The way buyers assess digital businesses has changed.

In the past, acquiring an online business often came down to a familiar set of questions: How much revenue does it make? What is the profit? Where does the traffic come from? How transferable are the assets?

Those questions still matter. But in the AI era, they are no longer enough.

In a recent Flippa webinar, Blake Hutchison, CEO of Flippa, sat down with Mushfiq Sarker, founder and CEO of WebAcquisition, to discuss how buyers should think about due diligence when acquiring digital businesses today. The conversation covered eCommerce, Amazon FBA, SaaS, content sites, AI risk, buyer blind spots, deal structure, quality of earnings, and the operational realities of the first 90 days after acquisition.

The message was clear: buyers are no longer just buying a website, app, store, or software product. They are buying the future reliability of that business’s customer acquisition engine.

Or, as Mushfiq put it, “You are buying eyeballs when you buy a business.” That single idea shaped much of the discussion.

Why Due Diligence Has Changed

AI has made it easier than ever to build products, generate content, automate workflows, and launch software. But that has also made many digital assets easier to replicate.

For buyers, this means the asset itself is no longer always the moat.

A SaaS tool can be rebuilt. Content can be generated. A landing page can be copied. A simple app can be recreated quickly.

What is harder to replicate is distribution.

That includes organic traffic, paid acquisition efficiency, email lists, brand authority, customer relationships, marketplace rankings, community trust, repeat buyers, and revenue history.

Mushfiq explained that his own acquisition criteria have shifted accordingly. Rather than starting with the business model, he looks first at the marketing channel strength behind the business.

This is one of the most important takeaways for anyone buying an online business in 2026. The question is not simply, “Can this be built?” The better question is, “Can this business continue to attract and convert customers after I own it?”

The New Buyer Mindset: Be Business Model Agnostic, but Channel Specific

A recurring theme from the webinar was that buyers should become more flexible about business models, but more disciplined about marketing channels.

Mushfiq noted that safe buying today starts with finding businesses that have a stronghold on a channel. That could mean five years of stable organic search traffic, profitable paid advertising, an engaged email list, a defensible YouTube audience, or long-standing customer relationships.

The strongest buyers are not necessarily those who say, “I only want SaaS,” or “I only want eCommerce.”

Instead, they ask:

• Can I understand how this business acquires customers?
• Do I trust that channel to continue?
• Do I have the skills to improve or expand it?
• Is there a second growth lever I can bring to the business?

This is particularly important in an AI-driven environment where surface-level assets are easier to replicate, but durable customer acquisition remains difficult.

The Biggest Due Diligence Blind Spot: Concentration Risk

One of the first blind spots Mushfiq highlighted was concentration risk.

This can appear in several forms.

• For a SaaS business, it may be one enterprise customer contributing a large portion of monthly recurring revenue.
• For a services business, it may be one client responsible for 30% or more of revenue.
• For a content site, it may be 90% of traffic coming from Google organic search.
• For an eCommerce store, it may be over-reliance on a single paid advertising channel.

Mushfiq said that once a single customer or channel represents roughly 20 – 30% or more of revenue, it becomes a serious risk factor.

That does not always mean the deal should be avoided. But it does mean the buyer should structure the deal accordingly.

Possible mitigations include retained equity for the seller, performance-based earnouts, seller financing, or a longer transition period where the seller remains involved in key customer relationships.

The broader lesson is simple: concentration risk does not always kill a deal, but ignoring it can.

Ecommerce Due Diligence: Gross Margins, Channel Risk, and the First 90 Days

For eCommerce businesses, Mushfiq focused heavily on gross profit margin.

He said that for brands selling their own products, he generally likes to see gross margins of at least 60 – 70%. For dropshipping businesses, where margins are naturally lower, he looks for roughly 20 – 30%.

Why does this matter?

Because gross profit is what funds the rest of the business. It pays for advertising, people, software, logistics, and the buyer’s return on investment. If the gross margin is too thin, the buyer may find there is little room to reinvest after acquisition.

The second key risk is marketing channel concentration. Mushfiq said he does not like seeing more than 80% of revenue dependent on a single marketing channel.

On the post-acquisition side, he recommended a simple 30, 60, and 90-day approach.

The first 30 days should be about stability. Get access to every account, confirm administrative ownership, review the asset list, and make sure revenue continues as expected.

The next 60 days should be about identifying easy wins, but not making reckless changes.

By 90 days, buyers should have a clearer view of the business rhythm, seasonality, and where careful optimization can begin.

One of his strongest warnings was for new buyers who acquire a business and immediately start changing everything. In eCommerce especially, timing matters. If a business is seasonal, major changes during peak periods can create unnecessary risk.

Amazon FBA Due Diligence: Account Health Matters

Amazon FBA businesses require an additional layer of diligence.

Beyond cost of goods, gross margin, freight, Amazon fees, storage fees, and fulfillment costs, buyers need to assess Seller Central account health.

Mushfiq made the point that an Amazon Seller Central account is itself a valuable asset. Buyers inherit not just the products and sales history, but also the account’s standing with Amazon.

That means buyers should check whether the seller has used questionable tactics to boost sales, whether there have been account warnings, and whether the account has maintained strong health over time.

For buyers without deep FBA experience, this is an area where specialist support is particularly important.

Content Site Due Diligence: Brand Beats Traffic Alone

Content sites have gone through one of the most dramatic shifts in digital M&A.

The Google Helpful Content Update, AI-generated content, and changes in search behavior have disrupted many smaller content sites. But that does not mean content businesses are dead.

In fact, both Blake and Mushfiq noted that larger, older, more established content businesses remain attractive when they have brand strength, traffic diversity, revenue diversity, and a community.

The key distinction is between a thin content site and a real media brand.

A site that relies almost entirely on Google organic traffic, has little direct audience relationship, and monetizes through a single ad or affiliate channel is far riskier than it used to be.

A site with a decade of history, a strong email list, social traffic, direct traffic, multiple revenue streams, and real audience trust is a very different proposition.

Mushfiq’s view was direct: if a content site has 80 – 90% organic search traffic, buyers should be extremely cautious.

That does not mean AI cannot be used in content operations. Mushfiq said his team uses AI with a “human in the loop,” where AI may assist with a large portion of the work, but expert review, editing, and original insight remain critical.

His warning was against mass publishing low-quality AI content with no review process. That may work briefly, but it is not a durable business model.

SaaS Due Diligence: The Product is Not Always the Moat

SaaS has historically commanded some of the highest multiples in digital M&A because of recurring revenue, scalability, and customer stickiness.

But AI has changed how buyers assess SaaS defensibility.

Many simple software products are now easier to replicate. The harder part is acquiring customers, retaining them, building trust, and embedding the product into a workflow.

That is why he prefers SaaS businesses with strong distribution, established traffic, customer relationships, and sticky B2B use cases.

The question buyers should now ask is not only, “How good is the software?”

They should also ask:

• How hard would it be to replicate the customer base?
• How embedded is the product in the customer’s workflow?
• Where does demand come from?
• Is churn low because the product is genuinely valuable?
• Are there untapped marketing channels a buyer can activate?

This is especially relevant for small SaaS acquisitions. A lightweight tool with weak distribution may be vulnerable. A revenue-generating SaaS business with loyal customers and strong acquisition channels remains valuable.

Why Quality of Earnings Matters

Another major takeaway from the webinar was the importance of not taking a P&L at face value.

Mushfiq warned that many buyers assume the profit and loss statement is accurate simply because it is presented professionally. But bookkeeping mistakes, missing costs, miscategorized expenses, owner add-backs, and excluded labor can all distort the true earnings of a business.

A common issue is missing labor cost.

For example, a seller may rely on family members, informal contractors, or underpaid internal support, then exclude those costs from the P&L. The business may appear more profitable than it will be for the buyer after acquisition.

Mushfiq gave an example where a buyer assumed they could easily replace staff after acquisition. But the real issue was that the P&L did not fully reflect the cost of the roles required to operate the business.

The lesson: buyers need to understand the true operating cost of the business after transfer, not just the seller’s historical cost base.

Quality of earnings analysis can be expensive, but Mushfiq said buyers can do a meaningful portion themselves by comparing bank statements, accounting records, tax filings, and the P&L to confirm that cash is actually flowing as represented.

Deal Structure is a Risk Management Tool

One of the most practical parts of the webinar was the discussion around deal structure.

When risk exists, buyers do not always need to walk away. They may be able to structure around it.

For example, if a business has customer concentration, an earnout can be tied to the retention of that revenue. If the seller is critical to customer relationships, retained equity can keep them involved. If the buyer wants downside protection, seller financing may align incentives over time.

Mushfiq said he likes retained equity and earnouts because they keep the seller connected to future performance.

Blake also noted that Flippa sees a range of structures across deals, including earnouts, seller financing, and salaried post-acquisition roles where a seller continues supporting key client relationships.

The broader takeaway is that due diligence should not only determine whether to buy. It should also inform how to buy.

The Big Takeaway: Buyers Are Buying Future Eyeballs

The central lesson from the webinar is that digital business due diligence has become a test of future demand.

Revenue matters. Profit matters. Assets matter.

But buyers need to go deeper and understand where the customers come from, whether those channels are durable, and whether AI is likely to disrupt them.

The most important question is no longer, “Does this business look good on paper?”

It is: “Do I trust that this business can continue attracting the same quality of customers after I acquire it?”

That is why due diligence matters. It helps buyers see beyond the listing, beyond the P&L, and beyond the excitement of the deal.

For anyone considering buying an online business, this webinar is a practical, timely guide to what has changed, what still matters, and how to think more clearly about risk in the AI era.

FAQ

How can buyers validate traffic, revenue quality, and operational performance when AI tools can inflate metrics?

The source of truth for traffic should be Google Analytics. Buyers should request access and review traffic sources, trends, and quality directly. If a business does not have Google Analytics installed, that is a major concern.

For revenue quality, buyers should review the platform where revenue is generated. For eCommerce, that may be Shopify. For SaaS, it may be Stripe. Buyers should compare that data against the P&L, accounting records, and bank deposits.

For operational performance, buyers should ask for a breakdown of software, contractors, employee costs, and workflows. A P&L may group important costs into broad categories, so buyers need to ask detailed follow-up questions.

How do you verify quality of earnings without spending a large amount on every deal?

Buyers can do much of the initial work themselves but hiring due diligence experts is the best way to ensure no red flag goes unnoticed.. They should review two years of bank statements, accounting records from QuickBooks or Xero, tax statements, and the P&L.

The key question is whether the cash shown in the P&L actually flowed into the bank account. Buyers should also look for missing costs, miscategorized expenses, and expenses that will be required post-acquisition but are not reflected historically.

What level of customer concentration is too risky in a business?

Once a single customer contributes around 20–30% or more of revenue, it becomes a meaningful risk factor.

In one example, a marketing agency where the largest customer contributed less than 10% of recurring revenue, which was viewed as relatively safe. By contrast, a business where one client contributes 30% or more of annual revenue may require a different deal structure.

How can buyers reduce customer concentration risk?

Buyers can use deal structure to reduce the risk. WebAcquisition suggests earnouts tied to customer retention or revenue performance, as well as retained equity for sellers who are important to customer relationships.

What should buyers look for in an eCommerce business?

Web Acquisition recommends focusing on gross profit margin and marketing channel concentration.

For owned-product eCommerce brands, 60 to 70% gross margins are generally good. For dropshipping businesses, roughly 20 to 30% should be good.

However, businesses that depend on one marketing channel should be reviewed differently. 

What should buyers do in the first 30, 60, and 90 days after acquiring an eCommerce business?

The first 30 days should be focused on stability: gaining access to accounts, confirming ownership, checking asset transfer, and making sure revenue continues.

From 60 to 90 days, buyers can begin identifying easy wins, but should avoid making too many changes too quickly. WebAcquisition warns buyers to be careful with changes during peak seasonal periods.

Is Amazon FBA different from regular eCommerce due diligence?

Yes. Amazon FBA requires additional diligence around Seller Central account health.

Buyers should review Amazon fees, freight costs, storage costs, account warnings, and any potential issues with the seller’s account history. Buyers are effectively inheriting the Seller Central account, so its health is critical.

Are content sites still worth buying after AI and Google updates?

Yes, but buyers need to be more selective.

Smaller content sites that rely almost entirely on Google organic traffic are much riskier than they used to be. Stronger content businesses tend to have brand value, multiple traffic sources, an email list, social media presence, and diversified revenue.

Stronger, larger content sites with long histories still attract buyer interest on Flippa because they have demonstrated resilience.

Is it okay for content businesses to use AI?

Yes, if AI is used with expert human review. AI can be used to assist with content, but one should keep humans involved for editing, insights, and quality control. WebAcquisition warns against mass-publishing low-quality AI content with no review process.

How has SaaS due diligence changed because of AI?

Buyers now need to assess how replicable the software is.

Simple software tools can often be rebuilt more easily today, so the real value may be in the customer base, brand, traffic, and distribution channels.

Sticky B2B SaaS businesses with strong customer relationships and embedded workflows remain attractive.

Should buyers worry if a business relies heavily on a single AI vendor?

This is usually a minor risk if the business can shift to another vendor. The bigger issue is whether workflows are portable and whether quality can be maintained if a vendor changes its model, pricing, or output quality.

What skills should a new buyer have before acquiring a business?

The answer depends on the asset type. An FBA buyer may need Amazon PPC expertise. An eCommerce buyer may need paid ads or SEO support. A SaaS buyer may need technical and customer success knowledge.

Buyers assess the skills required to operate the business, identify which skills already exist within the team, and hire for any gaps.

What is the single biggest shift buyers need to make in the AI era?

Buyers need to ask whether AI will affect the “eyeballs” coming to the business.In other words, will AI disrupt the traffic, leads, customers, or revenue channels that make the business valuable?

Buyers should assess the risk by channel, then structure the deal to protect themselves where appropriate.

What technical red flags can be missed in traditional due diligence, but are critical when evaluating AI-enabled businesses?
A key technical red flag is how easily the business can be replicated with AI. Many SaaS tools can now be “vibe coded” quickly, so buyers should look beyond the software itself and assess whether the business has defensible traffic, distribution, brand, and customer relationships.

Buyers should also be warned against AI-generated content or workflows without a proper human review process. AI can support “70% of the work,” but the remaining human editing, insight, and quality control is what makes it sustainable.

What does WebAcquisition charge for due diligence?

WebAcquisition Pricing depends on business model and complexity. Technical and marketing reports generally start around $3,000 and can go up to around $8,000. Quality of earnings work may range from roughly $4,000 to $8,000.

Get in touch with WebAcquisition>