When software is the company, tech due diligence is critical

A need for tech due diligence

The need to understand open source risk in a recent acquisition was the driver for the leading provider of patient medical financing options, AccessOne, to reach out to Black Duck Audit Services for an open source code audit.

“We wanted to assure that the target was keeping code current and identify any security or operational risk that could result from their use of open source,” AccessOne chief technology officer Connor Gray told me late last year. “We also took advantage of the web services analysis that Black Duck On-Demand provides. Those provide indicators of an organization’s rigor around their software process. If the target isn’t aware of what code is in their code base, it might be an indication that they are doing a sloppy job of code management. If they have developers putting code into the code base without the organization being aware of it, that poses significant risk.”

As I previously noted, open source may come with legal obligations that go with the usage of that code. There also may be security vulnerabilities within the code. A Black Duck On-Demand open source code audit is an automated process that discovers the open source components in a codebase, and the legal compliance issues related to those open source components, prioritizing any issues based on their severity. The audit also discovers known security vulnerabilities related to the open source components as well as operational risks such as versioning and duplications.

Given the value delivered to protect against the impact of a lawsuit, data attack, or loss of value, Black Duck On-Demand open source code audits are one of the most cost-effective risk mitigation strategies that a firm involved in an M&A transaction can undertake. Black Duck On-Demand performs hundreds of open source software audits for some of the largest organizations and most active acquirers in the world. By identifying open source code and third-party components and licenses, Black Duck On-Demand can alert your firm to potential legal, operational, and security issues. That way, you can:

• Avoid surprises
• Mitigate legal exposure
• Understand risks that may affect software asset values

“I’ve been through a number of different acquisitions, both as a buyer and a seller,” Gray says. “The thoroughness in the data that we got back from Black Duck On-Demand is far beyond anything else that I’ve seen. I would say to any company involved in an M&A transaction that you really aren’t doing the job you need to do without something like a Black Duck On-Demand audit to help you through it. I cannot imagine doing  a transaction without using Black Duck On-Demand’s services.”