Every Technology Build Sends Two Invoices. The Second Arrives at the Closing Table.

A services operator backed by private equity is three weeks from signing. The deal has been two years in the making, and the financial model is clean. Management has started thinking about what comes next. Then the call comes from the buyer's counsel. The acquirer's technical diligence team has spent forty-eight hours in the data room, and they have found a problem. The platform the company built eighteen months ago, the one that was supposed to justify a technology multiple, runs on a no-code builder. The source code is the vendor's property. It cannot be moved to the acquirer's infrastructure, and the intellectual property does not transfer with the sale. The buyer wants a $400,000 price adjustment to fund the reconstruction they will have to finish before the platform is worth anything to them.

The board had approved that platform for $70,000. They chose it because it was the cheapest option on the table. They had modeled the first invoice. They had not modeled the second.

The Two-Invoice Problem

Every technology build sends two invoices. The first arrives when the project is delivered, and operators budget for it carefully. The second arrives at the closing table, and most operators never see it coming. Its size is set by a single relationship: Initial Build Cost plus Exit Remediation Debt equals True Cost.

Exit Remediation Debt is the amount a buyer's technical team subtracts from the price when it discovers that the platform cannot be cleanly transferred, cannot isolate enterprise client data, or carries security flaws the acquirer will have to fix after the close. It does not appear on a balance sheet. It surfaces as a price chip during diligence, and in the worst cases it is why the deal does not close.

The debt is not the same for every kind of build, and the differences are not subtle. Form-based tools assembled from spreadsheets and web forms transfer no software at all; a buyer treats the company as a pure-service business with a website and assigns it no technology value. No-code and low-code platforms produce a configured tenant of someone else's product, with the source code retained by the vendor. Bubble, one of the most widely used, does not permit source code export at all and hosts only on its own infrastructure.¹ White-label marketplace software hands the acquirer a vendor relationship rather than an asset, under a license that is, by design, non-transferable. In all three cases the buyer who cannot take clean ownership of the code does not pay for it, however well the platform shows in a demo. On the acquirer's model, the technology line reads zero.

Two more categories function but do not survive scrutiny: custom code from unmanaged offshore teams that cannot be audited or extended without a refactor, and AI-assembled code shipped without senior review. Only one category carries no second invoice. An institutional build owns its source code outright and is engineered to pass a Big Four technical audit. The diligence team finds nothing to charge for.

The $70,000 figure is misleading on its own. If the platform needs $400,000 of reconstruction to become a transferable asset, its true cost was $470,000, before the multiple compression that follows when a buyer reclassifies the business from a growth platform to a remediation project. The cheapest first invoice produced the largest total.

The Vibe Coding Problem

There is a newer version of this trap, and in 2026 it is spreading fast. The pattern has a name: vibe coding. A developer describes what they want, an AI model generates the code, the developer glances at the output and commits it. No architectural review, no security audit. For a prototype, that is fine. For a platform being built toward an exit, it is the second invoice in the making.

The behavior is now mainstream. In Stack Overflow's 2025 developer survey, 84 percent of developers reported using or planning to use AI coding tools, and 42 percent of committed code is already AI-assisted, even as developer trust in that code has fallen.² The trust is falling for a reason. Veracode tested AI-generated code across more than one hundred models and found that roughly 45 percent of it contained security vulnerabilities, including flaws in the OWASP Top 10, at a rate 2.74 times higher than human-written code.³ Aikido Security's 2026 survey of 450 developers and security leaders attributed one in five breaches to AI-written code, and nearly seven in ten respondents had already found a vulnerability it introduced.⁴

The risk compounds on a predictable curve. Velocity spikes in the first months, consistency erodes as patterns multiply, review fatigue sets in, and incidents start to land. The cycle tends to complete inside twelve to eighteen months, which for a company building toward a twenty-four-month exit means it completes in the data room. What the acquirer's team finds is a pile of unreviewed commits: authentication that differs from one feature to the next, credentials sitting in plain sight in a repository. They find it in the first two days.

What matters is which part of the platform AI actually accelerates. It is very good at the visible thirty percent, the screens and workflows a buyer sees in a demo. It does not write the multi-tenant data isolation that keeps one enterprise client's records away from a competitor's, and it does not write the security architecture underneath. That is the other seventy percent, the part that decides what the acquirer is actually buying, and vibe coding skips it.

What the Foundation Actually Costs

The institutional build is the only option that eliminates the second invoice, and the reason lives in that seventy percent. Multi-tenant data isolation, the ability to serve competing enterprise clients whose data is physically separated, has to be engineered from the first sprint; a platform without it cannot take an enterprise client without a rebuild. Security architecture is the difference between a clean audit and a finding, and a finding at the closing table gets priced. Across M&A, moderate technical issues typically move price by 5 to 15 percent and significant ones by 15 to 30 percent.⁵ When Verizon found undisclosed breaches while diligencing Yahoo, it cut its offer by $350 million, from $4.83 billion to $4.48 billion.⁶ The same mechanism runs in the lower middle market at smaller numbers.

The cost of waiting is worse than the cost of building. Technical problems found after the close routinely run several times what they would have cost as a pre-close price adjustment. The advisory firm RSM documented a private equity buyer forced to spend $2 million on cybersecurity upgrades outside its integration budget, money that could have been negotiated into the purchase price had diligence caught the gap, alongside a separate target whose aging core system carried $30 million in integration cost.⁷ Found in the data room, technical debt is a line item the seller can negotiate. Found six months after the check clears, it is the buyer's problem alone.⁸

None of this requires avoiding AI. The institutional model uses AI as a productivity layer for that visible thirty percent and puts senior architects in charge of the foundational seventy. That division is what compressed build timelines and cost over the last two years, and it is why the foundation is affordable now in a way it was not before. Consider the return on an illustrative $5 million of EBITDA. A technology-enabled exit near 10x against a pure-service exit near 5x is roughly $25 million in additional proceeds.⁹ The build that protects that gap, the one that reaches the closing table with no Exit Remediation Debt, costs well under $500,000 at the low end. The ratio is not close. It holds only where the platform earns its multiple, which takes real operational adoption and documented recurring revenue by the time diligence arrives.

The second invoice is not decided at the closing table. It is decided at the start, in the board meeting where someone sets two build quotes side by side and picks the lower one, on the reasonable theory that a platform is a platform. The quote names the first invoice. It is silent on the second, which is set by the architecture underneath and comes due only when the buyer's team finally reads the code. By then the number is fixed and the leverage is gone. An operator who plans to sell a technology-enabled business gets one chance to hold that number at zero, and it is the day the build is scoped, not the week before the deal signs.

Prepared June 2026. All figures validated against the live sources cited below.