Absence from a report is not a verdict. Products can be left out by inclusion rules, timing or scope, so judge the vendor on direct evidence instead. Ask for customer references, security documentation, a sample SBOM and a proof of concept, and give it the same scorecard as everyone else.
Why a product might not appear
Forrester's public method says the analyst defines scope and sets inclusion criteria. Other firms use similar approaches. Reasons a product may be missing include:
- It launched or changed after the research window.
- It sits in a neighbouring category the report did not cover.
- It did not meet a threshold for size or customer base.
- The vendor did not take part. Forrester notes it may evaluate products regardless of participation, so this is not guaranteed to explain absence.
None of these says the product cannot do the job.
The risk that is real
A missing report does remove a shortcut. Analysts give buyers an outside view on a vendor's viability, roadmap and customers. If you skip a product with no report, you lose nothing. If you buy one with no report, you must collect that outside view yourself.
A due diligence list to replace it
- Customers. Ask for two references with a similar stack and size, and ask them what went wrong during rollout.
- Company health. Ask about funding, headcount trend and support staffing. A smaller company can still be steady, but you should know.
- Security of the vendor. Request its security documentation and how it handles your data. Ask what evidence exists for its own controls and read it carefully.
- Product evidence. Request a sample SBOM and a documented export format. Run your test corpus.
- Exit terms. Confirm you can export your data and configuration.
- Support. Test it. Open a real question during the trial and time the answer.
Compare on equal footing
Use the same scorecard for products with and without reports. Give no bonus for a placement and no penalty for absence. If you want to reflect the extra due diligence, put it in a separate risk column.
Read the claims with care
Be cautious if a vendor without a report cites analyst commentary about the category as if it applied to them. A general market statement is not an assessment of one product, and Gartner's reprint rules limit vendors to industry-general quotes for exactly that reason.
Safeguard offers SBOM and dependency scanning, reachability analysis and a free scan at gold.safeguard.sh/scan, which lets you test any vendor's claims against a neutral baseline of your own.
Quick check
Should a procurement team require an analyst mention?
It is better to require evidence you can inspect. A mention can be one source among several but should not be a gate.
How much extra work is this?
Plan for a few extra days of due diligence per unlisted vendor.
Sources
Last reviewed: 19 October 2026.
