Technical due diligence is the independent, read-only assessment of a software platform before you buy it, invest in it, or bet your growth on it. In Australia it is a fixed-fee engagement — ours run from $25,000 (Express) to $45,000 (Comprehensive) per deal — that answers the question every investment committee eventually asks: what are we actually buying? This guide covers the process, what a proper assessment examines, the costs, and the checklist we work through on real deals at CISO Advisory Australia.
When investors and acquirers need it
- Private equity and venture capital — before a term sheet becomes a completed round, especially where the platform is the asset.
- Corporate development and M&A teams — acquiring a software business, or a business whose value depends on one.
- Boards approving a major build-vs-buy decision — committing to a vendor platform for a decade deserves the same scrutiny as buying the vendor.
- Founders preparing to be assessed — running the exercise on yourself before a raise or sale removes the surprises that kill valuations; that side of the engagement is covered by our platform and security assessment.
What a proper technical DD examines
A defensible assessment is read-only — no changes to the target’s systems — and independently corroborates what the data room claims. Ours covers seven areas:
- Infrastructure and architecture. What the platform actually runs on, how it scales, where the single points of failure are, and what the cloud bill says about efficiency.
- Security posture. Identity and access, exposure of data and secrets, patching discipline, and evidence of (or gaps in) security testing.
- Code quality and engineering practice. Repository health, test coverage, technical debt concentration, and whether the codebase can absorb the roadmap being sold to you.
- CI/CD and release engineering. How software gets to production, and how fast a defect can be reversed.
- Data and resilience. Backup reality (not backup policy), disaster-recovery capability, and data-governance obligations that transfer with the deal.
- Observability. Whether the team can see the platform failing before customers do.
- Key-person risk. The bus factor: how much of the platform lives in one irreplaceable head — the most common finding that changes deal terms.
The process and timeline
A typical engagement runs in four stages: scoping and access (read-only credentials, data-room review), evidence collection (systems, repositories, pipelines, interviews with the engineering team), corroboration (claims tested against operating reality), and reporting. Deliverables are built for an investment committee, not an engineering wiki: a board-ready Risk Matrix, a Findings Register with evidence, and a prioritised, costed remediation roadmap that can feed directly into deal terms, escrow conditions or the first 100-day plan. See the full method on our technical due diligence service page.
What technical due diligence costs in Australia (2026)
| Tier | Fixed fee (AUD ex GST) | Suits |
|---|---|---|
| Express | $25,000 | Smaller targets and early-stage deals needing a fast, senior read. |
| Standard | $35,000 | Full scope across all seven assessment areas. |
| Comprehensive | $45,000 | Larger or regulated targets, with an investment-committee briefing. |
Investors with regular deal flow can join the DD Panel at panel pricing with no retainer. New Zealand and Singapore targets are covered. Full fees on the pricing page.
The pre-deal checklist
Before you close, you should be able to answer yes to each of these — with evidence, not assurances:
- Has an independent party — not the target’s team, not your integration vendor — verified the platform’s security posture?
- Do you know the real availability and recovery capability, demonstrated rather than described?
- Has anyone outside the target read the code and the pipelines?
- Do you know which two people the platform cannot survive losing?
- Is there a costed remediation roadmap you can price into the deal?
Cyber-specific deal risk — breach history, undisclosed incidents, compliance debt — is covered in our companion guide to cyber due diligence in M&A.
Why independence is the whole point
Technical DD from a firm that also wants the integration work, the managed-services contract or the remediation project is a sales survey. CISO Advisory Australia sells no products and takes no downstream work from the deals it assesses — the report is the entire commercial relationship, which is what makes it defensible in front of an investment committee. To scope a deal, book a confidential call; you will have a fixed written fee before any access is granted.
Frequently asked questions
What is technical due diligence?
An independent, read-only assessment of a software platform before an acquisition or investment. It corroborates what the data room claims across infrastructure, security posture, code quality, CI/CD, data resilience, observability and key-person risk, and reports the findings in board-ready form: a Risk Matrix, a Findings Register with evidence, and a prioritised, costed remediation roadmap.
How much does technical due diligence cost in Australia?
CISO Advisory Australia charges a fixed fee per deal: $25,000 (Express, smaller targets), $35,000 (Standard, full scope) and $45,000 (Comprehensive, larger or regulated targets with an investment-committee briefing), AUD ex GST. Investors with regular deal flow can join the DD Panel at panel pricing with no retainer.
How long does technical due diligence take?
Typically 10 to 15 business days from access to report, depending on the tier and the target's size. Express engagements on smaller targets run faster; comprehensive assessments of regulated targets sit at the longer end.
Is the assessment safe for the target's systems?
Yes — it is strictly read-only. No changes are made to the target's systems, repositories or pipelines; access is scoped and credentialed for observation and evidence collection only, under confidentiality appropriate to a live deal.
Why does independence matter in technical due diligence?
Because a DD provider who also wants the integration, remediation or managed-services work downstream has a commercial interest in what the assessment finds. CISO Advisory Australia takes no downstream work from deals it assesses — the report is the entire engagement, which is what makes it defensible to an investment committee.
Need this handled for your organisation?
Confidential and no obligation. We respond the same business day — on-site same day / next business day, or remote, Australia-wide. Prefer to talk now? Call us 24/7 on 07 2112 8502.