Published UK technical due diligence prices include a £3,500 starting fee, a £15,000 plus VAT technical review and a £35,000 plus VAT full diligence engagement. These are individual providers' advertised offers, shown below, rather than a UK market average. The scope behind each price matters more than the headline number.
FoundationState quotes each engagement individually. Our Small, Medium and Large tiers describe the depth of review, with typical delivery windows of 1–2, 2–3 and 3–8 weeks respectively. Fees depend on the systems, evidence and commercial questions in scope.
If you already have a target and a deadline, contact FoundationState for a scoped quote. Share the number of products, the technology estate and the decision the review needs to support.
Published technical due diligence pricing examples
The following examples were checked on 11 October 2026 against the providers' own service pages. They give a starting point for a budget discussion, but they are not like-for-like packages or FoundationState prices.
| Provider and offer | Published fee | Scope and timing stated by the provider |
|---|---|---|
| Arslan Zaheer: technical due diligence | From £3,500; VAT treatment not stated on the service page | Fixed scope with a fixed or capped fee. Final price depends on codebase size, products and any hands-on AI testing. |
| Rocking Tech: Technical Review | £15,000 plus VAT | Early screening across codebase, infrastructure and delivery history, with a technical lead interview and written summary. Advertised delivery: 10 working days. |
| Rocking Tech: Full Technical Due Diligence | £35,000 plus VAT | Broader architecture, code, infrastructure, security, team and dependency/IP assessment, with a full report and presentation. Advertised delivery: 15 working days. |
A starting fee does not tell you what a complex target will cost. Equally, a higher fee does not establish that a review covers every repository, security test or legal question. Confirm the written scope, exclusions and VAT treatment before comparing quotes.
What changes the cost of technical due diligence?
Two businesses with similar revenue can require different reviews. One may run a single application in one cloud account; the other may have acquired products, outsourced development and several teams responsible for customer data.
The main questions to settle before requesting a price are:
- Breadth: how many products, repositories, cloud accounts, business systems and entities need reviewing?
- Depth: is the buyer seeking an operational snapshot, a SaaS platform assessment or detailed architecture and engineering evidence?
- Access: are current diagrams, deployment records, ownership documents and the relevant people available? Which conclusions will be limited by missing evidence?
- Transaction questions: does the review need to address scalability, key-person dependency, software ownership, integration or separation from a wider group?
- Specialist work: are penetration testing, performance testing or a full source-code audit required as separately agreed workstreams?
- Deadline: when must initial concerns and the final report be available, and how much parallel work or follow-up is needed?
Use the technical due diligence checklist to identify relevant evidence. Agree which areas the provider will assess and how deeply, rather than treating the checklist as a promise that every item is included.
How FoundationState's Small, Medium and Large tiers differ
Our technical due diligence service uses three scope levels. Choose the tier around the question you need answered, not simply the funding round or transaction value.
| Tier | Typical delivery window | Focus of the review |
|---|---|---|
| Small | 1–2 weeks | Identity and workforce tooling, business-system access, endpoint hygiene, basic security operations and the public website. Deliverables include a risk summary, Day-1 ownership concerns and a 30–60–90-day remediation plan. |
| Medium | 2–3 weeks | Adds a SaaS product and conceptual architecture review, cloud ownership and resilience, application security posture, data handling and delivery practices. Deliverables include a technical and operational risk heatmap and a 12-month improvement roadmap. |
| Large | 3–8 weeks | Deeper application and infrastructure architecture, engineering and codebase overview, security posture, reliability, team dependencies and commercial integration questions. Deliverables include an executive risk report and prioritised remediation and investment roadmap. |
Small does not include proprietary SaaS or application review, source-code review or cloud architecture assessment. A small company whose value depends on its software may therefore need a broader scope, even if its team and revenue are modest.
Medium does not include a full source-code audit or load testing. Penetration testing and formal compliance certification audits are outside the standard scope across these tiers. Large includes an engineering and codebase overview, but does not include line-by-line vulnerability exploitation. Discuss any specialist testing explicitly before commissioning the engagement.
These are delivery windows, not counts of chargeable consultant days. Stakeholder availability, evidence access and the breadth of the agreed review affect the timetable. Our technical due diligence timelines guide explains how to plan the work alongside a transaction.
How to compare quotes without overlooking gaps
A useful quote makes it clear what the fee buys. Ask each provider the same questions:
- 1What is being assessed? Name the products, environments and entities, and identify anything deliberately excluded.
- 2What evidence will be inspected? Distinguish document review and interviews from repository inspection, cloud evidence or hands-on testing.
- 3What will the buyer receive? Confirm the report, prioritised risks, commercial implications, readout and any remediation estimates. Our guide to technical due diligence reports explains useful outputs.
- 4What happens if new risks appear? Agree how additional work, extra interviews or a changed deadline will be priced and approved.
- 5What does the total include? Confirm VAT treatment, expenses, specialist assessments, follow-up questions and any separate remediation work.
- 6What access and confidentiality arrangements are needed? Clarify the NDA, evidence handling and the target team's commitments before the clock starts.
A focused review can be the right choice when the question is narrow. For example, checking ownership and access to a business's core tools is a different task from assessing whether its SaaS platform can support an acquisition growth plan. The written scope should make that distinction visible.
Keep the assessment fee separate from the cost of fixing findings
The diligence fee pays for the agreed assessment and deliverables. A remediation roadmap describes work that may be needed afterwards; it does not mean that implementation is included.
For budgeting, separate the review itself, any targeted investigation prompted by findings, and post-close remediation or integration. Ask whether improvement estimates are preliminary planning figures or separately scoped implementation quotes.
This helps the buyer distinguish the cost of obtaining an independent view from the investment needed to address a platform's weaknesses.
What to include when asking FoundationState for a quote
A short initial brief helps establish the right scope:
- The transaction or board decision, the stage it has reached and the report deadline.
- The number of products, business entities, cloud environments and engineering teams.
- Whether the target owns proprietary software or mainly uses third-party business tools.
- The main concerns, such as resilience, access ownership, delivery capacity or integration.
- The evidence and stakeholder access available, plus any known constraints.
- Whether product diligence or specialist testing needs to be considered alongside technical review.
Contact FoundationState to discuss the target, agree the appropriate depth of review and request an engagement quote.
Frequently Asked Questions
How much does technical due diligence cost in the UK?
The published examples above include a £3,500 starting fee and fixed-fee reviews at £15,000 and £35,000 plus VAT. These are individual offers with different scopes, not an average or a maximum price. FoundationState provides a quote based on the agreed review.
Does FoundationState publish fixed prices for its tiers?
No. Small, Medium and Large describe scope and typical delivery windows. The fee is quoted for the systems, organisational breadth and questions included in the engagement.
Is a Small review enough for an early-stage SaaS investment?
It depends on the question. FoundationState's Small tier covers operational hygiene, business tooling and public-facing risks; it excludes proprietary SaaS and application review. If the investment depends on the product's architecture or engineering capability, discuss a Medium or Large scope.
Are security testing and remediation included?
Security posture assessment is different from penetration testing. Penetration testing and formal certification audits sit outside the standard tiers, and implementing fixes requires a separate agreement. Confirm any specialist work and follow-up in the quote.
