What technical due diligence costs, and why published figures disagree

Technical due diligence costs between $5,000 and $150,000 per review across the firms that publish a price, and the reason the range is thirty to one is that the firms are pricing different pieces of work under the same name. Some of those figures describe a one-week look for deal-stopping problems. Others describe a month of code reading, interviews and a written report. A buyer who compares the low end of one against the high end of another learns nothing.

This page collects every vendor-stated figure we could fetch and confirm on 2026-09-17, attributes each one, and explains what moves a review from one end of the range to the other. It does not give a Reveneau price, because a price without a scope is exactly the problem this page is about. What Reveneau does on this topic is state, in the proposal, the scope, the access assumed, the interview count and the deliverable before naming a figure, so the number can be compared with any other quote line by line.

If you have not yet decided whether to commission a review at all, start with the pillar guide and what technical due diligence is. If you are budgeting for a specific stage, scope by stage is the companion to this page.

What do the firms that publish prices say technical due diligence costs?

Five firms and two comparison sites publish a figure. The table lists each one as stated on the page it came from, with the scope the page attaches to it. Every entry is the publisher's own claim about its own price or its own view of the market, and we have not audited any of them.

Publisher and page	Stated price	Stated scope and duration	Date
MEV	$5,000 to $30,000	"depending on the size and complexity of the system, quoted upfront"; "2 to 4 weeks"	updated 2026-08-05
Papermark, specialist tech firms	$35K to $95K, at $300 to $600 per hour	"SaaS, software companies"	2025-10-27
Papermark, Big Four tech advisory	$50K to $150K, at $400 to $700 per hour	"Tech acquisitions"	2025-10-27
Peony, US software and tech	$5k to $25k	workstream line in a table of all diligence types	2026-03-12
Peony, UK comprehensive software technical DD	£20k to £100k; large enterprise audit £150k+	same table	2026-03-12
VeryDiligent, red flag assessment	10,000 to 15,000 euros	"identify showstoppers quickly"; "five to seven business days"	2026-06-04
VeryDiligent, standard	20,000 to 30,000 euros	"architecture, code quality, security, infrastructure, and engineering team"; "two to three weeks"	2026-06-04
VeryDiligent, large or complex	30,000 to 50,000 euros and up	"multiple products, large engineering teams, complex technology stacks, or significant regulatory requirements"	2026-06-04
Dextralabs, Dipstick	$5,500	"1 week"; "stack review, architecture check, code & cloud assessment"	updated 2026-09-02
Dextralabs, Comprehensive	$22,000 to $50,000 in one table, $13K to $21K in a second table on the same page	"3 to 4 weeks" in the first table, "3 to 5 weeks" in the second	updated 2026-09-02

Two of these are comparison sites rather than diligence firms. Papermark and Peony sell data room software, and their figures are their view of what other firms charge, with no method stated for how they arrived at them. MEV, VeryDiligent and Dextralabs are firms quoting their own prices. The Dextralabs page carries two different ranges for the same product name, which is a useful reminder that a published figure is a marketing page, and marketing pages drift.

Why do the published figures disagree so much?

The figures disagree because the word "review" covers at least three different products, and each publisher prices the one it sells. Once the products are separated, the ranges overlap far more than the headline spread suggests.

The one-week screen. Dextralabs' $5,500 Dipstick and VeryDiligent's 10,000 to 15,000 euro red flag assessment are the same shape: a few days, a small team, and a single question, which is whether anything here should stop the deal. There is no full code read, and interviews are few. Peony's US figure of $5k to $25k sits mostly in this band.

The two to four week review. MEV's $5,000 to $30,000, VeryDiligent's 20,000 to 30,000 euros, and Dextralabs' comprehensive tier all describe a review that reads the code, interviews the engineers, looks at infrastructure and security, and ends in a written report. madewithlove, which does not publish a price, describes the same product: finishing "within 2 weeks, conducting up to 8 interviews and a deep code review", delivered as "a written, qualitative report". This is the product most venture and growth deals buy.

The large-deal engagement. Papermark's $35K to $95K specialist band and $50K to $150K Big Four band, and Peony's £20k to £100k and £150k+ UK figures, describe reviews attached to larger transactions: more products, more teams, more people on the reviewing side, and a report that has to survive a lender, a board and a lawyer. The hourly rates Papermark states, $300 to $700, imply 100 to 250 billed hours at the low end of each band.

So the ranges are three products, and a firm's published range tells you which product it mainly sells. It does not tell you what your deal needs.

What drives a technical due diligence price up or down?

Four things move a quote, and a good proposal names all four. VeryDiligent's own page lists the same set: target complexity, assessment scope, delivery speed, and access quality.

The size and age of the codebase. A three-year-old monolith in one language reads faster than a decade of services across four languages with two rewrites in the history. Reviewers price by how long the read takes, so line count, repository count and language count all move the number.

How many products and teams are in scope. One product with one team is one review. A company assembled through acquisitions, with three products on three stacks maintained by three teams, is three reviews with a summary on top. VeryDiligent prices this explicitly as its large tier.

How fast the answer is needed. Every firm that discusses speed says the same thing: compressing two to three weeks into one costs more, because more reviewers work in parallel and the schedule loses its slack. If the deal has an exclusivity clock, say so in the request for a quote, because the quote will change.

How much access the target gives. Read access to the repositories, the cloud console and the incident history makes a review cheaper than one that works from screenshares and slide decks, because verified findings take less time to reach than reported ones. How to run technical due diligence covers what access to ask for. A target that limits access is buying a more expensive and less certain review.

What does the price actually buy?

The price buys a written report, the interviews and reading behind it, and a person who will defend the findings in front of the investment committee. The variation in price is mostly variation in how much of each of those you get.

At the screen end, the deliverable is a short memo of red flags and a verbal readout. At the two to four week end, it is a report of the shape described on the report structure page: findings by area, each with a severity, an owner and a cost to fix, plus an executive summary written for people who will read only that page. At the large-deal end, add a longer appendix, a lender-ready version, and follow-up sessions with the deal team and the target.

Ask, before you sign, which of the following are included and which are extra: the number of interviews, whether the reviewers read code directly or rely on what the target shows them, whether a security scan is run, whether the cloud bill is analysed, whether open source licences are inventoried, and whether the firm will present to the committee. Each of those is a line that moves the price when it moves from "included" to "additional".

How should an investor budget for it?

Budget the review as a share of the cost of being wrong, and then check it against the published bands. The published prices give you the market's shape; the deal gives you the number that matters.

Two anchors help. The first is the cost of the finding that changes the deal. A review that finds a single-person dependency on the core system, a copyleft licence in the proprietary code, or a cloud bill growing faster than revenue pays for itself many times over on one finding, and each of those has its own page: assessing the engineering team, open source licence due diligence and cloud cost due diligence.

The second is time. The only published study of diligence hours against returns is the Wiltbank and Boeker angel study of November 2007, covering 539 angels and 1,137 exits: investors who spent more than the median twenty hours on diligence saw an overall multiple of 5.9X, against 1.1X for those below the median, and the top quartile above 40 hours saw 7.1X. That is angel diligence as a whole rather than technical review alone, and it is a correlation in self-reported data, so treat it as a reason to spend the hours rather than a promise of the multiple.

How to get quotes that can be compared

Send every firm the same one-page scope and ask for a price against it. The scope should name the products, the repositories and their approximate size, the number of engineers, the access you will secure, the number of interviews you expect, the deadline, and the deliverable you want. A quote that answers a different scope is a different product, and the table above shows how far the price moves when the product changes.

When you read the quotes, compare hours and seniority as well as totals. Papermark's hourly bands, $300 to $600 for specialists and $400 to $700 for Big Four teams, are the only published rates we found, and a total divided by a rate tells you how many hours of whose time you are buying. How to choose a technical due diligence firm takes the comparison beyond price. If you want the review run for you, the investor page describes the engagement.