The Business of Cyber Security

The Commercial Due Diligence Funnel

Where Commercial Due Diligence is the checklist — the full inventory of what to examine — the funnel is how that checklist is sequenced into a process that disqualifies fast and concentrates effort late, where the decision gates sit, and the single "kill question" at each stage. CDD is a filter run from the first screen to signing, not a document produced at the end; its function is to convert a thesis into priced conviction, or to kill a deal cheaply before it consumes the budget.

As an illustration: a growth-stage cyber target shows 45% ARR growth and a clean headline, until cohort analysis reveals net revenue retention has slipped below 100% and the growth is bought (CAC payback north of three years), not earned. That single confirmatory finding moves the asset from a software multiple to a discount, or kills it. The headline survives the screen but not the funnel — and surfacing such findings before signing rather than after is the purpose of CDD.

Why CDD is a funnel, not a checklist

A checklist treats every line as equal weight at every stage. A funnel does the opposite: it front-loads the cheap, fast disqualifiers (does this fit the thesis? is the revenue recurring?) and reserves the expensive workstreams (cohort retention, technical architecture, customer reference calls) for the few targets that survive. The economics are demanding — confirmatory diligence on a single target costs real money and weeks of senior time, so the aim is to spend that budget on as few targets as possible. A CDD process therefore resembles a funnel with heavy attrition early and deep conviction late:

The CDD funnel — attrition by stage 1 · Universe & thesis screen ~100 names → does it fit? recurring revenue? 2 · Preliminary CDD ~20 → NRR, growth source, moat, GTM 3 · Confirmatory CDD ~5 → cohorts, tech, refs, security posture 4 · IC & pricing ~2 → value bridge, structure 1 · Close kill: no fit / one-time rev kill: NRR<100 / bought growth kill: vendor breached / churn kill: price gap / structure fails Illustrative attrition. The funnel disqualifies cheaply early (thesis fit, revenue quality) and reserves the expensive workstreams (cohorts, architecture, reference calls, the vendor's own security) for the few names that survive.
CDD is a filter, not a report. Each stage has a single dominant kill question; clearing it earns a target the next, more expensive stage. Most of the named universe should die at stages 1–2 on fast, cheap signals (fit, recurring-revenue mix, NRR) so the budget concentrates on the handful worth confirmatory work.

Stage 1 — Universe and thesis screen

The first cut is strategic, not financial: does the target sit in the value pool the thesis is built on, and is its revenue the kind that compounds? Two kill questions answer most of it: does it fit the acquisition thesis (right sub-segment, right life-cycle stage — filling, not draining — 26/33), and is the revenue genuinely recurring (software ARR vs. one-time/services dressed as software). A target that fails either dies here, on public information and a single call, before anyone opens a data room. For a buy-side retainer (27), this is the stage that runs continuously across a whole universe.

Stage 2 — Preliminary CDD (revenue quality and moat)

Survivors earn a look at the numbers. The dominant workstreams — and their kill questions:

A target that clears stage 2 has a defensible revenue base and a moat thesis worth paying to confirm.

Stage 3 — Confirmatory CDD

This is where the budget goes, and where deals are re-priced or killed:

The output of stage 3 is not a pass/fail; it is a re-priced view — the findings that move the multiple, size the escrow, and shape the earnout (29a).

Stage 4 — IC, value bridge and pricing

The survivors are taken to an investment committee with a value-creation bridge (06e, 30): entry multiple, the operating plan to grow EBITDA/ARR, the bolt-on pipeline, and the exit thesis (29b). Diligence findings feed directly into structure: a retention risk becomes a retention pool; a disputed pipeline becomes an earnout; a rep concern becomes escrow. Price and structure are decided together, not sequentially.

The red-flag gate (deal-killers vs. price-breakers)

Not every red flag kills a deal; the distinction is which re-price and which warrant walking away:

Finding Kills the deal Re-prices / restructures
NRR < 100% / deteriorating cohorts If structural and broad If isolated to one cohort/segment → discount + earnout
Growth bought (CAC payback >2–3y) If the model can't ever pay back If fixable with GTM discipline → lower entry multiple
Services dressed as software Rarely fatal Re-rate to a services multiple (36)
Vendor's own security incident Usually fatal in cyber Only if fully remediated and disclosed
Customer/partner concentration If a single logo is existential Otherwise → escrow + earnout
Founder/key-person flight risk If the asset is the founder Otherwise → rollover + retention pool (29a)
AI commoditizes the core value If the moat is gone If AI can be made additive → thesis pivot

Cross-references: Commercial Due Diligence, Deal Structures, Exits: M&A vs IPO, Value Creation & Operator Playbook, Product & Competitive Strategy, Buy-Side Prospect Framework, Go-to-Market & Channels, Buy-and-Build Math, Valuation.


Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.