Reference guide

Technical due diligence, mapped end to end

The nine dimensions a full technical due diligence covers, the methods and tools behind each one, and where an automated analysis can stand in. A neutral map of how engineering teams read a codebase before an investment, an acquisition or a board decision.

9
Dimensions
6
Disciplines
40
Methods
59
Tools

The comparison

Traditional TDD, and Codeego

The same nine dimensions a full technical due diligence covers, and where an automated analysis can stand in.

Traditional approach

Expert team-led TDD

2-10 wks

Typical duration

$10k-$500k

Typical cost

Dimensions covered

1. Scope the engagement

Define goals, timeline, access level

2. Codebase review

Quality, structure, tech debt

3. Architecture review

Scalability, patterns, dependencies

4. Security assessment

Vulnerabilities, secrets, auth

5. Infrastructure & DevOps

CI/CD, deployments, monitoring

6. Team & process review

Skills, docs, velocity, bus factor

7. Data & IP review

Licences, OSS, proprietary assets

8. Economic valuation

Cost to build, LOC, team-months

9. Risk scoring & report

Red, amber, green, recommendations

Full human-led assessment. Requires repo access, stakeholder interviews and multi-week coordination across all nine dimensions.

Codeego

Automated analysis, report in minutes

< 20 min

Time to report

Full

Economic valuation

8 / 9

Dimensions covered

1. Scope the engagement

Source (Git or ZIP), scenario inputs

partial

2. Codebase review

Code quality, LOC, complexity, duplication

full

3. Architecture review

Architecture signals, dependency health

full

4. Security assessment

Semgrep SAST, secrets, dependencies, OWASP

full

5. Infrastructure & DevOps

Infra inventory, Docker, K8s and IaC signals

full

6. Team & process review

Inferred team size, process maturity

partial

7. Data & IP review

Licence check, IP custody, SBOM

partial

8. Economic valuation

Deterministic hours, build-cost ranges

full

9. Risk scoring & report

Red, amber, green, findings, recommendations

full

Automated coverage on eight of nine dimensions, with full depth on codebase, architecture, security, infrastructure and economic valuation. Partial on team process and data and IP, where live interviews and vendor contract review still need a human. A fast, defensible technical view of the codebase, not a replacement for a full human-led due diligence.

Codeego coverage by dimension

ScopePartial
Codebase qualityFull
ArchitectureFull
SecurityFull
Infra & DevOpsFull
Team & processPartial
Data & IPPartial
Economic valuationFull
Risk & reportFull

The reference matrix

Nine dimensions, and how each one is assessed

Methods, tools and companies link out to their sources; companies are listed for context, not as endorsements.

Codebase & architecture
Security
Infra, DevOps & team
Data & IP
Economic valuation
Risk & report

Dimension	Methods	Tools	Companies	Duration	Cost
Codebase quality	Static analysis Complexity metrics Test coverage Code churn Manual review	SonarQube SonarCloud CodeClimate Coverity Lizard Code Maat git log / blame	Thoughtworks Black Duck N-iX Avenga Moravio	2-6 wks incl. in full TDD	$10k-$200k depends on tier
Architecture	Architecture diagrams Dependency analysis Load testing API review Schema review	Structurizr C4 Model Dependency-Track Madge dep-cruiser k6 Gatling Jaeger	Accenture Capgemini Sphere Partners Quandary Peak Forbytes	2-6 wks incl. in full TDD	$10k-$200k depends on tier
Security	OWASP Top 10 SAST Secret scanning SBOM & CVE Pen testing Auth & IAM	Semgrep Snyk Bandit Brakeman TruffleHog GitLeaks OWASP ZAP Trivy Syft Grype	NCC Group Rapid7 CrowdStrike Bishop Fox	1-3 wks standalone workstream	$15k-$80k scope-dependent
Infra & DevOps	CI/CD review Cloud config Observability audit DR & backup Cloud cost analysis	Checkov tfsec AWS Trusted Advisor Grafana Prometheus Datadog New Relic Infracost GitHub Actions Jenkins	Capgemini Avenga Forbytes Thoughtworks	2-5 wks incl. in full TDD	$10k-$100k cloud complexity varies
Team & process	Engineer interviews Bus factor analysis DORA metrics Docs quality Post-mortems	LinearB Waydev Jellyfish Jira Linear Confluence Notion git shortlog	McKinsey BCG Bain EY-Parthenon Deloitte	1-3 wks interviews add time	$8k-$80k depends on team size
Data & IP	OSS licence audit IP ownership GDPR / privacy Vendor contracts Data retention	FOSSA Black Duck OneTrust Spirion Nightfall	Black Duck (Synopsys)FOSSA Deloitte PwC KPMG	1-2 wks legal opinion adds cost	$5k-$30k scan is low cost
Economic valuation	COCOMO II Function point analysis Team-months from git Replacement cost Tech debt discount	cloc scc COCOMO II calculator Glassdoor Levels.fyi git log	McKinsey BCG Bain Deloitte KPMG PwC	1-3 wks combined with code review	$5k-$50k add-on to main TDD
Risk & report	RAG risk matrix Findings prioritisation Executive summary Remediation roadmap	Notion Confluence DealRoom (VDR)Intralinks Ansarada	Toptal Expert360 GLG AlphaSights McKinsey Deloitte	3-5 days included in engagement	included part of overall fee

Codebase quality

Methods

Static analysis Complexity metrics Test coverage Code churn Manual review

Tools

SonarQube SonarCloud CodeClimate Coverity Lizard Code Maat git log / blame

Companies

Thoughtworks Black Duck N-iX Avenga Moravio

Duration

2-6 wks

incl. in full TDD

Cost

$10k-$200k

depends on tier

Architecture

Methods

Architecture diagrams Dependency analysis Load testing API review Schema review

Tools

Structurizr C4 Model Dependency-Track Madge dep-cruiser k6 Gatling Jaeger

Companies

Accenture Capgemini Sphere Partners Quandary Peak Forbytes

Duration

2-6 wks

incl. in full TDD

Cost

$10k-$200k

depends on tier

Security

Methods

OWASP Top 10 SAST Secret scanning SBOM & CVE Pen testing Auth & IAM

Tools

Semgrep Snyk Bandit Brakeman TruffleHog GitLeaks OWASP ZAP Trivy Syft Grype

Companies

NCC Group Rapid7 CrowdStrike Bishop Fox

Duration

1-3 wks

standalone workstream

Cost

$15k-$80k

scope-dependent

Infra & DevOps

Methods

CI/CD review Cloud config Observability audit DR & backup Cloud cost analysis

Tools

Checkov tfsec AWS Trusted Advisor Grafana Prometheus Datadog New Relic Infracost GitHub Actions Jenkins

Companies

Capgemini Avenga Forbytes Thoughtworks

Duration

2-5 wks

incl. in full TDD

Cost

$10k-$100k

cloud complexity varies

Team & process

Methods

Engineer interviews Bus factor analysis DORA metrics Docs quality Post-mortems

Tools

LinearB Waydev Jellyfish Jira Linear Confluence Notion git shortlog

Companies

McKinsey BCG Bain EY-Parthenon Deloitte

Duration

1-3 wks

interviews add time

Cost

$8k-$80k

depends on team size

Data & IP

Methods

OSS licence audit IP ownership GDPR / privacy Vendor contracts Data retention

Tools

FOSSA Black Duck OneTrust Spirion Nightfall

Companies

Black Duck (Synopsys)FOSSA Deloitte PwC KPMG

Duration

1-2 wks

legal opinion adds cost

Cost

$5k-$30k

scan is low cost

Economic valuation

Methods

COCOMO II Function point analysis Team-months from git Replacement cost Tech debt discount

Tools

cloc scc COCOMO II calculator Glassdoor Levels.fyi git log

Companies

McKinsey BCG Bain Deloitte KPMG PwC

Duration

1-3 wks

combined with code review

Cost

$5k-$50k

add-on to main TDD

Risk & report

Methods

RAG risk matrix Findings prioritisation Executive summary Remediation roadmap

Tools

Notion Confluence DealRoom (VDR)Intralinks Ansarada

Companies

Toptal Expert360 GLG AlphaSights McKinsey Deloitte

Duration

3-5 days

included in engagement

Cost

included

part of overall fee

See the codebase through this lens

Codeego runs the automated dimensions of this map on any repository and returns a Software Valuation Report, signed by a Trusted Third Party, in minutes.

Explore the solution