# Technical Due Diligence

> Evaluate the security and technical risks behind an investment, acquisition, partnership, grant, or vendor decision.

Canonical page: https://www.guvenkaya.co/services/technical-due-diligence

**Understand the technical risk before you invest, buy, or partner.** Independent security diligence for investors, acquirers, and enterprise buyers who need to know what they would actually be taking on.

## What we evaluate

We check the target’s claims against available evidence and identify what remains unverified.

- **What they have actually built**: We examine the architecture and critical code supporting the target’s claims.
- **What they can prove**: We separate demonstrated security posture (findings, fixes, incident history) from assertions with nothing behind them.
- **What you would inherit**: We surface the vendors, platforms, and technical debt that become yours on the day the deal closes.
- **What we could not establish**: We state the evidence gaps plainly, so an unanswered question never reads as a clean result.

## Best used before you buy or commit.

- **Investment or acquisition**: A commitment depends on the target's technical reality.
- **Vendor selection**: A strategic platform will inherit trust and operational reach.
- **Ecosystem commitment**: A grant or partnership needs independent validation.
- **Claims need evidence**: Security assertions made during a deal require technical review.

## How we build the evidence for your decision.

1. **Define the questions that could change the decision**: Agree the investment, acquisition, vendor, grant, or partnership question. Identify the technical claims to check and the evidence needed to assess them.
2. **Check claims against available evidence**: Review architecture, code, controls, and incident history within the access provided. Record what supports each claim and what remains unverified.
3. **Document red flags and open questions**: Investigate the gaps with the greatest impact on the decision. Rank red flags and unresolved questions, with the evidence needed to close them.
4. **Explain the implications**: Prepare an executive summary connecting findings and remaining unknowns to the transaction or commitment under review.

## Deliverables

- **Material red flags**: Risk drivers and the evidence behind them.
- **Prioritized questions**: The questions still open, and the evidence we would need to close them.
- **Executive summary**: Findings translated into implications for the transaction or commitment.

## Engagement team

- **Piotr Cielas**, Principal Advisor: Financial-services assessments, offensive security, risk leadership, CVEs, and patents.
- **Timur Güvenkaya**, Founder & Partner: Rust-based and non-EVM systems, protocol security, architecture, infrastructure, and custody.
- **Paul Vijender**, Specialist Advisor: Product security, IAM, cloud, network, data, DevSecOps, blockchain, and AI leadership.

## Frequently asked questions

### How much access do you need to the target?

We scope the work around the available documentation, interviews, and operational evidence. If the review includes code, we need access to it during scoping. Without code, some implementation claims may remain unverified. The report distinguishes supported conclusions from open questions.

### Can you assess a vendor as well as an acquisition target?

Yes. Diligence can support vendor selection, investment, acquisition, partnership, or grant decisions. We tailor the review to the technical risks and dependencies you would take on.

### Can you work inside a deal timeline?

We scope the work around your decision date and available access. If the timeline limits what can be examined, the report identifies those gaps and their implications.

### Do you give a go or no-go recommendation?

We explain the technical risks, remediation effort, and unresolved questions relevant to the decision. The investment, acquisition, or vendor decision remains with you.

### Can you use previous audits or assessments?

Yes. We assess their scope, findings, remediation evidence, and relevance to the current system. Previous reports help focus the work, but they do not establish the security of changes made since the review.

## Related services

- [Risk Assessment](https://www.guvenkaya.co/services/risk-assessment.md): Give leadership a prioritized view of where security risk concentrates and what to address first.
- [Secure Code Reviews](https://www.guvenkaya.co/services/secure-code-review.md): Find security flaws in critical code, including authorization, business logic, and state changes.
- [Digital Asset Program Advisory](https://www.guvenkaya.co/services/digital-asset-program-advisory.md): Make security, custody, vendor, and operating-model decisions across a broader digital asset program.

## Discuss your due diligence questions.

Describe the decision, available access, and deadline. We will propose a diligence scope.

Discuss your scope: https://www.guvenkaya.co/contact