical risk often depends on people.

Who understands the critical systems? What knowledge is documented? Which contractors or vendors are essential? Can the team onboard new engineers? What happens if a key person leaves?

Roadmap Questions

The most important question is whether the technology can support the plan.

If growth depends on enterprise customers, new integrations, geographic expansion, or higher transaction volume, diligence should test those assumptions against the current platform.

The Output Should Support Action

Good diligence does not just identify risk. It should explain what to do next:

  • What affects valuation?
  • What needs attention before close?
  • What should happen in the first 90 days?
  • What can wait?

Investors need enough technical clarity to make a commercial decision.

Back to blog posts