Ask ten questions of any analyst report: what was scoped, who was included, which criteria and weights were used, when the research was done, what inputs were used, what the cautions are, whether it covers your needs, and what you would still need to test. If you cannot answer them, do not rely on it.
The ten questions
1. What market did it scope? Supply chain security overlaps with composition analysis, application security testing and posture management. Confirm the report covers the one you are buying.
2. Who was included, and why? Forrester's public method says the analyst sets inclusion criteria. Read them to see who could not appear.
3. What criteria were used? Forrester describes criteria meant to be differentiating rather than exhaustive, so common requirements may be absent.
4. How were they weighted? Weights decide the outcome. If you can customize them, do.
5. When was the research done, and on which product versions? Dates and versions matter in a market that ships often.
6. What inputs did the analyst use? Forrester lists questionnaires, demos, reference interviews and analyst expertise. None of these is a test on your code.
7. What cautions does it give for each product? Cautions are often more useful than strengths.
8. Does it cover your needs? Compare its criteria to your own list. Anything you need that is missing must be tested separately.
9. How is the vendor quoting it? Gartner's reprint rules require exact quotes, no implied endorsement and a disclaimer that research reflects opinion. Wording that goes beyond that deserves a question.
10. What will you still verify yourself? Name the tests you will run regardless of the placement.
How to use the list
Print it and attach the answers to your evaluation file. When a colleague asks why you did or did not rely on a report, the answers are there.
If a report fails three or more questions, use it for vocabulary only.
Scoring yourself
Not every report will answer every question, and paywalls limit what you can see. Mark unanswered questions as unknown, not as fine. Unknowns are a reason to lean more on your own test.
Make the list shorter for small decisions
For a low risk, short term tool, questions 1, 5, 8 and 10 may be enough. For a company-wide platform, use all ten and add questions about data handling and exit.
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates, and a free scan at gold.safeguard.sh/scan supports question 10.
Write one line per question. Short answers force clarity, and gaps become obvious.
Quick check
Do I need the full paid report to answer these?
Some answers need it, such as criteria and weights. Without it, mark them unknown and rely more on your own testing.
Which question matters most?
Number eight, whether it covers your needs. A report that does not is background reading only.
Sources
Last reviewed: 19 October 2026.
