Vendor Due Diligence: A $5M SaaS Vendor Was a 2-Person Operation With No Real Office

Background

A healthcare company was about to sign a $5M annual contract with a SaaS vendor for a critical compliance platform. The vendor's LinkedIn showed 52 employees and a professional website with team photos. The CISO requested independent verification.

Investigation Methodology

1. LinkedIn Employee Verification: Every listed employee's LinkedIn profile was analyzed for authenticity — profile creation dates, activity patterns, connection networks, and profile photo analysis.
2. Office Verification: The vendor's listed office address was verified through property records, virtual office provider databases, and satellite imagery.
3. Technical Infrastructure Assessment: The vendor's website hosting, code repositories, and technical infrastructure were analyzed for team size indicators.

Key Findings

• Of the 52 LinkedIn profiles: 48 were created within a 3-month window, had AI-generated profile photos, and had no engagement activity beyond their initial posts.
• The "headquarters" was a virtual office address at a coworking space with no dedicated suite.
• Website analysis showed all code commits came from only 2 unique contributors.
• The vendor's "team photos" were stock images with the background digitally replaced.

Outcome

The healthcare company terminated contract negotiations immediately. The discovery likely prevented a catastrophic vendor dependency on a company that could not deliver on its SLA commitments. Total investigation time: 10 business days.