Forrester says an analyst sets the scope, picks the vendors, writes criteria, scores each one against a scale and weights the criteria to draw the Wave. Buyers should read the weights first, because they decide the outcome, and then re-weight the findings for their own needs.
What Forrester says about its method
Forrester's public methodology page describes these steps:
- The analyst defines the scope, identifies vendors and sets inclusion criteria.
- Criteria are meant to be differentiating rather than exhaustive.
- The analyst writes scale explanations for each criterion and scores vendors against a 3-point rubric.
- Scores draw on vendor questionnaires, demos, reference interviews and the analyst's own expertise.
- The analyst weights criteria by importance, and the scores and weights produce the graphic.
- Vendors see their scorecards and profiles after finalization and can give feedback during the review period.
The page also says Forrester may evaluate products regardless of whether a vendor takes part, and that it will not consider vendor requests to remove themselves from a Wave.
Why the weights matter most
Two buyers can look at the same scores and reach different conclusions, because the graphic is only as relevant as its weights. If the analyst put heavy weight on strategy and light weight on developer workflow, and your adoption risk is developer workflow, the picture is answering a different question than yours.
Forrester describes an interactive experience that lets clients customize its findings to their business needs. If you are a client, use it. Move the weights to match your priorities and see whether the order changes. If the order is stable, you have learned the finding is stable under your priorities. If it flips, you have found a real trade off to test.
Criteria that are "differentiating, not exhaustive"
That phrase deserves attention. A criteria list built to separate vendors will leave out things that every vendor does, and things that few do. Basics such as export formats or integration with your ticket system might not appear because they do not separate products. They may still decide your project.
Write a list of the basics you need and verify them directly.
Practical steps
- Read the criteria and weights before the placement.
- Mark criteria that match your requirements, and criteria that do not.
- List your own requirements that the report omits.
- Ask each vendor to demonstrate both lists on your sample code.
- Record results in a single scorecard with your weights.
What the rating labels are
The public page describes the rubric as producing Leader, Strong Performer or Contender ratings. Those are the analyst's categories for this evaluation. They are not a statement that a Contender will fail in your environment.
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates, with a free scan at gold.safeguard.sh/scan to try on your own repository.
Quick check
Does a vendor pay to be in a Wave?
The Forrester pages we read do not address payment. Ask the analyst firm and the vendor directly, and see the post on pay-to-play questions linked below.
Can I trust a Wave if the vendor reviewed its own scorecard?
Vendor review is a documented fact-check step, and Forrester says it accepts no new information during the courtesy preview. It still helps to ask what changed after review.
See also Is analyst placement pay to play? Questions buyers can ask.
Sources
Last reviewed: 19 October 2026.