I have a problem with the way we talk about digital due diligence.
We tend to make it a technology conversation.
Is the infrastructure secure?
Are the systems scalable?
Is customer data protected?
Does the company have cybersecurity protocols?
Is the technology stack modern enough?
Of course those questions matter. Any investor, board or CEO ignoring cybersecurity and infrastructure risk is taking an unnecessary gamble.
But I think we are missing a much bigger issue.
A company can pass a technology audit and still be digitally fragile.
It can have good infrastructure and a terrible customer acquisition model.
It can have impressive software that a competitor may be able to reproduce far faster than management realizes.
It can have thousands of pages indexed by Google but almost no real authority in its market.
It can be spending aggressively on growth while essentially renting every new customer.
It can have a respected CEO who is nearly invisible when buyers, journalists, investors or AI platforms research the category.
It can be implementing AI across the organization without really knowing what data is going where.
And perhaps most importantly, it can look healthy today while all of those weaknesses quietly make tomorrow’s growth more expensive.
That is digital risk too.
I believe we need to stop treating digital due diligence as a check on whether technology works and start asking a harder question:
Can the digital side of this business actually support, protect and compound the value we think the company has?
That is a very different conversation.
Digital risk does not always arrive as a crisis
When people hear “digital risk,” they usually imagine something dramatic.
A cyberattack.
A data breach.
A platform outage.
A regulatory problem.
Those risks are real, and regulators and standards bodies are treating them more seriously. NIST’s Cybersecurity Framework 2.0 includes governance as a core function, reinforcing the idea that cybersecurity is not something leadership can simply hand to IT and forget about. The SEC has also established cybersecurity risk management, governance and material incident disclosure requirements for covered public companies.
But some of the most expensive digital problems are much quieter.
Nobody wakes up one morning and announces:
“Our customer acquisition model has become dangerously dependent on paid media.”
Or:
“Our competitors are becoming the authorities AI systems reference when buyers research our category.”
Or:
“Our CEO knows more about this industry than almost anyone in the market, but none of that knowledge is visible, structured or citable.”
Or:
“The technology we spent three years building is becoming easier to replicate.”
These things usually happen slowly.
CAC creeps higher.
Organic traffic becomes less productive.
Another competitor starts appearing everywhere.
A sales cycle gets longer.
A brand keeps publishing content but never becomes associated with a distinctive idea.
Executives start using AI tools in dozens of places without anybody mapping the exposure.
Marketing reports traffic. Sales reports pipeline. IT reports uptime.
Every function looks at its piece.
Nobody looks at the whole system.
That is the blind spot.
Digital due diligence now sits between technology, growth and strategy
My background is not purely marketing, and I think that shapes how I look at this.
I came into growth through technology, systems, business strategy and operations. I eventually moved much deeper into marketing because I kept seeing the same problem: companies were treating growth as a collection of activities instead of a business system.
That distinction matters even more now.
Digital touches almost everything.
How people find you.
What they believe about you.
Whether they trust you.
How they buy.
How sales follows up.
How data moves.
How AI is used.
How your experts are perceived.
How easily your technology can be recreated.
How quickly a competitor can enter your space.
How dependent you are on Google, Meta, LinkedIn, Amazon, an EHR, a marketplace or another third party.
So when I look at digital due diligence today, I am not interested in a prettier version of a technical audit.
I want to know where the business is brittle.
I want to know what it owns.
And I want to know what would still be standing if one important assumption stopped being true.
That is usually where the real conversation starts.
Start with a question most companies hate answering: what do you actually own?
I do not mean buildings, software licenses or trademarks.
I mean commercially.
What part of your growth engine belongs to you?
If your paid media stopped for three months, would qualified demand continue?
If Google changed dramatically, would buyers still know you?
If LinkedIn disappeared tomorrow, does your executive authority exist anywhere else?
If your largest referral source went away, what happens?
If an AI company changed its platform or pricing, which internal processes would break?
If one technology vendor disappeared, how much of the customer journey stops?
This is where I think executives need to distinguish assets from dependencies.
Paid advertising can be an excellent growth channel.
It is not inherently an owned asset.
A social media following can be valuable.
You still do not own the platform.
Google rankings create economic value.
You do not control Google.
An AI vendor can create enormous productivity gains.
You do not control the model.
A healthy company can use all of these things.
The risk comes when the company starts confusing access with ownership.
What do you actually own?
Your customer relationships?
Your brand?
Your reputation?
Your proprietary data?
Your clinical evidence?
Your intellectual property?
Your executive expertise?
Your category authority?
Your direct audience?
Your processes?
Your partnerships?
Your distribution?
Your knowledge?
Those are the things I want to understand.
Because if everything valuable about the company’s growth disappears when somebody else changes an algorithm, raises a price or terminates an integration, we do not have a growth engine.
We have a collection of dependencies.
AI makes this question much more important
Every leadership team I speak with is discussing AI.
That is not surprising.
The productivity opportunity is enormous.
But I think many companies are moving much faster on adoption than they are on judgment.
Which tools are employees using?
Which ones are approved?
What client information is being entered?
What proprietary information is being shared?
What code is being generated?
Which customer-facing claims are being created or modified by AI?
Which decisions are AI-assisted?
Who validates outputs?
Who owns the consequences when something is wrong?
These are increasingly normal business questions.
NIST has published a Generative AI Profile as a companion to its AI Risk Management Framework, and the OECD published dedicated due diligence guidance for responsible AI in 2026.
I am very much an advocate for using AI.
But I do not believe enthusiasm removes accountability.
This is one reason we built the Judgment Layer into the Bullzeye 3D Framework.
The principle behind it is fairly simple:
The higher the consequence of a decision and the harder that decision is to reverse, the stronger the evidence should be.
AI can help us find patterns faster.
It can challenge assumptions.
It can analyze enormous amounts of information.
It can make teams more productive.
What it cannot do is sit in the boardroom six months later and take responsibility for a bad strategic decision.
That responsibility still belongs to a human being.
And I think that line is going to matter much more than companies currently realize.
Then there is the digital risk almost nobody was discussing three years ago: AI visibility
This is where my view of due diligence probably departs most sharply from a traditional technology review.
I would now want to know whether AI systems understand the company.
Not because I think ChatGPT mentions should suddenly determine company valuation.
They should not.
But because the way buyers find information is changing.
Search is no longer the only discovery layer.
A buyer can ask:
Who are the leading companies in this category?
What alternatives should I consider?
Which company specializes in this problem?
Who are the experts on this subject?
Which vendors should be on my shortlist?
What should I know before buying this technology?
The AI system synthesizes an answer.
Sometimes the buyer clicks through.
Sometimes they do not.
Either way, a new intermediary is influencing the consideration set.
That creates a very simple business question:
When the market asks the question you want to own, does your name enter the answer?
Bullzeye has been doing a significant amount of work around this through Generative Engine Optimization and our broader SEO, AEO and GEO work.
And one thing has become very clear to me.
Ranking and authority are not the same thing.
You can rank well and still have weak AI visibility.
You can publish constantly and still not be cited.
You can have an excellent website and very little third-party corroboration.
You can be a respected company in the real world while the digital evidence around your authority is surprisingly thin.
That matters.
Not because we should manipulate AI systems into saying our names.
That is the wrong goal.
The goal is to build enough legitimate evidence, authority and consistency that leaving you out of a serious answer becomes harder.
That is a very different strategy.
This is also why I think companies are overproducing content
AI has made producing content incredibly easy.
That has created an odd problem.
There is more content than ever, but a lot less of it matters.
Companies publish ten articles that say roughly what their competitors’ ten articles say.
Everyone explains the same trend.
Everyone has five tips.
Everyone has “the ultimate guide.”
Everyone is “unlocking” something.
Everyone suddenly has a framework.
And then we wonder why nobody remembers who wrote any of it.
Information is not scarce anymore.
Point of view is.
Evidence is.
Original experience is.
Trust is.
A useful proprietary dataset is.
A strong customer outcome is.
An executive willing to say something specific enough that another executive might disagree is.
That is why I keep pushing our own team away from content volume and toward authority.
We have already articulated this on Bullzeye as:
Attention is rented. Authority is owned.
Our GEO work is built around that principle. Bullzeye’s current article on generative engine optimization explicitly positions authority and citation as more valuable than pure publishing volume.
And I think it belongs in due diligence.
If I am investing in a business, I want to know whether the market knows why this company matters.
I want to know whether people outside the company say it too.
I want to know whether the CEO’s expertise exists beyond the About page.
I want to know whether industry publications reference the company.
I want to know whether the business has created ideas other people use.
I want to know whether there are facts, evidence, research, customer stories and third-party signals supporting the story management is telling me.
Because authority is not what you say about yourself.
Authority is what the market can independently verify about you.
Customer acquisition deserves much harder diligence
Here is another scenario.
Two businesses each generate $20 million in annual revenue.
The first generates demand through a healthy combination of:
organic search,
direct traffic,
existing customers,
referrals,
partnerships,
earned media,
executive visibility,
AI discovery,
events,
and paid acquisition.
The second generates most new demand through Google and Meta advertising.
The revenue number may be identical.
The growth risk is not.
If paid media costs increase substantially, the second company’s economics change.
If an account gets suspended, growth changes.
If a competitor with deeper pockets starts bidding aggressively, growth changes.
If attribution becomes less reliable, decision-making gets harder.
None of that means the company is bad.
It means I want that dependency priced into the growth story.
One of the simplest questions I would ask a CEO is:
If we stopped paying for attention tomorrow, how much attention would we still have?
That answer tells me a lot.
Visibility is worthless if the business cannot convert it
I also see another mistake constantly.
Companies treat visibility as though it is the finish line.
Traffic increased.
Great. What happened next?
We rank number one.
Good. What happened next?
We are appearing in AI.
Interesting. What happened next?
Leads increased.
Fine. What happened next?
Did the right people show up?
Did somebody respond?
How long did it take?
Did sales know where the lead came from?
Was it qualified?
Did the buyer find enough proof to continue?
Did they schedule?
Did they show?
Did they buy?
Did they stay?
Did they refer someone?
This is the part of growth strategy that dashboards often sanitize.
A business can have a marketing success sitting on top of a commercial failure.
Traffic can rise while revenue stays flat.
Leads can rise while lead quality falls.
Visibility can improve while the buying experience gets worse.
A campaign can look fantastic in isolation while creating very little economic value.
That is why the Bullzeye 3D Framework begins with strategy rather than channels.
Differentiate. Disrupt. Dominate.
Then Design. Discover. Deploy.
The point is not the six words.
The point is sequence.
We should know what deserves to scale before we scale it.
Bullzeye describes 3D as a two-layer growth operating model in which strategy establishes the target before execution builds and scales against it.
That same logic applies to due diligence.
Do not just ask whether the company can grow faster.
Ask whether the system underneath the growth deserves more fuel.
AI is also changing what counts as a moat
This may be the most uncomfortable part of the conversation.
For years, companies could point to the amount of time and money spent building technology as evidence of defensibility.
I am not sure that assumption holds as comfortably anymore.
AI is reducing the cost of creating certain types of software, analysis, content and functionality.
That does not make technology worthless.
It makes the next question more important:
What remains difficult to reproduce?
Maybe it is proprietary data.
Maybe patents.
Maybe clinical evidence.
Maybe regulatory knowledge.
Maybe deep workflow integration.
Maybe customer relationships.
Maybe a network.
Maybe distribution.
Maybe contracts.
Maybe brand authority.
Maybe switching costs.
Maybe an exceptional operating model.
Maybe all of the above.
But if management tells me the moat is simply that “we built the platform,” I would push harder.
How long would it take a well-funded competitor to approximate the important part?
What would they still be missing?
That second answer is usually where the actual moat lives.
Healthcare companies should be even more demanding about this
Much of my work now sits in healthcare, MedTech and HealthTech, and this is where the weaknesses become much easier to see.
Healthcare has a complicated relationship with visibility.
A company can be very visible and not credible.
It can be very credible and almost impossible to find.
A physician can be one of the best in a specialty and have almost no meaningful digital footprint.
A MedTech company can have strong clinical data and weak commercial adoption.
A HealthTech platform can attract attention while lacking the trust signals needed for hospitals, physicians or patients to act.
And increasingly, AI sits somewhere in the middle of all of those journeys.
That is exactly why our Healthcare Growth Intelligence work is grounded in evidence.
Healthcare Growth Intelligence sits inside the 3D Framework as the healthcare-specific evidence engine used to inform growth decisions with market, buyer, competitive, behavioral and commercial intelligence.
Healthcare does not need more marketing noise.
It needs better connections between evidence, visibility, trust, adoption and revenue.
And that should absolutely be examined during diligence.
If I were sitting across from a CEO before a raise, these are the questions I would ask
Not 100 questions.
These.
Where are we most digitally dependent?
Which outside company has the ability to materially affect our growth?
What demand do we actually own?
If advertising stopped, what remains?
Does the market understand our differentiation?
Not our leadership team. The market.
Do AI systems understand who we are and what we are known for?
If not, why not?
Who validates our claims besides us?
Customers? Media? Research? Industry associations? Experts? Partners?
What proprietary knowledge have we turned into an authority asset?
If the answer is none, there is work to do.
Where does our digital customer journey leak?
What happens between attention and revenue?
How are employees using AI?
Not what the policy says. What are they actually doing?
Which AI decisions have human accountability?
Who signs their name to the outcome?
What part of our technology is easier to reproduce today than it was two years ago?
This needs an honest answer.
What is genuinely hard to copy?
That is the moat.
What happens if our largest digital dependency fails?
That is the risk.
Those questions tell me far more than a digital maturity score ever could.
And this is where digital due diligence becomes growth strategy
I do not believe the purpose of diligence should only be finding reasons not to invest.
Good diligence should also find hidden upside.
Sometimes the company has a remarkable CEO nobody knows.
Sometimes the proprietary research is sitting in PowerPoints instead of being turned into market authority.
Sometimes the company has strong organic demand but a terrible conversion process.
Sometimes customers love the business, but those customer stories are invisible.
Sometimes a company has built a powerful product but positioned it so generically that the market cannot see the advantage.
Sometimes sales knows exactly why customers buy, while marketing is still communicating something completely different.
Sometimes the business is sitting on years of expertise that nobody has organized, published or made citable.
Those are growth assets.
They just have not been activated yet.
And this is one reason I do not separate due diligence from growth strategy as cleanly as many people do.
The same questions that uncover risk often uncover the next growth opportunity.
Where are we weak?
Where are we dependent?
What does the market misunderstand?
What do we know that competitors do not?
What do customers value that we are not communicating?
What authority already exists but has never been turned into an asset?
What can we own?
That last question is one I come back to constantly.
What can this company credibly own in the mind of the market that somebody else cannot easily take away?
That is strategy.
Digital due diligence should not be a hunt for perfection
No company is going to come through this with zero risk.
That is not the goal.
I am suspicious of any diligence report that reduces a complex business to a beautiful green scorecard.
Real companies are messy.
There will be technical debt.
There will be channel dependency.
There will be underdeveloped authority.
There will be imperfect data.
There will be AI use ahead of policy.
There will be conversion gaps.
The value is in knowing which weaknesses matter.
A broken metadata field and an acquisition model that depends on one platform are not the same risk.
A weak executive LinkedIn profile and weak clinical substantiation are not the same risk.
An outdated page and an undefended technology moat are not the same risk.
Good judgment is knowing the difference.
So what is digital due diligence now?
My definition is intentionally broad:
Digital due diligence is the examination of whether a company’s technology, data, digital authority, customer acquisition, AI use and commercial pathways are strong enough to support the value leadership expects the business to create.
Cybersecurity belongs inside it.
So does AI governance.
So does search visibility.
So does generative engine visibility.
So does reputation.
So does customer acquisition dependency.
So does conversion.
So does defensibility.
Because these things no longer operate separately.
They affect one another.
And collectively, they affect enterprise value.
A few questions I am asked about digital due diligence
Is digital due diligence the same as technology due diligence?
No.
Technology due diligence looks deeply at areas such as infrastructure, architecture, security, software and scalability.
Digital due diligence should also examine how customers find the company, how much acquisition depends on third parties, what digital authority exists, how AI is being used, how demand converts and how defensible the digital business actually is.
Should AI visibility really be part of investor diligence?
I believe it should be considered where AI-assisted discovery materially affects the market.
It should never be treated as a vanity metric or used in isolation.
The useful questions are whether buyers are using these systems, whether the company is accurately represented, which competitors appear, what sources are influencing answers and whether the company’s wider authority footprint supports its position.
Is GEO replacing SEO?
No.
That is one of the biggest misunderstandings around AI visibility.
Bullzeye treats SEO, AEO and GEO as related but different visibility layers. SEO is still critical for traditional search discoverability. AEO improves the ability to become a direct answer. GEO addresses whether generative systems understand, mention and cite the organization. Our current SEO vs. AEO vs. GEO analysis goes deeper into those distinctions.
Can strong digital assets increase enterprise value?
They can strengthen the underlying qualities investors care about, including growth efficiency, resilience, demand generation, differentiation and defensibility.
But I would be careful about claiming a simple formula between an SEO metric, AI citation count or social following and valuation.
Enterprise value is more complicated than that.
The question is whether the digital asset creates an economic advantage the company can sustain.
That is the test.
What I would tell a CEO
Before you spend more on growth, understand the machine you are feeding.
Before you automate more, decide who remains accountable.
Before you congratulate yourself on traffic, follow it all the way to revenue.
Before you tell investors you have a technology moat, pressure-test how quickly AI is changing the cost of replication.
Before you invest another million dollars in paid acquisition, understand how much demand you own without it.
Before you publish another 100 pieces of content, ask whether the first 100 gave the market anything worth remembering.
And before you say your company has authority, search for yourself from the outside.
Look at Google.
Look at ChatGPT.
Look at Claude.
Look at Perplexity.
Look at the publications your buyers trust.
Look at the people who influence your category.
Then ask:
If I knew nothing about this company, would the digital evidence lead me to the same conclusion about its value that management wants me to reach?
If the answer is no, that is not automatically a marketing problem.
It may be telling you something much more important about the business.
That is why I believe digital due diligence belongs in the growth conversation, the investment conversation and increasingly, the boardroom.
Not because everything is suddenly digital.
Because nearly every growth assumption now has a digital dependency somewhere underneath it.
And those assumptions deserve to be tested before we scale them.
About Meghna Deshraj
Meghna Deshraj is Founder and CEO of Bullzeye Global Growth Partners, where she advises healthcare, MedTech, HealthTech and complex B2B leadership teams on growth strategy, commercialization, AI visibility and executive decision-making.
She is the author of the Bullzeye 3D Framework, a two-layer operating model designed to put strategy ahead of execution and validation ahead of scale.
Related Bullzeye thinking:
Healthcare Growth Intelligence