Search each firm's own site for several category names, not one, then read the public methodology, scope and date before anything else. Categories such as software composition analysis, application security testing, posture management and vulnerability management overlap, and each firm draws the lines differently. Public pages tell you the method, even when reports are paywalled.
Why one search term fails
Supply chain security sits across more than one market. Depending on the firm and year, coverage may live under names for dependency analysis, application security testing, application security posture, vulnerability management, cloud security or software supply chain security itself. I could not verify a current list of reports from each firm, so check their sites rather than assuming.
A June 2026 Frost press release shows how fast frameworks change, and the other firms revise too. So date matters as much as topic.
A search routine
- Write five or six category names and synonyms for what you buy.
- For each firm, search its site and filter by type: scored evaluation, market map, advisory note, blog.
- Record the title, market definition, edition date and access level.
- Read the methodology page for that report type.
- Read the scope and inclusion text before the findings.
What public pages give you for free
- Method. Forrester, GigaOm and KuppingerCole publish methodology pages. Frost publishes announcements about its framework.
- Policies. Forrester publishes policies on integrity, vendor review, participation and citations.
- Library listings. KuppingerCole's library shows whether items are free, free with an account or restricted.
- Analyst commentary. Blogs often explain how to use a report, as in KuppingerCole's post on long lists and short lists.
Paywalled content stays paywalled. Do not copy a report, and do not rely on a vendor's slide for scores you cannot see.
Turn what you find into a brief
After an afternoon you should have: a list of relevant report titles, the method behind each, and the questions each cannot answer. Hand that to your team with your own requirement list and the plan for a proof of concept.
Check your shortlist against your own inventory
Before you read reports, know what you actually run. Inventory first makes every vendor conversation more concrete. Open the demo and see what a dependency inventory looks like.
Click through it at your own pace, or open it full screen.
Keep a simple log
A spreadsheet with one row per report keeps the work reusable: firm, title, market, edition date, access level, method link, and a line on what question it answers for you. Revisit it each quarter. Editions change, and a report you dismissed as too early may become relevant once the market matures.
Quick check
Are analyst reports free?
Access varies. KuppingerCole's library marks items as free, free with an account or restricted, and Forrester describes licenses for research use. Check each item.
Is one category name enough to search?
No. Coverage is spread across overlapping names, and each firm defines markets differently.
Safeguard's asset discovery and SBOM and dependency scanning give you an inventory to bring to those conversations, and the free scan takes a few minutes.
Sources
- The Forrester Wave Methodology
- Forrester policies index
- GigaOm methodology
- About KuppingerCole's Leadership Compass
- KuppingerCole research library
- Looking at vendors from various angles (KuppingerCole blog)
- Frost and Sullivan press release on the Frost Radar update
Last reviewed: 19 October 2026.
