How to choose a technical due diligence firm

Choosing a technical due diligence firm is a matter of six checkable criteria, and the reason to hold to them is that the usual shortcuts do not work: the published lists of top firms are mostly written by firms on the lists, and the directory rankings measure reputation rather than method. The criteria below can be tested in a thirty-minute call and a one-page quote, and they are the same for a seed fund buying a screen and a buyout team buying a full review.

Reveneau is one of the firms an investor can choose, and this page names it once: it runs reviews to the report template published on this site, states scope before price, and has no stake in whether a deal closes. That is a description of the offer, and the criteria below are the way to check it, or any other firm's, against something other than its own website.

For what the review should cost, read what technical due diligence costs. For how deep it needs to go, read scope by stage. The pillar guide covers the review itself.

Why is a list of the top firms a poor guide?

You cannot rely on a list of top firms because the lists are, in the cases we checked, compiled by a firm that appears on its own list. N-iX's "Tech due diligence firms: Vendor list, 2026 edition" (updated 2026-02-25) places N-iX first and states that its selection "involved analyzing multiple sources, including Clutch.co, The Manifest, GoodFirms, vendors' websites, and LinkedIn accounts". Dextralabs' "Top Tech Due Diligence Agencies" (updated 2026-03-23) names Dextralabs in seven of its regional sections. Neither is hiding anything; both are marketing pages for the firm that wrote them, and a reader who takes them as independent has been misled by nobody but the search engine.

The rules that apply are consumer protection rules. The FTC's final rule on consumer reviews and testimonials (2024-08-14) "prohibits a business from misrepresenting that a website or entity it controls provides independent reviews or opinions about a category of products or services that includes its own products or services", and its updated Endorsement Guides (2023-06-29) require disclosure of material connections between an endorser and the business. A list a firm writes about its own category is fine as marketing and useless as a ranking, and the test is whether the publisher is on the list.

Directory rankings are a different case. Clutch says, by its own account, that it ranks companies with "a proprietary ranking algorithm" on five criteria: the number, quality and recency of client reviews, work experience, market presence and industry recognition, services offered, and presence in a location. Those measure how a firm is regarded and how it presents itself. None measures whether its reviewers open a repository.

What are the six criteria?

The six criteria are method, scope before price, independence, deliverable, presence and availability, and each one has a question that tests it in a first call.

Criterion	What it means	The question that tests it
1. Method	The people who write the report read the code, run the scans and do the interviews themselves	"Who on the engagement will have read access to the repositories, and what will they read first?"
2. Scope before price	The proposal states products, access, interview count, duration and deliverable, and then a figure	"Send me the scope you are pricing before you send the price."
3. Independence	No fee that depends on the deal closing; no engagement with the target or a bidder; no product the firm will sell after close as a condition	"Is any part of your fee contingent on the outcome, and have you worked for the target or any other party to this deal?"
4. Deliverable	A report with a written severity scale, a verification method on every finding, a cost to fix, and a list of what could not be verified	"Show me a redacted report, and show me where the unverified list is."
5. Presence	The lead reviewer will present to the investment committee and answer questions from counsel	"Who presents, and are they the person who read the code?"
6. Availability	The firm can start inside the deal's window without swapping in people it did not name	"Who is staffed, by name, and what happens if the deal moves a week?"

The first criterion carries the most weight, because a firm that outsources the reading to a scanning tool and writes the report from its output produces findings without judgement. Ask to see how a finding moved from observation to severity in a past report; the answer shows whether a person made the call.

What should you ask about the reviewers themselves?

Ask who will do the work, by name, and what they have built and operated themselves, because the quality of a technical review is the quality of the two or three people reading the code. A firm's size, age and client list say little about the reviewer you will get.

Three questions do most of the work. What systems have you run in production, and at what scale? A reviewer who has carried a pager reads an incident log differently from one who has not. What is the last codebase you read that changed your mind about a company? The answer shows whether the reviewer looks for evidence against their first impression. And what will you refuse to conclude without access? A reviewer who will write "we could not verify this" is worth more than one who will write around the gap.

Ask also how the firm handles AI-written code, because a rising share of target codebases contains it and the questions are different: provenance, licence exposure and the review process behind the generation. Diligence on an AI-written codebase covers what a firm should be able to say. A firm with no answer is a firm that has not met the question yet.

How do you compare quotes that do not match?

Compare quotes by scope, hours and seniority rather than by total, because two firms pricing "technical due diligence" are usually pricing different products. The vendor-stated ranges on the cost page run from $5,500 for a one-week screen (Dextralabs, updated 2026-09-02) to $50,000 to $150,000 for a Big Four engagement (Papermark, 2025-10-27), and a low quote next to a high one may be a screen next to a full review.

Three steps make the comparison honest.

1. Send every firm the same one-page scope. Products, repositories and their size, engineer count, the access you will secure, the interview count, the deadline, and the deliverable you want. VeryDiligent's cost page (2026-06-04) names complexity, scope, speed and access as its four price drivers, and a scope that fixes all four gets quotes that can be compared.
2. Ask for hours and seniority behind the total. The only published hourly bands are Papermark's: $300 to $600 per hour for specialist firms and $400 to $700 for Big Four technology practices (2025-10-27). A total divided by a rate in that band tells you how many hours of whose time you are buying.
3. Read the deliverable, not the proposal. A redacted past report shows the severity scale, the verification column and the unverified list, or shows their absence. The proposal is written to win; the report was written to be read.

A quote that comes back against a different scope is a different product. Ask the firm to re-price the scope you sent, or drop it from the comparison.

What should make you walk away from a firm?

Walk away from a firm whose fee depends on the deal closing, that will not name its reviewers, that prices before it scopes, or that cannot show a past report with an unverified list. Each of those is a sign that the report will be shaped by something other than what the reviewers found.

Two softer signals are worth weighing. A firm that promises a verdict ("we will tell you whether to invest") has misunderstood the job, which is to price the risk so the deal team can decide; what technical due diligence is covers why the output is a cost rather than a yes or no. And a firm that also sells the remediation should say so and should be judged on whether its report sends work its own way: a Critical finding whose only remedy is the firm's own engineers deserves a second opinion.

None of the criteria above depends on a list, a directory or a claim of past work, and that is deliberate. The evidence for a firm is the report it will write, and the criteria are the way to see that report before paying for it. If the offer described above fits the criteria, the investor page describes it; if another firm's does, the criteria will show that too.