PlatformCommand · Scout · Anvil→ Security & technology diligence · Pre-LOI to Day 100
Platform Platform overview Command For vCISO practices For PE portfolios Integrations Scout Managed Scout Anvil Company Services Field Notes About Dispatch Sign in Sign in
AnvilSecurity & technology diligence

Know what you're
inheriting. Before you sign.

Anvil is the security and technology diligence workspace for deal teams. Score the target’s stack and posture, price the integration, and hand the committee an artifact instead of a slide. It does not replace financial, legal or commercial diligence. It is the technical half of the file.

The deal score →

Fig. 01 · The deal workspace · pipeline, findings and score

The Anvil deal workspace showing the pipeline, composite scores and open findings across live transactions

Two-week deep dives that miss the integration risk. A slide deck where the committee wanted an artifact. A spreadsheet that dies the day the deal closes and takes the reasoning with it. Anvil runs the security and technology workstream as a record, not a document, and the record keeps working after close.

2 to 6 wks

Average time from data-room access to technical intelligence the investment committee can act on.

60%+

Of M&A value erosion traces back to integration cost that was missed or mispriced.

30%

Of breaches involve a third party, including the ones you inherit at close.

Verizon 2025 DBIR
§ 01The deal score

One number the
committee trusts.

Anvil rolls security posture, software risk, vendor exposure and integration readiness into a single hundred-point composite, weighted to your thesis and resolved to a letter. The number is defensible because every point traces to a finding, and the finding traces to a document in the room.

A90 to 100Clean. Mature controls, low integration drag.
B80 to 89Solid, with known gaps already priced and planned.
C70 to 79Workable, with gaps to price into the model.
D60 to 69Material risk. Remediation belongs in the model.
F0 to 59Deal-shaping issues. Renegotiate or walk.
Anvil › Deals › Northwind Systems
NNorthwind SystemsComposite scoreWeighted to thesis
D64/ 100Material risk. Remediation priced into the model.
Security postureWeight 35%57
Software riskWeight 25%68
Vendor exposureWeight 20%61
Integration readinessWeight 20%74
FDCBA

Fig. 02 · Composite score · sample dealEvery point traces to a finding

§ 02The workspace

From first look
to full integration.

Six modules on one record. The assessment produces findings, the findings price the economics, the economics inform the report, and the report becomes the Day 1 plan. Nothing is re-entered and nothing is lost at handoff.

The Anvil pipeline: every live deal with its stage, composite score and open risks
A SOC 2 Type II control assessment in Anvil with per-control ratings
SBOM analysis in Anvil with CVE findings and ranked remediation
Deal economics in Anvil: consolidation savings, payback and net year one
The diligence intelligence report with executive summary and findings
The Day 1 to Day 100 integration roadmap built from the findings
Six modulesOne record, pre-LOI through close
Hudson
§ 03The analyst

Diligence
that listens.

Switch on ambient transcription and Hudson follows the management interview live, matching what is said against the data room and proposing a rating for every control with the evidence already attached. Every suggestion links back to the moment in the transcript and the artifact it came from, and you approve each one.

Anvil › Northwind Systems › Management interview
TranscribingAmbient · nobody is taking notes
CC6.2 · SOC 2 Type II
Manages credentials and authentication
Deal teamHow do you handle credential rotation across the platform?
Target · CTOWe rotate every 90 days, but there is no written policy enforcing it yet.
Hudson suggests87% confidence
Partialwas · not assessed

Rotation occurs but is not documented, so CC6.2 is partially met. Drawn from the live call and two data-room artifacts.

Transcript · SOC2.pdf · IAM-policy.md

Fig. 03 · Ambient transcription · suggested ratingYou approve every write

§ 04The lifecycle

One workspace,
first look to Day 100.

Diligence does not end at signing. The same record that screened the target drives the integration, so the person owning Day 40 can read why a risk was accepted in week two.

01

Pre-LOI screening

A short sprint to surface deal-killers before you commit. Stack inventory, posture snapshot, vendor map.

02

Confirmatory technical diligence

The deep dive on a signed deal. Control assessments, SBOM analysis, policy comparison, committee report.

03

Integration planning

Findings organise into a four-phase roadmap. Vendor dispositions, cost estimates and accepted risks, all logged.

04

Post-close execution

The same workspace, now driving Day 1 through Day 100. Phase progress, residual findings, monthly reporting.

Pre-LOI to Day 100One record runs the full deal lifecycle, with no context lost at handoff.
§ 05Next

See what
you're buying.

Bring a target you are looking at, or one you have already closed. We will run it through the workspace and show you the score, the findings and the Day 1 plan that comes out the other side.

All three products →