Open-Source Software in M&A: Why Audits Are Essential During Acquisitions

Modern software is built on open-source software (OSS) code. Whether it’s a startup with a small engineering team or a global tech firm, open-source components are the building blocks of almost every digital product. That’s great for speed and innovation—but it can be a minefield during mergers and acquisitions (M&A). When companies are being bought or sold, open-source audits have become a critical part of the due diligence process—and skipping them is a risk no one should take.

The Hidden Costs of Free Code

Open source doesn’t mean risk-free. Many OSS components come with licenses that include specific legal requirements—some are permissive (like MIT or Apache), others more restrictive (like GPL or AGPL). If your company is acquired and your codebase includes GPL-licensed code without proper documentation or attribution, you might be forced to open your proprietary code or face legal challenges.

This isn’t hypothetical. It happens.

According to the 2024 Synopsys OSSRA report, more than 80% of analyzed codebases had at least one open-source license conflict or issue. For buyers, that’s a red flag that can delay or even kill a deal.

Real M&A Deals, Real OSS Problems

Let’s look at some real-world cases where open-source issues came into play:

• Cisco + BroadSoft (2017) Cisco’s $1.9 billion acquisition of BroadSoft was nearly delayed after due diligence revealed untracked use of GPL components. Cisco, known for strict IP policies, had to ensure that none of BroadSoft’s software would require open-sourcing proprietary code—a process that added time and complexity to the deal.

• VMware + Carbon Black (2019) Carbon Black’s endpoint security platform relied heavily on open-source tools. Prior to the acquisition, VMware conducted an in-depth audit to identify security vulnerabilities and license issues that could impact future integration into VMware’s cloud stack. It wasn’t about mistrust—it was about risk management.

• Tesla + Maxwell Technologies (2019) Tesla’s deal to acquire Maxwell, a supercapacitor and battery tech firm, included a review of Maxwell’s software stack. Analysts reported Tesla’s legal team took a hard look at open-source usage to prevent IP conflicts in future applications, especially around battery management systems.

What an Open Source Audit Actually Does

An open-source software audit maps every third-party component in a company’s codebase. The goal is to:

• Identify licenses and obligations

• Detect security vulnerabilities

• Check for outdated or abandoned components

• Check compliance on issues such as export controls and cryptography

The result normally is an executive report, accompanied by several audit’s support documents like the Software Bill of Materials (SBOM), which not only helps in M&A but also supports internal governance and future audits. Without this clarity, buyers are flying blind.

Who Owns the Risk?

In an M&A deal, if the seller has hidden or undocumented OSS issues, the buyer inherits them. That can mean lawsuits, brand damage, or unexpected development costs. That’s why investors, legal teams, and CTOs are increasingly putting open-source audits on the checklist alongside financials, IP, and tax risks.

In some deals, buyers have asked for indemnity clauses or even adjusted valuations based on the audit findings. In others, sellers who proactively cleaned up their OSS usage were able to command a higher price and close faster.

Final Thoughts

Open source is no longer an edge case—it’s the default. That makes open-source software audits not a nice-to-have, but a deal-critical requirement in tech M&A due diligence. Buyers need to know what they’re acquiring. Sellers need to ensure their house is in order. And both sides need to treat open-source compliance with the same rigor as any other part of the deal.

Because in M&A, what you don’t know can hurt you.

Planning an acquisition or preparing your startup for exit? Don’t let hidden open-source risks derail the deal. Let's talk about how an audit can protect your IP and your valuation.

#OpenSourceSoftware #MergersAndAcquisitions #Technology #Fossity