Read time: 6 minutes | Issue #39 | Book a Call
Happy Tuesday. Mark here.
Bain & Company has been vibecoding functional replicas of PE acquisition targets. The method: use AI to rebuild a working version of the target's software from product demos and documentation, then check whether the product is as hard to replicate as the seller claims. At least one Silicon Valley PE firm dropped its bid on an analytics platform after Bain's prototype showed the core logic was reproducible. One PE investor said: "If it's in the question box, we're not going to touch it."
I finished a technical review for a PE client last week that ended the same way. Except we didn't need to build a replica. We just opened the codebase.
Inside the Issue
600 lines of glue code behind a $50 million asking price, and why Bain is now stress-testing acquisition targets with AI-built replicas before signing
A four-axis AI diligence scorecard for deal teams, built from what we find inside codebases that pitch decks describe as "proprietary AI platforms"
PE software buyouts hit a decade low, Thoma Bravo writes down Medallia, and AI M&A deals grew 90% year-over-year while buyers get more cautious
Bain Rebuilt Their Software. We Opened the Codebase. Both Deals Died.
Bain introduced a specialist engineering capability in 2023 for private equity diligence. The team builds working prototypes of target companies' software using AI code generation tools, then evaluates whether the product's competitive advantage lives in the code, the data, the workflow design, or the marketing deck.
Rebecca Burack, head of Bain's global PE practice, described the difference as "seeing something in 2D versus 3D." The firm has vibecoded hundreds of prototypes since launching the method. In at least one documented case, a PE firm pulled its bid on an analytics platform after the prototype demonstrated that the product's interface, automation logic, and analytics layer were all reproducible.
I've been watching PE firms struggle with this question for two years. Bain built a tool for it, and we answer it a different way: we go inside the codebase directly. What we found last week made me want to send this newsletter early.
The $50 million codebase
A PE firm asked us to review an AI company before close. The pitch deck said "proprietary AI platform." The data room showed $4.2M ARR growing 40% year-over-year. The management presentation had 14 slides on their "foundational model architecture," complete with detailed diagrams and proprietary terminology.
We opened the codebase.
The "proprietary model" was gpt-4o with temperature set to 0.2, a system prompt, and a React frontend. Six hundred lines of glue code that any senior engineer could rebuild in a weekend.
They were asking 12x revenue.
I've reviewed a lot of codebases. The gap between the pitch and the product on this one was the widest I've seen in three years of doing these reviews. The codebase contained no model, no training pipeline, and no proprietary data. The entire product was an API call with a UI on top.
The PE firm walked within the day.
Our read: this is not an edge case. It is a pattern. Buyers are deploying capital faster than their diligence teams can evaluate what they're buying, and the diligence playbooks haven't caught up to what "AI company" actually means in 2026.
PitchBook's numbers confirm the pattern. PE software platform buyouts fell to 41% of deal value in 2026, the lowest level in a decade and a 30-percentage-point drop from the prior year. US software deal value through May 2026 is running at roughly one-quarter of last year's pace: about $39 billion annualized versus $156 billion in 2025.
The pullback isn't just rates and credit tightening. Buyers are losing confidence that they can tell what they're buying.
The four gaps standard diligence doesn't cover
PE firms I talk to have a financial diligence playbook and a commercial one. Almost none have a technical playbook built for AI codebases. Across hundreds of engagements, I keep running into the same four blind spots.
Gap 1: Model dependency. If the target runs on a third-party model (OpenAI, Anthropic, Google), you need to know what happens when that provider raises pricing, deprecates the model version, or a competitor ships equivalent capability at 20% of the cost. Valutico calls this "agentic substitution risk" in their 2026 buyer's framework. I call it the thin-wrapper problem. If you can swap the underlying model in an afternoon, the "proprietary AI" is worth the React frontend it's wrapped in.
The company we reviewed had zero proprietary model logic. Their competitive moat was a system prompt and an API key. That's not IP. That's a configuration file.
Gap 2: Training data liability. You acquire an AI company, you inherit how they sourced their training data. The datasets they scraped, the copyrighted material they ingested without permission. And most data rooms I've seen contain nothing on training data provenance.
Bartz v. Anthropic settled for $1.5 billion covering 482,460 books, roughly $3,100 per work after fees. Anthropic was required to destroy the pirated libraries and derivative copies within 30 days of final judgment. The settlement covers past conduct only and does not establish future licensing frameworks.
Meanwhile, EU AI Act penalties for prohibited AI practices run to 7% of global turnover or €35 million, whichever is higher. Other violations, including transparency and operational requirements, carry penalties up to 3% or €15 million. Six countries have already issued conflicting interpretations of whether AI training on copyrighted material qualifies as fair use, creating a liability patchwork that any cross-border acquisition inherits.
Gap 3: Talent concentration. In a traditional SaaS company, losing two engineers is a setback. In an AI company, the model pipeline often lives in three people's heads. I've seen shops where one ML engineer's departure would mean the company cannot retrain or update its core product. Standard HR diligence counts headcount. It doesn't map who holds institutional knowledge about the model architecture, whether the training pipeline is documented, or whether a new hire could run it.
KPMG's 2025 Technology M&A Survey found that only 33% of dealmakers prioritize investigating technical and AI debt during pre-deal evaluation, even though 66% discuss it during deal planning. Thirty-three points between acknowledging a risk and actually checking for it.
Gap 4: Integration failure rates. RAND cited estimates that more than 80% of AI projects fail to deliver intended business value, roughly double the failure rate for comparable IT projects without AI. RAND's own study is qualitative rather than statistical, built on 65 interviews with data scientists and engineers, so treat the number as directional rather than precise. Separately, MIT found that roughly 95% of generative AI pilots returned zero measurable P&L impact. That measures financial return, not technical failure, and the study is not peer-reviewed, but the direction is consistent.
Acquiring an AI company and plugging it into a portfolio company's stack is a multi-quarter engineering project carrying that same probability distribution, and the product won't work on day one. It's an integration project with an 80%+ historical base rate of failure to deliver value.
The spreadsheet shows ARR and growth. It doesn't show whether the company built what they're selling. We've been inside enough of these to know the difference.
The Four-Axis AI Diligence Scorecard
Valutico published a four-axis framework for evaluating AI vulnerability in M&A. We've been running a version of this across our engagements. Below is each axis with the specific questions that surface problems before signing.
Score each axis from 0 (low risk) to 10 (high risk).
Axis 1: Model Dependency (0 = fully proprietary model, 10 = pure API wrapper)
What percentage of the product's core functionality depends on third-party model APIs?
What's the contractual relationship with each model provider? Pricing terms, usage limits, termination clauses.
If the primary provider raised prices 5x tomorrow, what happens to margins?
Can the team demonstrate the product running on an alternative model within 48 hours?
What proprietary fine-tuning, training data, or model modifications exist beyond prompt engineering?
Red flag: the team describes "prompt engineering" as their moat. That's a configuration file with a monthly bill attached to it.
Axis 2: Data Moat (0 = irreproducible dataset with clear provenance, 10 = no proprietary data)
What proprietary datasets does the company own, and can they demonstrate legal provenance for each source?
Is training data provenance documented anywhere in the data room?
Could a competitor with access to public data reproduce the company's model performance within six months?
Do data licensing agreements survive a change of control?
Red flag: no training data documentation in the data room. After Bartz ($1.5B, 482,460 books), this is a liability you inherit on signing.
Axis 3: Talent Concentration (0 = knowledge distributed and documented, 10 = single point of failure)
How many people can retrain or update the core model?
Is the training pipeline documented and reproducible by someone who didn't write it?
What happens to the product roadmap if the top two ML engineers leave after their earn-out?
Can a new hire run the full model update cycle from documentation alone?
Red flag: one engineer, no docs, 18-month earn-out. You're buying a countdown timer, not a company.
Axis 4: Substitution Risk (0 = mission-critical with unique workflow, 10 = commodity automation)
Does the product automate a task that an off-the-shelf AI agent could replicate tomorrow?
What would it cost a well-funded competitor to rebuild the core functionality?
Does the product's value come from the model, the data, the workflow, or the distribution?
Red flag: core functionality is reproducible in a weekend with an API key and a frontend framework. We know, because we've seen the codebase.
Score each axis. More than one score above 8 means the asking price needs to reflect the risk profile, not the growth rate. Run this before your LOI, not after.
01 PE software platform buyouts hit a decade low. Deal share fell to 41% of PE software deal value, down 30 percentage points from the prior year. Only seven software platform transactions exceeded $100 million through May 2026. US software deal value is running at about one-quarter of 2025's $156 billion pace. Investors are shifting capital to add-ons and growth equity, which now represent 45% of deal value.
02 Thoma Bravo faces a projected $5.1 billion equity loss on Medallia. The firm acquired the customer experience platform for $6.4 billion in 2021. Orlando Bravo told CNBC: "We made a mistake," pointing to peak-cycle pricing and overaggressive growth assumptions. The restructuring has become a cautionary reference for the entire 2021-2022 take-private cohort, where major software deals (Anaplan at $10.7B, Coupa at $8B, Citrix at $16.5B) were struck at peak-cycle multiples that no longer hold.
03 AI M&A deals grew 90% year-over-year in Q1 2026. 266 deals closed in Q1 alone. Nearly half of all tech deals now carry an AI component, up from one in four in 2024. Private-market AI companies command 8-15x revenue multiples versus 4-6x for comparable traditional SaaS. But the premium is diverging: companies with proprietary data and embedded AI attract buyers, while "pure wrappers without proprietary data, workflow, or distribution advantages are struggling to attract serious interest."
04 Bartz v. Anthropic aftermath: six countries diverge on training data rules. The $1.5 billion US settlement covered 482,460 books. Six countries have since issued conflicting interpretations of whether AI training on copyrighted material constitutes fair use. For any AI acquisition with cross-border operations, training data liability is now jurisdiction-dependent and largely untested.
05 KPMG: 66% discuss AI debt in deal planning, 33% actually check for it. The firm's 2025 Technology M&A Survey found that two-thirds of dealmakers acknowledge technical and AI debt as a concern during planning, but only one-third prioritize investigating it during pre-deal evaluation. KPMG recommends seven due diligence dimensions evaluated through an AI-specific lens. Traditional frameworks, they note, "fail to evaluate AI-specific signals."
The Four-Axis AI Diligence Scorecard from Worth Your Time, formatted as a one-page visual diagnostic. Score each axis 0-10 before your LOI.
Any axis scoring 8 or above means the valuation conversation needs to price the specific risk, not just the growth rate. Two or more axes above 8 and the deal structure (escrow holdbacks, earnouts tied to technical milestones, acqui-hire pricing) should reflect it.
The PE firm that hired us for that code review saved themselves a 12x multiple on 600 lines of glue code.
We run technical diligence on AI acquisition targets: model architecture reviews, data provenance audits, talent concentration mapping, integration risk scoring.
If you're evaluating something with "AI" on the pitch deck, we'll tell you what's behind it.
Until next Tuesday,
— Mark Ajzenstadt, Founder @ Limestone Digital
P.S. If you're not just evaluating AI companies but shipping AI into your own product, we embed AI-native engineering teams that stay. We have three slots open for August.
