The Commercial Due Diligence Funnel
Where Commercial Due Diligence is the checklist — the full inventory of what to examine — the funnel is how that checklist is sequenced into a process that disqualifies fast and concentrates effort late, where the decision gates sit, and the single "kill question" at each stage. CDD is a filter run from the first screen to signing, not a document produced at the end; its function is to convert a thesis into priced conviction, or to kill a deal cheaply before it consumes the budget.
As an illustration: a growth-stage cyber target shows 45% ARR growth and a clean headline, until cohort analysis reveals net revenue retention has slipped below 100% and the growth is bought (CAC payback north of three years), not earned. That single confirmatory finding moves the asset from a software multiple to a discount, or kills it. The headline survives the screen but not the funnel — and surfacing such findings before signing rather than after is the purpose of CDD.
Why CDD is a funnel, not a checklist
A checklist treats every line as equal weight at every stage. A funnel does the opposite: it front-loads the cheap, fast disqualifiers (does this fit the thesis? is the revenue recurring?) and reserves the expensive workstreams (cohort retention, technical architecture, customer reference calls) for the few targets that survive. The economics are demanding — confirmatory diligence on a single target costs real money and weeks of senior time, so the aim is to spend that budget on as few targets as possible. A CDD process therefore resembles a funnel with heavy attrition early and deep conviction late:
Stage 1 — Universe and thesis screen
The first cut is strategic, not financial: does the target sit in the value pool the thesis is built on, and is its revenue the kind that compounds? Two kill questions answer most of it: does it fit the acquisition thesis (right sub-segment, right life-cycle stage — filling, not draining — 26/33), and is the revenue genuinely recurring (software ARR vs. one-time/services dressed as software). A target that fails either dies here, on public information and a single call, before anyone opens a data room. For a buy-side retainer (27), this is the stage that runs continuously across a whole universe.
Stage 2 — Preliminary CDD (revenue quality and moat)
Survivors earn a look at the numbers. The dominant workstreams — and their kill questions:
- Revenue quality. Is NRR/GRN above 100% and are cohort curves holding? Net retention is the truest single quality signal in cyber; a deteriorating cohort curve is a price-breaker regardless of headline growth.
- Growth durability. Is growth from new logos and expansion (earned) or from rising spend (bought — CAC payback >2–3 years)? Rule of 40 frames the growth-vs-profitability trade.
- Moat & life-cycle. Is the differentiation data/workflow/distribution (durable) or raw tech (commoditizable)? What is the platform-bundling exposure — is Microsoft or a suite vendor draining this pool (03m)?
- Go-to-market. Channel vs. direct mix, partner concentration, marketplace traction (19).
A target that clears stage 2 has a defensible revenue base and a moat thesis worth paying to confirm.
Stage 3 — Confirmatory CDD
This is where the budget goes, and where deals are re-priced or killed:
- Cohort retention, rebuilt from raw data — not the seller's summary. The single most decisive workstream.
- Customer reference calls — the truth about churn risk, competitive displacement, and whether the product is loved or merely installed.
- Technical & architecture review — scalability, technical debt, and the AI question (is the product AI-native or a retrofit at commoditization risk — "analytical SaaS"?).
- The vendor's own security posture — uniquely existential in cyber: a breached security vendor is a deal-killer, not a discount.
- People & key-person dependence — founder/engineer retention, lock-ups, attrition; the asset that walks out nightly.
- Legal/structural — contract assignability, IP/open-source provenance, and the completion-risk gauntlet (antitrust/CFIUS/financing — 29a).
The output of stage 3 is not a pass/fail; it is a re-priced view — the findings that move the multiple, size the escrow, and shape the earnout (29a).
Stage 4 — IC, value bridge and pricing
The survivors are taken to an investment committee with a value-creation bridge (06e, 30): entry multiple, the operating plan to grow EBITDA/ARR, the bolt-on pipeline, and the exit thesis (29b). Diligence findings feed directly into structure: a retention risk becomes a retention pool; a disputed pipeline becomes an earnout; a rep concern becomes escrow. Price and structure are decided together, not sequentially.
The red-flag gate (deal-killers vs. price-breakers)
Not every red flag kills a deal; the distinction is which re-price and which warrant walking away:
| Finding | Kills the deal | Re-prices / restructures |
|---|---|---|
| NRR < 100% / deteriorating cohorts | If structural and broad | If isolated to one cohort/segment → discount + earnout |
| Growth bought (CAC payback >2–3y) | If the model can't ever pay back | If fixable with GTM discipline → lower entry multiple |
| Services dressed as software | Rarely fatal | Re-rate to a services multiple (36) |
| Vendor's own security incident | Usually fatal in cyber | Only if fully remediated and disclosed |
| Customer/partner concentration | If a single logo is existential | Otherwise → escrow + earnout |
| Founder/key-person flight risk | If the asset is the founder | Otherwise → rollover + retention pool (29a) |
| AI commoditizes the core value | If the moat is gone | If AI can be made additive → thesis pivot |
→ Cross-references: Commercial Due Diligence, Deal Structures, Exits: M&A vs IPO, Value Creation & Operator Playbook, Product & Competitive Strategy, Buy-Side Prospect Framework, Go-to-Market & Channels, Buy-and-Build Math, Valuation.
Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.