PE firms spend significant time during software diligence on ARR, net revenue retention, churn, and gross margins. The analysis is thorough and the metrics are real. What most diligence processes miss entirely is the ecosystem question: how much of this company's value lives in the network of developers, partners, and integrations built around the core product, and what would it cost a competitor to replicate it?
The ecosystem economics piece in this series established the baseline: for every $1 Salesforce earns, its ecosystem generates approximately $4 in additional economic value. That ratio isn't unique to Salesforce at Salesforce's scale. It's the output of specific decisions made years before the ratio becomes visible in any financial model. And those decisions (or their absence) are already visible in every software company that goes through PE diligence.
Why ecosystem value is systematically undervalued
The standard PE diligence model is built around the target company's own financials. Revenue, customer count, churn, CAC/LTV. These are the numbers in the data room. Ecosystem value doesn't appear on the income statement. It shows up in the economic activity of partners and developers who are not the company's direct counterparties, and who, as a result, don't show up in any of the standard reporting.
This creates a consistent pattern: acquirers discount ecosystem assets because they can't easily measure them, then discover after close that the ecosystem was a substantial part of why the product had the retention it did. The developer who built a custom integration for a client hasn't just adopted the product: they've made it difficult to replace without replacing their own work. That switching cost doesn't appear in any churn cohort.
The implication is straightforward. If you're not running explicit ecosystem diligence alongside financial diligence, you are either undervaluing what you're buying or missing risk factors that will surface post-close.
Five dimensions worth assessing systematically
API surface area is the starting point. How much of the platform's core functionality is exposed via documented, supported APIs? A platform where key workflows are only accessible through the GUI is a closed product, regardless of what the marketing materials say. A platform where data read/write, automation hooks, and custom logic execution are accessible to third-party developers is a genuinely open one.
The underlying question is whether the architecture was deliberately designed for extension or whether extensibility capabilities were added after the fact. Look specifically at the breadth of API coverage relative to core product capabilities; the consistency of API design (versioned, documented, with a stated deprecation policy); and whether the platform offers hosted execution environments like Atlassian's Forge or Shopify Functions, where third-party code runs inside the platform's infrastructure rather than external services. Hosted execution is a significant signal: it means the platform has made a structural commitment to developers, not just an API surface commitment.
Marketplace health metrics are the second dimension, and the one where most diligence stops at the wrong number. App count is not a health metric. A catalogue of 12,000 apps and a catalogue of 4,000 apps can have wildly different ecosystem health profiles depending on the usage data behind them.
Attach rate is the percentage of customers who have installed at least one third-party extension, and it is the most important single indicator. Shopify's attach rate exceeds 80%, with the average merchant using six apps. That is not incidental to the product's retention profile; it is the mechanism of the retention. A platform with a 15% attach rate and a large app catalogue is telling you that developers are building but customers aren't integrating, which usually means the extensions aren't solving real problems, or that distribution within the marketplace is broken.
The metrics worth pulling alongside attach rate: developer count CAGR over three to five years; revenue concentration across the top 10 and top 100 apps; and total GMV or developer payout data if available. The Atlassian Marketplace generated $1.8 billion in annual sales in 2024, growing at 19% CAGR. That number tells you developers are running real businesses on the platform, and that means the switching cost for Atlassian's customers includes the switching cost for those developer businesses, too.
Documentation quality is a proxy for platform maturity that most diligence teams skip, because it doesn't reduce to a number in a model. Documentation determines what percentage of developers who encounter an API actually build something useful with it. The difference between average documentation and excellent documentation is the difference between a developer ecosystem that grows organically and one that requires continuous hand-holding to expand.
The diligence test is direct: have a developer with no prior knowledge of the platform attempt to build a working integration using only the public documentation. Time it. Compare the result to Stripe, which enforces a rule that no feature ships until its documentation is written, reviewed, and published. Stripe's documentation became an industry benchmark specifically because they treated it as a product with its own investment and metrics, not an afterthought. If the path from sign-up to working prototype is measured in days rather than hours, that gap is a signal about the platform's developer acquisition posture.
Revenue share design tells you the platform's posture toward its developer ecosystem, and therefore the kind of ecosystem it is likely to build going forward. The platforms with the strongest developer communities have consistently chosen to take a small or zero share early, transitioning to standard rates after developers have established distribution. HubSpot charges 0% in perpetuity and has built a partner economy generating $840 million annually. Atlassian introduced 0% for Forge developers on their first $1 million in lifetime earnings. Shopify takes 0% on a developer's first $1 million lifetime App Store earnings.
These are not financial concessions. They are deliberate developer acquisition strategies, as the developer acquisition playbook covers in detail. A platform that extracts a 30% revenue share from early-stage developers will lose the long-tail builders who create the specialist, high-value tools that make an ecosystem genuinely useful. What remains is the apps that couldn't find another distribution channel.
Ecosystem concentration risk is the factor most likely to surface post-acquisition. If 40% of the platform's ecosystem GMV flows through two apps, the acquisition of either (by the platform or by a competitor) creates outsized disruption. Healthy ecosystems have a long tail of specialist apps, each serving a segment, with no single dependency that could materially affect the whole.
Appfire's existence is the positive signal here. They've built an acquisition thesis around consolidating dozens of Atlassian marketplace apps into a single portfolio company, a strategy that only works if the individual apps have real enterprise value and the ecosystem is large enough to support a consolidation strategy. When people start building acquisition theses around the apps on your marketplace, the ecosystem has reached a form of permanent infrastructure status.
The Thoma Bravo model
Thoma Bravo's acquisition of Ping Identity in October 2022 (an all-cash transaction at $2.8 billion, representing a 63% premium), followed by the acquisition and merger of ForgeRock in 2023 for $2.3 billion, is a clear example of platform extensibility as investment thesis rather than product feature.
The rationale was not that Ping Identity had more capable identity features than competitors. It was that the enterprise identity management market represented a $50 billion opportunity, and the most defensible position in that market is a platform that becomes the authentication layer across enterprise software stacks. Every enterprise app, every third-party integration that uses Ping for identity, makes the platform harder to displace: not because the product is better, but because the switching cost includes every dependent integration.
Thoma Bravo acquired two companies and merged them to build a platform with the surface area and customer relationships necessary to establish that extensibility position. That's the ecosystem logic applied at the deal level: you're not buying a product, you're buying or building the infrastructure that other software depends on.
The diligence questions that matter
Given these five dimensions, the assessment questions worth asking in every software diligence process:
What percentage of the platform's core functionality is accessible via documented, supported API? What is the developer count CAGR and attach rate? How much economic value (in GMV, developer payouts, or partner revenue) flows to the developer ecosystem annually? What is the revenue share structure, and what signal does it send about the platform's developer posture? What is the concentration risk: how dependent is the ecosystem on the top 10 apps?
And the question that synthesises the framework: if this company stopped building new features tomorrow and only maintained its APIs, how many of its customers would leave within three years? If the answer is "very few," the ecosystem has created something more durable than the product itself.
That durability is what most PE diligence misses. It's also what the most sophisticated acquirers, the ones building platforms rather than buying products, have learned to look for first.