In diligence, buyers spend their time elsewhere.
Across middle market transactions, valuation reductions increasingly come from operational gaps that do not appear clearly in financial statements. These gaps surface late in the process and are difficult to fix under time pressure.
Three gaps consistently reduce valuation, often by millions of dollars.
1. No Clear AI Story Signals Weak Operating Discipline
AI typically shows up in diligence when buyers review how costs move, where work has been automated, and how operations scale.
Buyers ask simple questions:
- Where has automation changed the cost structure?
- What expenses have permanently come out?
- What are the drivers behind the efficiency improvements you’re forecasting?
In many businesses, the answers are informal. Tools are in place, but savings are not tracked, plans are loosely defined, and ownership is unclear.
That uncertainty gets priced.
Observed impact:
Bain and McKinsey data show that companies able to document AI driven productivity improvements trade at 15–20% higher enterprise values than peers without quantified efficiency programs¹, ².
At a $40–60M revenue scale, that difference commonly translates to $5–10M in deal value.
Where documentation is thin, buyers typically assume future investment requirements and discount 0.5x EBITDA or more.
What shows up well in diligence:
- Identified use cases with annual dollar impact (e.g., accounts payable automation reducing costs by $100K–$150K per year)
- Payback periods under 6 months
- A defined next phase with cost and timing
- The presence of numbers matters more than the sophistication of the tools
2. Cyber Events During a Sale Reprice Deals Fast
When a company is in the middle of a sale, risk goes up.
Deal announcements, heavy data room use, and distracted teams make it easier for attackers to get in. In many M&A-related cases, ransomware is already inside the system weeks before anyone notices.
If an attack happens during the sale process, the impact is immediate.
Documented impact:
IBM’s 2024 Cost of a Data Breach Report shows that the average ransomware incident in the U.S. costs $5M in direct damage³. In live transactions, PwC and KPMG research shows that serious cyber incidents often lead to 20–30% cuts in purchase price⁴.
In some cases, deals fall apart entirely because buyers cannot assess the risk fast enough before closing.
Sellers that avoid repricing usually enter the process with:
- Completed security checks,
- Tested backups and response plans,
- Continuous monitoring during diligence,
- Limited system access tied to deal activity.
Across similar businesses, strong cyber preparation is linked to 10–15% higher valuations compared to less prepared peers⁵.
3. Legacy Systems Quietly Destroy EBITDA Multiples
Outdated systems rarely stop a deal.
They quietly reprice it.
Legacy systems rarely trigger dramatic diligence findings. They affect valuation quietly.
Common patterns include:
- ERP or accounting platforms older than 8–10 years
- Custom tools dependent on a single employee
- Unsupported infrastructure
- Manual processes compensating for system gaps
From a buyer’s model, these convert directly into integration cost, execution risk, and timeline uncertainty.
Observed impact:
KPMG analysis across U.S. middle-market exits shows unresolved technology debt reduces valuation multiples by 0.5–1.0x EBITDA⁶.
For a $8–12M EBITDA business, this equates to $4–12M in lost enterprise value.
Buyers do not expect modernization to be complete at exit. They do expect:
- Identification of the most critical systems
- A costed replacement plan (often $500K–$2M)
- A credible timeline
Absent this, pricing assumes downside.
The Valuation Difference Is Mostly Operational
Recent middle-market transactions in the U.S. clear around 7.5x EBITDA on average.
The difference between 7.0x and 8.0x on a $50M EBITDA business is $50M in enterprise value. In competitive processes, most of that spread is explained by operational confidence, not growth forecasts.
AI economics, cyber readiness, and technology sustainability account for much of that confidence.
Conclusion
Exit value is increasingly shaped by how predictable the operations feels to own after closing.
Companies that enter a sale process with measurable efficiency gains, contained cyber risk, and clear system plans consistently outperform peers by 15–25% in realized exit value⁷.
The work required is not transformational. The cost of ignoring it often is.
References:
¹ Bain & Company (2024) – AI and Productivity in M&A
² McKinsey & Company (2024) – Quantifying AI Impact in Due Diligence
³ IBM Security (2024) – Cost of a Data Breach Report
⁴ PwC (2024); KPMG (2023) – Cyber Risk in U.S. Transactions
⁵ Deloitte (2023) – Cyber Readiness and Valuation Outcomes
⁶ KPMG (2023) – Technology Debt and EBITDA Multiples
⁷ EY (2024) – Digital Preparedness and Exit Performance
