Five categories of risk I've found in the majority of digital diligence engagements I've run. Almost without exception, none of them appear in the seller's data room. Each is the kind of thing that materially affects valuation if it's surfaced at the right point in the negotiation.
In rough order of frequency.
1. Content concentration
Open the asset's organic traffic data and pull traffic by URL. In a healthy content-led business, you'd expect a long tail — maybe the top 20 URLs accounting for 40-50% of organic traffic, with thousands of pages contributing the rest.
What you actually find, more often than not, is that one to three URLs are doing most of the work. I've seen a deal where 65% of the asset's organic traffic was coming from a single page. The asset was being marketed as a content-engine business. It was, in reality, a one-page business with a content-engine flavour.
The risk is obvious. If that page loses its rankings — to a Google update, to AI search, to a more authoritative competitor publishing the same thing — the organic line collapses. The buyer was paying a multiple on traffic the asset doesn't structurally control.
Sellers don't disclose this because it doesn't show up in their reporting unless they're looking for it. Buyers miss it because the headline traffic number looks healthy. The fix is straightforward: pull traffic by URL on day one of diligence. If the top three URLs are doing more than 40% of the work, the concentration risk needs to be in the report.
2. Technical debt that's recoverable but expensive
Most digital assets have technical debt. The interesting question isn't whether there's any — there always is — but whether the debt is recoverable, what the cost looks like, and how much of the next 18 months it's going to occupy.
Three patterns I see regularly:
A CMS or platform decision made five years ago that's now actively limiting growth. The site's on a system that worked for the previous size and use case but is becoming a constraint. Migration is doable but expensive — typically £100k-£500k of agency or in-house engineering, plus 6-12 months of disruption. The cost has to come out of the asset's earnings post-deal.
A page-speed problem that's hidden by mobile-first ranking. Desktop performance is fine. Mobile performance is bad. Core Web Vitals on mobile are in the red. Google's not punishing it yet, but they will. The fix is operationally significant.
Schema and structured data that haven't been touched since 2020. The asset's structured data is incomplete or partially broken. This was less of an issue when generative engines weren't a meaningful traffic source. In 2026 it matters a lot more than it used to.
None of these are in the data room. All of them require post-deal investment that should affect the price — and feed directly into the 100-day plan.
3. Key-person dependency in operations or content production
Pull the team and ask a sharp question: if the senior editorial lead, or the senior SEO lead, or the senior PPC lead left tomorrow, what would happen?
In most digital businesses at the size that gets sold, the answer is something between "operations would be impaired for six months" and "the business would lose 30% of its capability immediately". Critical knowledge sits in heads. Processes aren't documented. The senior person is, in practice, the operating manual.
When the deal closes, the financial incentive for that key person changes. They're now working for new owners. Sometimes their equity hasn't vested. Sometimes they were planning to leave anyway and the deal was their cue. Either way, the buyer is exposed.
The standard diligence question — "is there a key-person risk" — produces a standard answer ("we have a strong team"). The useful question is more specific: "if [name] left, what specifically would break, and what would it cost to replace the capability?" Asked of multiple people, with their answers compared, it surfaces the dependencies the team itself doesn't always realise exist.
4. Attribution lies in the marketing reporting
Marketing reporting in most digital businesses is a fiction agreed upon by the marketing team and the platforms they spend on. Each channel claims credit for the same conversion. Multi-touch attribution models flatter every channel they're asked to attribute. The blended numbers look better than the underlying reality.
In diligence, the standard test is: do the channel-by-channel numbers add up to the actual revenue line? Almost always, no. Marketing reports say each channel drove £2m. The actual revenue is £8m. Three of the channels are double-counting.
The fix isn't to demand a perfect attribution model — there isn't one. The fix is to look at the asset's growth in revenue alongside its growth in spend, channel by channel, over multiple time periods. The channels that genuinely matter will correlate. The channels that are claiming credit for revenue they didn't generate won't.
This is rarely surfaced in the seller's reporting because the seller's marketing team wrote the reporting. It's almost always surfaced in diligence because the diligence team is asked, specifically, to do this comparison.
5. The single-page traffic dependency that's about to lose its ranking
Related to (1) but specific enough to deserve its own callout. Sometimes the asset has a page that's punching above its weight. It's ranking for a high-volume term it shouldn't really be ranking for. The page is older than the page that's currently ranking #2. The page is on a domain with stronger backlinks than the #2 page. But the content is thinner, more dated, and increasingly out of step with what users want.
In classical SEO, this kind of page can hold its position for years. In 2026, with AI Overviews and generative search engines making the comparison more dynamic, these pages are getting overtaken faster. I've seen assets where a single page was driving 25% of organic traffic and was, by every content-quality measure, the worst page in the asset. It was ranking on legacy authority. The legacy authority is being repriced.
The diagnostic is to look at the URL and ask: if I were the user typing this query, would I prefer this page, or would I prefer the page below it? If you prefer the page below it, the asset is at risk of losing the rank — not because of an algorithm change, but because Google and the AI engines are getting better at giving the user what they actually want.
Putting it together
The pattern across all five: these aren't things sellers are actively hiding. They're things sellers don't know about themselves, or don't have the analytical capacity to surface, or have surfaced and rationalised away. The diligence team's job is to find them and quantify them.
If you're a buyer running DD, build the test for each of these into your standard scope. If you're a seller preparing for sale, run them on yourself first. The asymmetry in deals goes to the side that's done the work.
I've yet to run a digital diligence engagement where none of these five appeared. Usually three or four. Pricing them in is a difference between paying the right number for an asset and paying too much. The cost of the analysis is trivial. The cost of skipping it is a six-figure variance on the deal price.