How the Shortlist Gets Built

How the Shortlist Gets Built is based on original research conducted by Amzai among 66 screened, qualifying buyers who had participated directly in a completed CNAPP or CSPM vendor evaluation in North America during the 18 months preceding their participation.

A total of 149 prospective participants were approached. Sixty-six completed the research and met the qualification criteria. Together, participants reported 209 vendor-on-shortlist entries across 66 completed evaluations.

The research examined unaided vendor awareness, vendor shortlist presence, reported evaluation outcomes and the sources through which buyers first encountered shortlisted vendors.

The research included 66 screened, qualifying buyers based in North America.

Participants were required to have participated directly in a completed CNAPP or CSPM vendor evaluation during the 18 months preceding their participation in the research.

Each participant reported on one completed evaluation. The research therefore covered 66 participants and 66 reported evaluations.

Buyer-level percentages use the 66 qualifying participants as their base.

Vendor Shortlist Rate uses the 66 reported evaluations as its base.

Findings concerning the composition and reported discovery sources of shortlists use the 209 vendor-on-shortlist entries as their base.

Research was conducted through structured, approximately 30-minute interviews between February 12 and March 27, 2026.

Participants were recruited through LinkedIn and email using Amzai’s proprietary database and professional network.

Participants received no financial incentives, vouchers or other rewards.

Responses were recorded in a consistent structured format to support analysis across the 66 qualifying participants and 209 reported vendor-on-shortlist entries.

Participants qualified for inclusion if they:

• Were based in North America
• Held a relevant role with direct involvement in cloud-security purchasing
• Had participated directly in a completed CNAPP or CSPM vendor evaluation
• Had sufficient knowledge of the vendors considered during that evaluation
• Had completed the evaluation during the 18 months preceding their participation
• Completed the qualifying questions
• Provided a complete response

Participants were screened according to their professional role, buying authority, employer profile, location and direct involvement in the reported evaluation.

Professional identity and role were assessed using available professional information. Participation in the evaluation was self-reported and was not independently verified against procurement records or evaluation documents.

Incomplete, non-qualifying and confirmed duplicate responses were excluded.

Participants were asked to recall vendors and discovery sources before being shown or read any vendor list.

Prompted confirmation occurred only after unaided recall had been recorded. This sequence was designed to reduce the risk that the research instrument influenced initial vendor recall.

Unaided recall measures which vendors participants remembered without prompting. Prompted confirmation was used to check whether additional named vendors had appeared in the reported evaluation.

Buyer-level percentage: a percentage calculated using the 66 qualifying participants as its base.

Vendor-on-shortlist entry: one vendor reported as appearing on one participant’s shortlist. Across the 66 reported evaluations, participants identified 209 vendor-on-shortlist entries.

Vendor Shortlist Rate: the percentage of the 66 reported evaluations in which a named vendor appeared on the shortlist.

Reported win: a vendor identified by the participant as the selected vendor in the reported evaluation. Outcomes were self-reported and were not independently verified against contracts or procurement records.

Unaided vendor recall: a vendor named by a participant before any vendor names were shown or read to them.

Reported discovery source: the source through which a participant recalled first encountering a vendor that subsequently appeared on their shortlist.

A reported discovery source indicates participant attribution. It should not, by itself, be interpreted as proof that the source caused the vendor to be shortlisted or selected.

Buyer-level percentages are based on 66 qualifying participants.

Vendor Shortlist Rate is calculated across 66 reported evaluations.

Discovery-source and shortlist-composition percentages are based on 209 reported vendor-on-shortlist entries.

Each vendor-on-shortlist entry was treated as a separate entry when analysing the sources through which participants recalled first encountering shortlisted vendors.

Percentages have been rounded and may not always total exactly 100%.

No statistical weighting was applied.

Incomplete, non-qualifying and confirmed duplicate responses from the same individual were excluded from the final dataset.

Because the research covered 66 evaluations, small differences between vendors or channels should be treated as directional rather than as precise market-wide rankings.

At a base of 66 evaluations, the approximate 95% margin of error for a percentage can be as high as approximately ±12 percentage points. This calculation is provided as context only because the sample was not randomly selected.

The correlation between unaided vendor recall and shortlist presence was calculated across eight named vendors. With only eight vendor-level observations, the result should be treated as a descriptive pattern in this dataset, not as a statistically conclusive market relationship.

The research was designed, conducted, funded and analysed by Amzai.

Amzai owns the underlying research and prepared the report’s findings, interpretation and analysis.

No vendor named in the report commissioned the research, paid for inclusion or reviewed or approved the findings before publication.

Participants were not paid or otherwise incentivised to participate.

Amzai provides event delivery, audience engagement and research services. Any commercial interpretation or recommendation presented in the report is Amzai’s own.

The research relies on participants’ recollection of completed vendor evaluations.

Responses were not independently verified against procurement records, evaluation documents, contracts, vendor CRM data or sales records.

Professional identity and role screening should not be interpreted as independent verification of every detail reported about an evaluation.

Participants were recruited from Amzai’s database and professional network rather than through a random sample of the entire North American CNAPP or CSPM buyer population.

The study covered 66 buyers, 66 reported evaluations and 209 vendor-on-shortlist entries. The findings concern the buyers, evaluations and vendors represented in this study and should not be treated as statistically representative of the entire CNAPP or CSPM market.

Small differences between closely grouped vendors or channels should be treated as directional.

Reported discovery source does not necessarily represent the only source that influenced an evaluation. It identifies where participants recalled first encountering a shortlisted vendor.

Relationships between variables, including unaided vendor recall and shortlist presence, should not be interpreted by themselves as proof of causation.

• Research owner: Ashutosh Prasad, CEO, Amzai
• Research and analysis: Amzai Research
• Publisher: Amzai
• Fieldwork: February 12–March 27, 2026
• Publication date: 14 August 2026
• Last updated: 14 August 2026
• Contact: ash@amzai.ai

Amzai. (2026). How the Shortlist Gets Built: Cloud Security Platforms – CNAPP and CSPM.