Awareness barely predicts shortlist presence
Across the eight vendors examined, the correlation between unaided vendor recall and shortlist presence was 0.17. Being remembered did not reliably mean being evaluated.
Amzai Research · 2026
How the Shortlist Gets Built
Why being remembered does not necessarily mean being evaluated—and what 66 verified cloud-security buyers reveal about how CNAPP and CSPM shortlists actually form
Original research among buyers who participated directly in a completed CNAPP or CSPM evaluation in North America, covering 209 reported vendor shortlist entries across an 18-month evaluation window.
Published
Amzai Research
Research at a glance
- Verified buyers
- 66Verified buyers
- Shortlist entries
- 209Shortlist entries
- Prospective participants approached
- 149Prospective participants approached
- Evaluation window
- 18 monthsEvaluation window
About the report
Every cloud-security vendor knows its win rate. Far fewer know how often they are considered in the first place.
How the Shortlist Gets Built examines the stage of the buying process that normally remains invisible to vendor CRM and pipeline data: how buyers discover vendors, which names make the shortlist and where those shortlisted vendors originally came from.
Amzai surveyed 66 verified buyers who had participated directly in a completed CNAPP or CSPM evaluation in North America. Across those evaluations, participants reported 209 vendor shortlist entries.
The findings show that awareness, reach, shortlist presence and eventual selection are separate problems. They also reveal that some of the channels with the broadest buyer reach produced very few shortlist entries, while smaller and more trusted environments played a disproportionate role in consideration.
Headline findings
Buyer-level findings are based on 66 qualifying participants. Findings concerning shortlist sources are based on 209 reported vendor shortlist entries.
No shortlist entries were attributed to vendor outbound
Vendor sales or outbound activity reached 64% of participating buyers but produced none of the 209 reported shortlist entries.
Conferences and practitioner communities shaped consideration
Conferences, executive roundtables and private practitioner communities together produced approximately 42% of reported shortlist entries.
Explore the complete research
Download the full report for the complete findings, vendor comparisons and analysis covering:
- Shortlist Rate across eight CNAPP and CSPM vendors
- The difference between awareness and shortlist presence
- Vendor shortlist presence and reported wins
- How buyers first encountered shortlisted vendors
- Channel reach compared with shortlist-entry production
- The role of conferences and executive roundtables
- The role of private practitioner communities
- Vendor websites, analyst firms and generative search
- The limitations of outbound reach
- What vendors can and cannot see inside their own pipeline
Research methodology
Research overview
How the Shortlist Gets Built is based on original research conducted by Amzai among 66 verified buyers who had participated directly in a completed CNAPP or CSPM evaluation in North America during the specified 18-month evaluation window.
A total of 149 prospective participants were approached, producing 66 complete, qualifying responses and 209 reported vendor shortlist entries.
The research examined unaided vendor awareness, vendor shortlist presence, reported evaluation outcomes and the sources through which buyers first encountered shortlisted vendors.
Research population
The research included 66 verified buyers based in North America.
Participants were required to have participated directly in a completed CNAPP or CSPM evaluation during the specified 18-month evaluation window.
Buyer-level percentages use the 66 qualifying participants as their base. Findings concerning the origin or composition of shortlists use the 209 reported vendor shortlist entries as their base.
Data collection
Responses were collected between February 12 and March 27, 2026.
Participants were recruited through LinkedIn and email from Amzai’s proprietary database and professional network.
Research was conducted through a structured online questionnaire administered using SurveyMonkey and one-to-one interviews conducted through Google Meet and Zoom.
Interviews lasted approximately 15 minutes and followed the same questions and response options as the online questionnaire. Interview responses were recorded in the same format and included in the combined dataset.
Participants received no financial incentives, vouchers or other rewards.
Recall and prompting
Participants were asked to recall vendors and discovery sources before being shown any vendor list.
Prompted confirmation occurred only after unaided recall had been recorded. This was designed to reduce the risk that the questionnaire itself influenced participants’ initial vendor recall.
Qualification criteria
Participants qualified for inclusion if they:
- Were based in North America
- Had participated directly in a completed CNAPP or CSPM evaluation
- Had sufficient knowledge of the vendors considered during that evaluation
- Completed the qualifying questions
- Provided a complete response
- Had completed the relevant evaluation within the specified 18-month window
Incomplete, nonqualifying and confirmed duplicate responses were excluded.
Analysis
Buyer-level percentages are based on 66 qualifying participants.
Shortlist-entry percentages are based on 209 reported vendor shortlist entries.
Each reported shortlist entry was treated as a separate entry when analysing the sources through which shortlisted vendors were encountered.
No statistical weighting was applied.
Incomplete, nonqualifying and confirmed duplicate responses were excluded from the final dataset.
Small differences between vendors or channels should be treated as directional rather than as precise market-wide rankings.
Research ownership
The research was designed, conducted, funded and analysed by Amzai.
Amzai owns the underlying research and prepared the report’s findings, interpretation and analysis.
Research independence
No named vendor commissioned the study, paid for inclusion or reviewed the findings before publication.
Participants were not paid or otherwise incentivised to participate.
Limitations
The research relies on participants’ recollection of completed vendor evaluations.
Responses were not independently verified against procurement records, evaluation documents, vendor CRM data or sales records.
The research covered 66 completed evaluations and 209 reported vendor shortlist entries. Given this sample size, small differences should be treated as directional rather than as precise market-wide rankings.
The relationship between two variables, including vendor awareness and shortlist presence, should not by itself be interpreted as proof of causation.
The findings concern the buyers, evaluations and vendors included in this study and should not be treated as a statistically representative ranking of the entire CNAPP or CSPM market.
Publication details
- Research owner: Ash Prasad, CEO, Amzai
- Research and analysis: Amzai Research
- Publisher: Amzai
- Publication date:
- Last updated:
- Contact: ash@amzai.ai
Suggested citation
Amzai. (2026). How the Shortlist Gets Built: Cloud Security Platforms—CNAPP and CSPM.
About Amzai
Amzai is a global event delivery partner that brings exceptional events to life.
Working across the entire event calendar as an extension of our clients’ teams, we provide the expertise needed across audience engagement, sponsorship, logistics, coordination and execution, using data and insight to make each event stronger than the last.
Download How the Shortlist Gets Built
Complete the form to receive the full report, including all findings, vendor comparisons, channel analysis and research methodology.