Mid-Market Deals Are Picking Up. The Tech Risk Inside Them Isn't in the Financial Model.

Deal season is back for the mid-market. EY reports U.S. deal volume rose 9% in the third quarter, driven by mid-market transactions, while megadeal value fell by half. A lot of owners and buyers want to sign before year-end.

At the same time, the technology diligence checklist got a lot longer. Cyber and AI are now standard diligence items in deals well outside the tech sector. After the late-October tech sell-off, investors are also openly questioning whether AI spending pays off. Buyers should bring the same skepticism to a target's AI story.

I've been on both sides of this. I've led technology due diligence for private equity firms evaluating a SaaS platform and a healthcare services company, and for a logistics company buying the code base behind its core system. I've also led the integration work after close: bringing an acquired offshore engineering organization into a global IT services firm, and onboarding 11 warehouses and stores onto SAP. The lesson is consistent: the technology problems that hurt you are rarely in the data room summary.

Why Technology Diligence Got Harder This Year

Four things changed the math:

• •AI is in every pitch. Targets claim AI-driven efficiency. You need to know what's real, what's licensed, what's built in-house, and who owns the data it was trained on.
• •Cyber risk transfers with the deal. A past incident, weak access controls or a lapsed insurance policy becomes your problem the day you close.
• •Software prices moved. VMware, Microsoft and Salesforce have all changed licensing. A target's IT run rate may be built on prices that no longer exist.
• •Key-person risk is higher. In many mid-market companies, one IT manager or one offshore vendor holds most of the knowledge.

Five Areas I Review Before the LOI Is Signed

• •True IT run rate. Not last year's spend. Next year's, including renewals, price increases and deferred upgrades.
• •Security posture. Reportable incidents, pen test findings and whether they were fixed, MFA coverage, backups, and how fast access is removed when people leave.
• •AI and code provenance. Approved AI tools, tools employees use without approval, and any models or code the company built. Ask where the code, models and data came from.
• •Core systems. ERP version and support dates (SAP ECC mainstream maintenance ends in 2027), level of customization, and how much technical debt the business runs on.
• •People and contracts. Who knows how things work, which vendor contracts have change-of-control clauses, and what it costs to replace either.

What This Looks Like in Practice

Three examples from engagements I've led:

• •A SaaS platform with a growth story. The architecture needed refactoring to scale, finance backups sat on USB drives in the office, and there were six to nine months of server capacity left. We rated 12 risks by impact and probability and priced each fix. The firm invested, and it paid off. Read the case study.
• •A healthcare company running on spreadsheets. The core system was built on Access and Visual Basic, with a four-person IT team. The Now/Next/Later roadmap, with a cost on every line, became the investment plan, and the firm bought the company. Read the case study.
• •A code base with no documentation. The knowledge lived in a few people's heads, and some had already left. We wrote five purchase conditions, including a year of vendor support, and the buyer closed on its terms. Read the case study.

Turn Findings Into Deal Terms

Diligence that ends in a report is half done. The findings should change the deal:

• •Price. Deferred upgrades and a security cleanup are real costs. Model them.
• •Protection. Representations on AI use and data, escrow or holdbacks for known gaps, and cyber insurance tail coverage.
• •Conditions. Require critical fixes, like MFA on remote access, before close. When buying software, require installation, cleanup and a support period.
• •Transition. If you're buying a carve-out, define the transition services agreement in detail. Vague TSAs get expensive.

Integration Starts Before Day One

The first 100 days decide whether the deal thesis holds:

• •Day one: Assign security ownership. Remove redundant accounts. Freeze nonessential changes.
• •Days 1–30: Communicate with the IT team early and honestly. Uncertainty drives your best people out the door first. Culture gaps show up here, too.
• •Days 30–100: Decide which applications, AI tools and vendors stay. Get onto one platform as soon as you can. Application rationalization and onboarding onto a common ERP are usually where the first real savings come from.

What to Do Next: A Checklist

• ☐Put a technology lead on the deal team before the LOI, not after.
• ☐Rebuild the target’s IT budget on 2027 pricing.
• ☐Request incident history, pen test results and the cyber insurance policy.
• ☐Get a written AI inventory, including tools that weren’t formally approved.
• ☐Confirm ERP version, support dates and customization level.
• ☐Identify key people and change-of-control clauses.
• ☐Translate every material finding into price, protection or a closing condition.
• ☐Draft a day-one security and access plan.

Frequently Asked Questions

Related Reading