Forrester scores each vendor against written scales for every criterion, then weights the criteria by importance, using the data gathered plus the analyst's market expertise. Placement falls into three bands: Leader, Strong Performer and Contender. The weights are analyst opinion, which is why your own priorities matter more than the default.
Scales first, then scores
According to the methodology page, the analyst writes an explanation for each scoring scale before scoring. Each vendor is then scored against those scales. The page says the three bands align with a 3-point scoring rubric, but it does not publish the rubric itself.
That means you cannot rebuild a score from public pages. What you can do is read the criteria list inside a report, if you have access, and see which of them match your needs.
Weighting is opinion by design
Criteria are weighted by importance, but the public page gives no weights or percentages. The vendor review policy goes further: vendors may not dispute criteria, scales or weightings, because Forrester treats them as analyst opinion, not fact. Vendors can escalate factual disagreements about their own score, not the framework.
For a buyer this is useful clarity. The weights reflect a view of a typical market buyer. If your estate is mostly one language, or you must run fully offline, a criterion that is lightly weighted in the report could be decisive for you.
What the graphic shows
Forrester says customer feedback determines the prominence of each vendor's marker, based on factors such as reference completeness, response rate, breadth of functionality, enterprise versus smaller references and overall satisfaction. Vendor participation is noted in the report text, not on the graphic. The page says these graphic changes apply to Waves that kicked off on or after 1 July 2024.
Reweighting for yourself
A simple method works well:
- List ten to fifteen requirements from your own security and engineering teams.
- Mark each as must have, should have or nice to have.
- Map each to the evaluation criteria in the report, noting gaps the report does not cover.
- Score shortlisted products yourself in a proof of concept.
If a report does not cover a requirement you care about, such as how a tool handles AI coding agents, that is a reason to test, not a reason to assume.
A worked example of reweighting
Suppose a report weights ten criteria and one of them is self-hosted deployment, lightly weighted because most buyers use SaaS. Your regulator expects data to stay inside your network. For you that criterion is a gate, not a nuance. A vendor placed in the top band overall could still fail it.
The reverse also happens. A vendor in a lower band overall may score well on exactly the three criteria you rank highest. This is why the band is a starting point for questions, not an answer.
Keep your own scorecard next to the report and note where the two disagree. Those gaps are the agenda for your proof of concept.
Quick check
Can a vendor ask Forrester to change the weights?
No. The vendor review policy lists disputing criteria, scales or weightings as something vendors may not do.
Does the public methodology page list the weights?
No. It says criteria are weighted by importance and gives no numbers.
Safeguard publishes what its platform does on its site, including policies, gates and guardrails and compliance evidence automation, so you can map them to your own weighted list.
Sources
Last reviewed: 19 October 2026.
