Delve Tech Due Diligence · Meta-Analysis
Investment Readiness
From 485 companies to the investable few — the quality funnel
The Investment Funnel
Starting from 485 companies, each progressive quality filter narrows the pool dramatically.
| Stage | Remaining | Drop-off | What it means |
|---|---|---|---|
| Total Portfolio | 485 | — | All companies with SOC 2 reports |
| Type 2 (Operational) | 254 | 231 lack operational evidence | Controls tested over time, not just designed |
| Scored 5+ | 109 | 145 below baseline | Minimum acceptable tech maturity |
| Scored 7+ | 19 | 90 adequate but not exceptional | Strong tech foundations |
| Full Maturity | 20 | -1 missing resilience | Multi-region + WAF + pen test + backups + reviews |
Only 20 companies (4.1%) meet the full maturity bar. This means 96% of the portfolio has concrete improvement opportunities — a value creation thesis for PE.
Readiness Tiers
Of 121 scored companies:
- HIGH (8-10): 1 companies — best-in-class
- MODERATE-HIGH (7): 18 companies — strong foundations
- MODERATE (5-6): 90 companies — adequate, undifferentiated
- LOW (3-4): 12 companies — material gaps
Cheapest Fixes
These interventions would move the most companies up the maturity ladder with the least effort:
Quick wins: Adding WAF (Cloudflare/AWS WAF, 1 day) and establishing quarterly access reviews (process change, $0) would benefit 56-78% of the portfolio.
Medium effort: Multi-region migration and pen testing programs require weeks of work but dramatically reduce portfolio-level risk.
Generated from investment readiness module · 485 SOC 2 compliance reports · 2026-03-24