Here's a pattern I've seen more than once. An investor runs a careful technical due diligence before a Series A. The report is good, the team fixes the main findings, and everyone moves on.
When the company raises its next round, the new investor runs their own diligence. This time the findings are different. The engineer who held most of the platform knowledge has left. Cloud costs have grown faster than revenue for several quarters. A finding from an external security test has been open for months. None of it was hidden. It just never reached the board in a form anyone noticed.
The existing investor learned about it from someone else's report, in the middle of a round they had hoped to lead.
Why the gap exists
Technical due diligence usually happens at one point in time: before an investment, or before an exit. After that, the company keeps changing, and so does the risk. For investors, most of the value is created or lost between two diligences.
So why does nobody look in between? Mostly because nobody owns it. Founders have little reason to volunteer bad news, especially with the next round in sight. Investors often don't know which technical questions to ask. And the board agenda is already full with revenue, hiring, and runway. Technology comes up when something breaks, or when the next diligence starts.
What continuous diligence is, and what it isn't
It isn't surveillance, and it isn't a full review every quarter. It means agreeing on a handful of signals, looking at them regularly, and talking about them while there's still time to act.
How much is right varies. At the light end, it's a few lines in the investor update. At the heavy end, some funds run automated scans across their portfolio, for example on open vulnerabilities or cloud spend. Most companies are well served somewhere in between.
What to watch
You don't need new tools. Most of the signals already exist in the company, and earlier editions covered them in detail. A good set mixes early warnings with signals that confirm what already happened.
Early warnings:
- People: which critical systems still depend on a single person (Edition 26)
- Technical debt: whether the debt ledger is shrinking or growing (Edition 4)
- Cloud cost against revenue: the trend, not the number (Edition 5)
- Security: how long critical findings stay open (Edition 16)
Confirmations:
- Delivery: how often the team ships, and how often a release causes problems (Edition 3)
- Incidents: how many, how long recovery takes, and whether follow-ups get done (Edition 6)
- Recovery: when a restore was last actually tested (Edition 13)
Pick five or six, and keep the definitions stable so the trend means something.
How to set it up
Agree on it at the investment. Information rights in investment agreements usually cover financials. A short technical section next to them settles the important questions early: which signals, how often, who prepares them, and who reads them. Agreed openly at the start, it feels like part of the partnership rather than control. Asking later for read access to every system is the quickest way to lose trust.
Use what the team already measures. If the CTO already tracks releases and incidents, use those numbers. A separate reporting process just for investors rarely survives the first busy quarter.
Keep it to a page and a conversation. A short quarterly note with the numbers and a few sentences of context from the CTO, then twenty minutes with someone on the investor side who understands technology. The conversation matters more than the dashboard.
What each side gets
Founders get a faster next round, because the answers to the diligence questions already exist. They get to raise problems on their own terms, with their own context, instead of having them found. And they can ask for help, a hire or an introduction, before it becomes urgent.
Investors get early warning, fewer surprises in follow-on rounds, and a clearer view of where in the portfolio their support is actually needed.
Both get something harder to measure: a working relationship built on shared numbers rather than impressions.
How the stage changes things
At seed, a few lines in the regular investor update are enough. From Series A on, a quarterly one-page tech note makes sense, and some boards make it a standing agenda item. Across a portfolio, the same short list for every company makes comparison easier, but the numbers still need context. A team in the middle of a platform rebuild will look worse for a while, and that may be exactly the right call.
Signs it isn't working
- A dashboard exists, but nobody has opened it since it was set up
- Numbers go up to the board, but no questions or help come back down
- Definitions change quietly, so the trend no longer means anything
- The next round's diligence still finds things the board didn't know
The last one is the real test. When continuous diligence works, the next formal review mostly confirms what everyone already knew, and preparing for an exit becomes much easier (Edition 28).
A few terms
- Point-in-time diligence: A review of the company as it is during the few weeks before a deal.
- Information rights: The part of an investment agreement that defines what the company reports to its investors, and how often.
Your turn
Founders: what would you be comfortable sharing with your investors every quarter? Investors: what do you actually hear about technology between rounds? I'd like to hear from both sides.
Five signals, one company. Bring one company, your own or one from your portfolio. In a free 30-minute call we'll pick the five signals worth watching and agree how often to look at them. Book one.
Next in the Playbook
Edition 30 picks up the topic I promised last time: R&D efficiency and ROI, and how to judge engineering productivity without falling for vanity metrics. Stay tuned!
Originally published on the Tech Due Diligence Playbook newsletter on LinkedIn.