How Problem Assets Expose Hidden Tech Risks in M&A Due Diligence

When one tech company acquires another, technical due diligence is essential. But here’s what most buyers miss: how the target company handles its problem assets — those tricky software systems, code issues, or infrastructure quirks — can make or break the entire deal. I’ve spent years reviewing tech targets, and this is often where the real story unfolds.

The Hidden Risks in Problematic Tech Assets

In M&A, “problem asset” doesn’t mean a dusty server or outdated laptop. It means software systems, code repositories, or technical infrastructures that look fine at first glance but carry silent risks. These often come with trust signals — SOC 2 reports, compliance badges, or legacy certifications — that, like a shiny grade on a rare coin, suggest everything’s under control.

But just as a coin might hide flaws beneath its slab, a codebase can mask serious issues behind compliance paperwork. I’ve seen deals nearly collapse when a buyer realized the target’s “secure” system had never been stress-tested for real-world threats. Others closed at inflated prices because a single unpatched vulnerability was overlooked.

The difference between a smart acquisition and a costly mistake? It’s not just what’s broken — it’s how the company responds. Are they upfront about known issues? Do they have a plan to fix them? Or are they hiding behind certifications and hoping no one asks too many questions?

Certification Does Not Equal Perfection

Think of certifications like a clean bill of health. A SOC 2 report or ISO 27001 certification shows a company meets standards — but it doesn’t mean their code is secure, their systems are stable, or their tech debt is under control.

I once reviewed a SaaS startup that proudly showcased its SOC 2 compliance. Sounds solid, right? But during our code quality audit, we found API keys hardcoded into a legacy microservice — a basic security no-no that had been there for months. The certification process had missed it because no one was actively monitoring or testing that service. Penetration testing later confirmed it was exploitable.

That gap between “compliant” and “secure” is where many deals go sideways.

What to do instead: Treat certifications as a baseline, not a finish line. Follow up with:

• Independent code reviews
• Penetration testing
• Automated static analysis (tools like SonarQube or Snyk)

Code Quality Audit: The Foundation of Trust

A thorough code quality audit isn’t just about catching bugs. It’s about understanding how well the team maintains, documents, and evolves their software. This is where you spot the tech debt that could sink your ROI.

Red Flags in Code Quality

Here’s what I watch for in every codebase:

• High cyclomatic complexity — when logic gets too tangled, it’s a maintenance nightmare
• Duplicate code blocks — a sign the team isn’t refactoring or reusing well
• Missing or outdated comments — often means knowledge is siloed or lost
• Deprecated libraries or frameworks — a ticking clock on future fixes

One of the most telling signs? A flood of ‘TODO’ and ‘FIXME’ comments. In one case, a company had over 1,200 unresolved ‘FIXME’ notes — many flagged as critical security patches that were pushed off due to “budget” or “timeline.” That’s not technical debt. That’s a liability.

Practical Example: Detecting Forgotten Tech Debt

Take this real snippet from a legacy API:

// FIXME: Refactor this query to prevent SQL injection
// (Old team left, no one touched it)
const query = `SELECT * FROM users WHERE id = ${userId}`;

This isn’t just bad code. It’s a known security risk that was ignored. And now it’s part of your acquisition. Fixing it post-deal? Costly. Time-consuming. And likely delayed because it’s buried in a larger system.

What to do: Use tools like SonarQube or GitPrime to get a clear picture of technical debt. Build a simple risk score based on:

• Number of critical open issues
• Time since last major refactor
• Code churn in key modules

Scalability Assessment: Can the System Grow?

A system that works for 10,000 users might fail at 50,000. A ‘problem asset’ here isn’t broken — it’s over-optimized for the present and unprepared for the future.

Scalability Red Flags

• Monolithic architecture with no modularization — hard to scale, hard to test
• Single points of failure (SPOF) — one database crash takes everything down
• No automated scaling (e.g., missing Kubernetes or cloud autoscaling) — manual fixes under load
• Manual deployments — slow, error-prone, and not repeatable

I evaluated a fintech startup with 100k users. Their database? A single PostgreSQL instance, no replication. At current load, it worked fine. But when we ran load testing, it failed 90% of requests at just 5x traffic. Not a bug — a future crisis.

Actionable Test: Load Testing

Don’t take their word for it. Insist on real-world load testing with tools like:

• JMeter — for API stress testing
• Locust — to simulate real user behavior
• K6 — ideal for cloud-native apps

Compare results to their growth plans. If performance drops by more than 30% at 2x load, that’s a red flag. You’re not buying today’s product — you’re buying its potential.

Technology Risk Analysis: Beyond the Code

Tech risk isn’t just about lines of code. It’s about people, processes, and dependencies — the invisible threads that hold a system together.

Hidden Dependencies

Many problem assets are tied to outdated or unsupported services. I once found a core product relying on an analytics tool scheduled to shut down in six months — a detail missing from every investor deck.

Other examples: a payment gateway using a deprecated API, or an authentication system relying on a vendor that stopped supporting it. These aren’t bugs. They’re time bombs.

Vendor and License Risks

• Open-source license compliance (e.g., GPL violations) — could force source code release
• Proprietary software with restrictive licensing — limits customization or resale
• Vendor lock-in (e.g., AWS-only features) — makes migration expensive

Build a Technology Dependency Map early. List every third-party service, API, and library. Flag any with:

• No active updates
• Upcoming deprecation
• Legal or compliance exposure

Disclosure and Transparency: The Ethical Dimension

Just as a coin dealer should disclose a repair, a tech company should be honest about its known issues. Yet all too often, due diligence uncovers undisclosed vulnerabilities or unpatched bugs that weren’t shared in the data room.

I reviewed one company whose authentication system had a critical flaw. When I asked, the CTO admitted it was known — but “low priority.” That wasn’t a technical issue. It was a cultural one. And it killed the deal.

Best Practices for Disclosure

• Provide a tech risk register listing known issues and mitigation plans
• Share internal post-mortems and incident reports
• Allow independent penetration testing — not just a partial scan

Buyers: demand this. If the team resists or downplays concerns, walk away. Trust isn’t optional in M&A.

The Due Diligence Mindset

Evaluating a tech target isn’t about finding perfection. It’s about uncovering the real risks before they become yours. Whether it’s a codebase with silent vulnerabilities, a system that can’t scale, or a dependency on a failing service, the goal is clarity.

To get there, focus on:

• Auditing code quality — not just what’s written, but how it’s maintained
• Testing scalability — not under ideal conditions, but under stress
• Mapping technology risks — beyond code, into systems, vendors, and licenses
• Demanding transparency — because honesty is the best due diligence

Remember: a certification won’t save you from a bad codebase. And a ‘problem asset’ isn’t always a dealbreaker — but ignoring it usually is. My job as a consultant? To surface the unknowns. So when you close the deal, you know exactly what you’re getting — and what you’ll need to fix.

Related Resources

You might also find these related articles helpful:

• A CTO’s Strategic Guide to Evaluating Risk in High-Value Technology Acquisitions – I’ve sat across the table from founders, legal teams, and my own engineers hundreds of times. Each technology acquisitio…
• How Deep Knowledge of Coin Auctions Can Lead to a Career as a Tech Expert Witness in Legal Tech – When software is central to a legal fight, attorneys need more than just lawyers—they need tech experts who can stand up…
• My Blueprint for Writing a High-Impact Technical Book on Niche Auction Markets (And How You Can Too) – Want to know a secret? Writing a technical book isn’t about fancy jargon or trying to sound like a textbook. It&#8…