2025 Open Source Risk in M&A by the Numbers

Discover the latest open source risks

Software due diligence is an important part of the merger and acquisition (M&A) process, and an audit of a target’s code is key whenever software is a significant part of the value of the deal. Auditing the software helps businesses better understand the technology and capabilities they’re buying, and helps identify potential legal, security, and quality issues preclose.

The Black Duck Audit team audits thousands of codebases for our customers each year, with the primary goal of identifying software risks during M&A transactions. The 2025 “Open Source Risk in M&A by the Numbers” report provides a detailed analysis of those risks.

Here’s what we know.

• The prevalence of open source components: Almost all audited M&A transactions included open source components, with thousands of components per transaction.
• License conflicts: 85% of M&A transactions had license conflicts.
• Unpatched vulnerabilities: 96% of transactions contained unpatched vulnerabilities.
• Comprehensive due diligence: Software due diligence, including open source audits, is essential for identifying and mitigating risks, avoiding surprises, and planning for necessary remediation in the context of M&A.
• The role of software composition analysis (SCA): SCA is a crucial ongoing management tool for identifying open source components, flagging legal compliance issues, detecting known security vulnerabilities, and tracking component versions and development activity.

Using open source in software development helps speed up development, drives innovation, and lowers costs. But if it is left unchecked, it may create risks in general, and in M&A.