Technographic Data: How to Find Out What Software a Company Uses

The average organization in Zylo's 2026 SaaS Management Index runs 305 SaaS applications, and the median organization runs 240. Technographic data is the record of which tools a company uses, and most of it is inferred from the few that leave a public trace: a script on the website, a DNS record, a job post. This guide shows six checks you can run on any company by hand, the technographic data tools and providers that run them at scale (BuiltWith, Wappalyzer and four alternatives, with prices), six questions for comparing providers, how to turn the results into a target list, and where the data goes wrong. It also publishes Spona data: how many companies in the US, UK, Germany and France show evidence of HubSpot, Salesforce, Microsoft Dynamics, Oracle, SAP and NetSuite.

Get thousands of leads in 4 minutes.

Stop stitching tools together.
Start with verified sales data, delivered in minutes.

SCALE SALES NOW

No contracts · No setup · No onboarding

Technographic data explained: definition, examples and the five fields of a record

Technographic data, or technographics, describes the technology a company uses: its CRM, ERP, marketing automation, ecommerce platform, email provider, cloud and security tools. B2B technographic data is about the company, not the person: the record says a company runs HubSpot, not who logs in to it.

Technographic data examples by category

Providers group the data into layers. The examples below are typical entries, with the check in this guide that surfaces each one:

• Infrastructure and hosting: AWS, Microsoft Azure or Google Cloud, a CDN such as Cloudflare. Visible in DNS and certificate records (checks 3 and 6).
• Business applications: Salesforce or HubSpot as the CRM, NetSuite or SAP as the ERP, Workday for HR, Marketo for marketing automation. Visible in job posts, case studies and SPF records (checks 3 to 5).
• Website and marketing stack: Shopify or WordPress, Google Analytics, HubSpot forms, a chat widget. Visible in the page source (checks 1 and 2).
• Security and identity: Okta for single sign-on, an email security gateway. Visible in sso. subdomains and MX records (checks 3 and 6).
• Developer and data tools: GitHub, Snowflake, Datadog. Visible in subdomains and job posts (checks 4 and 6).

How many technologies a provider covers depends on its method and on the day you ask. ZoomInfo says it tracks 30,000+ technologies across 200+ categories; 6sense lists 30,000+ technologies and 15.8M+ companies; BuiltWith, which reads websites only, lists 127,836 web technologies. Demandbase shows why such counts need a date: its technographics product page reports 136M+ domains and 48K+ technologies, while its FAQ guide still says 82+ million domains and 18K+ technologies.

A product name on its own is weak data. A usable technographic record has five fields:

• Technology and category, for example Salesforce in CRM.
• Evidence: where the signal came from (a website tag, a DNS record, a job post, a case study, a licensed feed).
• First seen and last seen dates, so you know whether the signal is current.
• Confidence: how strongly the evidence points to active use.
• Scope: the domain or subsidiary the evidence belongs to.

Vendors build the confidence field in different ways. 6sense, for example, scores each detection on recency, on how often the technology is mentioned and on the reliability of the source, and weights direct scans of a company's digital presence above passive sources such as job descriptions. A record without a date and a source cannot be checked, so treat it as a lead to verify, not a fact.

How to find out what software a company uses: 6 technographic data checks

Each check needs a browser or a terminal and nothing else. The first two read the website; the other four look behind it, where most business software lives.

1. Read the website source code. Open the home page, press Ctrl+U (Option+Cmd+U in Chrome on a Mac) and search the source for tool names and script domains. Marketing, analytics and chat tools load in the visitor's browser, so they show up here. HubSpot's tracking code, for example, pushes its calls into an array named _hsq, so "_hsq" in the source points to HubSpot. Check the pricing, careers and contact pages as well: forms, chat widgets and job boards often load only there.
2. Run a browser extension. The Wappalyzer extension (3,000,000 users on the Chrome Web Store) and the BuiltWith extension search the page code for you and name the technologies on the page you are viewing. They see what the browser sees, so the blind spots of check 1 apply.
3. Look up the DNS records. Run "dig MX company.com" and "dig TXT company.com" in a terminal, or use Google Admin Toolbox Dig in the browser. The MX record names the email provider: smtp.google.com, or older values that start with aspmx, means Google Workspace; a host ending in mail.protection.outlook.com means Microsoft 365. The SPF record, the TXT record that starts with v=spf1, names the outside services the company allows to send mail for its domain through RFC 7208 "include" entries, which often exposes the CRM, marketing automation, help desk and billing tools. Other TXT records hold the verification strings that SaaS vendors ask domain owners to add.
4. Read the job posts. Job ads name the tools new hires must know. A listing that asks for Salesforce and Marketo experience signals that the company runs both, which is how 6sense reads its passive sources. Search the careers page and job boards for "experience with" plus the tool, and note the post date.
5. Check partner, integration and case-study pages. Vendors publish customer stories and partner directories, and many companies list the tools they connect on their own integrations page. A named case study is strong evidence of a deployment; an old one may describe a project that has since ended.
6. Search certificate logs and subdomains. Publicly trusted TLS certificates are written to public, append-only Certificate Transparency logs: 2,563,437,540 certificates since 2013, according to certificate.transparency.dev. A search for the domain on crt.sh lists the subdomains it has secured, such as sso., status. or help., and a CNAME lookup on each shows which vendor hosts it. Bloomberry builds its technographic data from the same infrastructure signals.

Log every finding with its source and the date you saw it. You will need both when the account comes up for outreach, and again when you recheck it.

Vendors run the same two families of checks at scale. ZoomInfo calls website scans and email-domain fingerprinting active detection, and job posts and employee profiles passive signals, and notes that passive signals "lag actual adoption by months". Demandbase says it mines "the technologies hiding behind the firewall" from sources beyond the website. Checks 1, 2, 3 and 6 read the company's own infrastructure and describe today; checks 4 and 5 read what the company or its vendors published, which can run months behind or ahead of actual use.

Technographic data tools: BuiltWith alternatives and Wappalyzer alternatives

Manual checks work for 20 accounts, not 2,000. The six technographic data providers below run them at scale, and each is a common answer when people look for a BuiltWith alternative or a Wappalyzer alternative. The table shows how each one detects software; the two sections after the list explain what each vendor sells (a lookup, a list, a database, an API) and six questions for comparing providers. Enterprise teams also shortlist HG Insights, which sells technology install data on a standard two-year term with no free trial, and 6sense, which lists technographics in all three of its plans; neither publishes prices. Prices and coverage figures below come from each vendor's own pages.

1. BuiltWith

BuiltWith crawls websites for front-end technologies and sells lists of the sites that use them. Its plans page reports 127,836 tracked web technologies and data from 491.9 million domains, updated weekly. Single-site lookups are free. Basic costs $295 a month ($2,950 a year) for 2 technologies and 2 keywords, Pro costs $495 a month with no technology limit, and Team costs $995 a month. Paid plans add usage alerts when sites start or stop using a technology, spend estimates and the contact names that businesses publish. The limit is the method: a crawler sees what a website loads, so ERP, finance and most CRM systems stay invisible unless they leave a public trace.

2. Wappalyzer

Wappalyzer is best known for its browser extension and also sells lookups, lead lists, CRM enrichment and an API. The free account includes 50 technology lookups and 50 email verifications a month, 5 website alerts and sample lead lists. Pro costs $250 a month, Business $450 and Enterprise from $850, with 17% off on annual billing. It reads the same front-end signals as BuiltWith, so the same backend blind spots apply; the difference is the entry price and a free tier that covers 50 lookups a month.

3. NerdyData

NerdyData is a search engine for website source code. You can search for any HTML, JavaScript, CSS, HTTP header, cookie or XHR URL, which makes it check 1 at scale, and its homepage reports 14.7 million crawled domains and 1,131 tracked technologies. A free account shows up to 100 rows per report; Basic costs $200 a month for 5,000 rows per download, and Pro costs $300 a month for 200,000. Use it as a Wappalyzer alternative when you know the exact string you want, such as a vendor's script name or a widget ID. It does not detect backend tools.

4. Bloomberry

Bloomberry reads infrastructure, not just web pages: subdomains, DNS records and certificate logs. That lets it see backend tools such as Snowflake, Rippling or Vanta and date the moment a company starts or stops using one, across 1,700+ B2B products. The app costs $199 a month for data on 2 vendors and $299 for 5; API plans start at $199 a month for 6,633 credits. On the app plans you pay per vendor tracked, so it suits a team watching a few competitors, not a team that needs every front-end tool on every site.

5. TheirStack

TheirStack builds technographic data from job posts on career sites, applicant tracking systems and job boards, and tracks 33,000 technologies. Its datasets hold 225 million job records, with 305,000 added a day, and 51 million technographic records. Sign-up is free, 1,000 company credits cost $109 one-time, and API plans start at $49 a month for 1,500 credits. Job posts reach tools a website never shows, such as data warehouses and ERP systems. The catch: a post names a skill the company wants, which can mean a migration that has not happened yet.

6. ZoomInfo

ZoomInfo sells technographic data inside its company and contact database, so one search can filter accounts by technology and return the people to call. It publishes no prices: its pricing page says cost depends on features, licenses and credit usage, that credit cost follows the depth of information, and that technographics belong to the advanced credits rather than the basic firmographic ones. It fits teams that already buy a large data platform. For a first test of a technology segment, the five tools above publish monthly prices and free tiers.

Technographic data provider, database, API or tool: what you are buying

The same vendor often sells five different things, and the price depends on which one you need:

• A lookup tool answers one question about one site: BuiltWith's free lookup, the Wappalyzer extension, or a free scanner such as CRFT Lookup. Free or close to it, no export.
• A list product returns every site or company that matches a technology filter: BuiltWith lists from $295 a month, Wappalyzer lead lists from $250, Spona's per-lead lists. This is what most sales teams mean by a technographic data provider.
• A database or dataset is a licensed file you load into your own warehouse. Coresignal reports 5M+ technographic records, extracts tech stacks from job postings with NLP and delivers the data "as a flat file" in JSON; HG Insights, Demandbase, 6sense and ZoomInfo license their datasets on quotes.
• An API returns the record on demand for your CRM, warehouse or AI agent. BuiltWith includes "APIs, MCP tools, and AI-ready SDKs" in every paid plan; Wappalyzer's API needs a paid plan and runs on credits, typically 1 per website, and the credits included in a plan expire after 60 days; NerdyData's API is pay as you go and "not included with monthly subscription"; Bloomberry's API starts at $199 a month and TheirStack's at $49.
• An orchestration layer such as Clay buys from several providers in one place ("200+ providers") and lists HG Insights, Sumble, Spade and Openmart under technographics data. You pay Clay's credits on top of the provider's price.

How to compare technographic data providers: six questions

1. Which method? Website crawl (BuiltWith, Wappalyzer, NerdyData), infrastructure signals (Bloomberry), job posts (TheirStack, Coresignal) or a licensed enterprise dataset that combines several of these with sources beyond the website (Demandbase, HG Insights, 6sense, ZoomInfo). The method sets the blind spots listed in the accuracy section below.
2. Does every record carry a source, a first-seen and last-seen date and a confidence score? 6sense documents its score; Spona stores a confidence and a last-seen field. A provider that cannot show them is selling a product name, not evidence.
3. How often is it refreshed? BuiltWith says weekly, 6sense reviews its technographics every 2 to 4 weeks, Spona rechecks every 30 days. Ask for the cadence in writing, and for the share of records older than 90 days.
4. How deep is coverage for your segment? Website tools see small businesses that have a website and never post jobs; job-post tools favor companies that hire; install data favors enterprises. Test with 50 accounts you already know. A consultant asking on Hacker News found BuiltWith and Wappalyzer missing the niche developer tools he sells into, and Bloomberry's founder replied that it skips some JavaScript frameworks to focus on paid products.
5. How is it delivered? Web app, CSV export, CRM connector, API or MCP. BuiltWith lists HubSpot, Dynamics 365, Zoho, Pardot and Close integrations in all plans; Bloomberry returns "data on the companies, not contact information of individuals", so plan a contact step.
6. What does the price buy? A technology tracked (BuiltWith Basic covers 2 technologies, Bloomberry's app 2 or 5 vendors), a lookup credit (Wappalyzer, TheirStack), a row (NerdyData), a lead (Spona) or a quote with a two-year term (HG Insights). Compare the cost per 1,000 matched companies for your own filter, not the headline price.

How to use technographic data in targeting

Technographic data pays off when it changes who you contact and what you say. In Spona data, "technology + industry + headcount" was the primary filter combination in 120 of 1,000 searches (12%): technology works as one filter among several, not as the whole definition of a market.

Technographic segmentation: five plays

• Displacement. Companies on a competitor's product. Lead with the cost of staying, and time the message to a renewal or a migration job post.
• Complement. Companies on a platform you integrate with. A HubSpot app sells to HubSpot users; say what the integration adds to the workflow they already run.
• Gap. Accounts that fit your ICP but show no tool in your category. Read a blank field with care: in Spona data, 38% of 10,000 deduplicated company records carry technology evidence, so a missing technology often means unknown, not absent.
• Timing. Companies that just added or dropped a tool. BuiltWith usage alerts, Wappalyzer website alerts and Bloomberry's subscribe and churn alerts flag the change; reach out while the project is open.
• Stack size. Companies running many tools around your category. More tools mean more integration work, so lead with consolidation or with the integrations you support.

Technographic segmentation is the name for this sorting: accounts grouped by what they run rather than by industry or size alone. ZoomInfo's worked example splits a sales engagement vendor's market into three tiers, Salesforce with no engagement tool, Salesforce plus a competitor's tool, and a CRM that does not integrate; each tier gets its own message and the third is dropped from the list.

The same plays run in reverse on your customer base. A customer whose site starts loading a competitor's script, or whose job posts ask for a competitor's skills, is a churn risk; a customer that adopts a platform you integrate with is an expansion opening. Demandbase lists retention as one of its seven uses of technographic data.

Technographic data plus firmographics and intent

Technology alone returns a long list. Add the firmographic limits from your ideal customer profile (industry, headcount, country) to keep only accounts you can serve, then rank them by timing: buyer intent data shows which of those accounts research your category now. Marketing works from the same segments: an ABM ad audience of displacement accounts, a landing page per CRM, a nurture track for gap accounts.

A worked example: a NetSuite consultancy targets US manufacturers with 50 to 500 employees, NetSuite evidence last seen within 90 days, and a finance or operations job post in the last month. Spona data counts 18,000 US companies with NetSuite evidence across all industries; the industry and headcount filters cut that to the share the consultancy can serve, and the job-post filter puts the busiest accounts first.

From a technographic account list to contacts

Technographic data names companies, not people. Each account still needs the person who owns the tool: marketing operations for HubSpot, a finance systems lead for NetSuite, IT for Microsoft 365. Find and verify their emails with waterfall enrichment, which queries several data providers in sequence, and recheck before each send, because contacts go stale through data decay. Push the technology fields into your CRM with their source and last-seen date through CRM data enrichment, so reps can see why each account is on the list.

Technographic data by country: Spona technology counts

How common is each platform among companies you can reach? The table counts companies, by headquarters country, with detected evidence of six business software families in Spona data.

Four patterns stand out:

• HubSpot leads in the US, the UK and France. In Germany, SAP leads with 18,000 companies against 14,000 for HubSpot.
• Germany's SAP count reaches 82% of the US count (18,000 against 22,000).
• NetSuite is mostly a US market here: 18,000 US companies against 700 in Germany and 600 in France.
• In France, SAP and Salesforce tie at 8,000 companies each.

The same table sizes a market. For a NetSuite consultancy, 18,000 US companies with NetSuite evidence is the ceiling of its US market before industry and headcount filters; 700 in Germany and 600 in France say that a NetSuite practice in those countries is a niche, and that the German ERP conversation starts with SAP.

How the counts are built: Spona combines licensed technographic feeds with dated evidence from company websites, integration pages, job ads and other permitted public sources, and stores each detection as evidence of use with a confidence and a last-seen field. New signals are ingested weekly, evidence is rechecked every 30 days, and a signal gets a stale flag after 90 days. Read the counts with four caveats:

• Categories overlap: a company with Salesforce and HubSpot counts in both rows, so the rows cannot be added.
• NetSuite is counted apart from other Oracle products.
• SAP and Oracle cover several product families. Filter by product family before you claim that a company runs an SAP or Oracle ERP.
• A public website tag alone does not establish an internal ERP or CRM installation.

The cadence above is how Spona works today, not a refresh guarantee, so check the last-seen date on any record before you act on it.

How accurate is technographic data?

Accurate enough to rank accounts, not accurate enough to assume. Each source fails in a known way.

Website tags show presence, not use. A script proves the code loads, not that the team uses the product, and old scripts often stay on a site after the contract ends. Bloomberry's homepage says it plainly: website scanning "tells you presence, not timing" and skews toward front-end technologies.

Most business software never touches the website. Zylo counts 305 applications in the average portfolio, and many finance, HR and security tools leave no public trace. BuiltWith's 127,836 tracked technologies are, in its own words, web technologies.

Job posts state intentions. A post that asks for SAP experience can come from a company planning a move to SAP, a consultancy staffing a client project or a recruiter.

Subsidiaries blur the record. A tag on one brand's site says little about what the parent company runs, and the reverse.

Data ages at different speeds. BuiltWith updates weekly, 6sense reviews its technographic data every 2 to 4 weeks, and Spona rechecks evidence every 30 days. A signal last seen six months ago describes the past.

Coverage has holes, and each vendor's holes differ. Only 38% of the 10,000 deduplicated company records in Spona's fill-rate sample carry technology evidence. In the Hacker News thread above, BuiltWith and Wappalyzer lacked the niche developer tools one consultant sells into, and Bloomberry covers paid products rather than every JavaScript framework.

Vendor coverage counts move. Demandbase's two pages disagree by 54 million domains, as shown above, and BuiltWith's technology count read 127,836 one day and 127,848 the next. Read every coverage figure, including the Spona counts above, as a dated snapshot.

How to check a technographic record before you use it

1. Read the evidence source and the last-seen date. No date, no outreach.
2. Confirm with a second, independent check: an MX record plus a job post beats one website tag.
3. Ask in discovery: "Which CRM are you on today, and when does the contract renew?"

Spona for technographic targeting: what it adds and what it leaves to the tools above

Spona is a contact layer with technology filters, not a website-detection tool. You describe your ideal customer in a chat, including the technologies they use, and Spona's AI mines 40+ data sources, verifies every lead and returns a scored list with the reasoning behind each match in about 4 minutes.

Where it fits:

• You need people, not domains. BuiltWith and Wappalyzer lists start from websites and add the contact details each tool can find; Bloomberry provides company data only. Spona returns verified decision-makers at companies that match the technology, industry, headcount and country you set.
• You want to test a segment at low cost. You pay per lead: qualified, scored leads cost $0.32 to $4 each and bulk leads $0.01 to $0.09, plus a one-time setup of 1,000 credits ($8 to $10) for each new ICP. Spona also offers free sample leads, so you can check the data before you pay.
• You want evidence with dates. Each technology detection carries a confidence and a last-seen field, rechecked every 30 days.

Where it does not:

• One website, one question. The free tiers of BuiltWith and Wappalyzer tell you faster what a single site runs.
• Full front-end coverage. BuiltWith tracks 127,836 web technologies. Spona does not publish a full technographic schema or product-level coverage, so a question such as "which SAP product?" needs a specialist or a discovery call.
• Purchase and churn dates for one vendor. Bloomberry dates adoption and churn from infrastructure changes.
• Hiring history. TheirStack keeps job data back to 2021 across 195 countries.
• Enterprise install and spend analysis. HG Insights sells this on contracts with a standard two-year term.

To test the fit, describe one technology segment in the free plan, check the sample leads against the six manual checks above, and scale only if the matches hold.

Get thousands of leads in 4 minutes.

Stop stitching tools together.
Start with verified sales data, delivered in minutes.

SCALE SALES NOW

No contracts · No setup · No onboarding

Technographic data FAQ

What is technographic data?

Technographic data is the record of the technology a company uses, from its CRM and ERP to the scripts on its website, with the evidence, date and confidence behind each entry. It is company-level data, inferred from public traces such as page source, DNS records and job posts or licensed from providers, and it needs a last-seen date to be worth acting on.

What does technographic mean?

The word blends "technology" and "demographics". Forrester Research sells consumer survey data under the Technographics name, which it says "provides broad and industry views of customer behaviors and adoption and use patterns". In B2B sales the term, sometimes written as business technographics, describes a company by the technology it uses, the way firmographic data describes it by size, industry and location. Technographics is the noun for the data itself.

What is the difference between firmographic and technographic data?

Firmographic data describes what a company is: industry, headcount, revenue, location. Technographic data describes what it runs: CRM, ERP, cloud and marketing tools. Firmographics tell you whether an account fits your market; technographics tell you whether your product fits its stack. Many target lists combine both, as in the technology, industry and headcount searches (12% of searches in Spona data).

Who are the top B2B technographic data providers?

For website technologies: BuiltWith, Wappalyzer and NerdyData. For backend tools and timing: Bloomberry (infrastructure signals) and TheirStack (job posts). For enterprise datasets with contact or intent data: ZoomInfo, HG Insights, 6sense and Demandbase. The comparison table above lists each method and the prices, and the six questions above show how to test a provider on your own accounts.

How much does technographic data cost?

Self-serve tools publish prices: TheirStack sells 1,000 company credits for $109 one-time, Bloomberry starts at $199 a month, NerdyData at $200, Wappalyzer at $250 and BuiltWith at $295. Enterprise datasets from ZoomInfo, HG Insights, 6sense and Demandbase are quoted per contract, and HG Insights' standard term runs two years. Spona charges per lead: $0.32 to $4 for qualified leads and $0.01 to $0.09 for bulk leads, plus 1,000 setup credits ($8 to $10) for each new ICP.

What are the main BuiltWith alternatives?

Wappalyzer works most like BuiltWith: website detection from $250 a month, with 50 free lookups a month. NerdyData searches raw source code, Bloomberry reads DNS and certificate data for backend tools, and TheirStack mines job posts.

Is BuiltWith free, and are there free BuiltWith alternatives?

BuiltWith is free for single-site lookups; lists, exports and alerts start at $295 a month on the Basic plan. Free options elsewhere: the Wappalyzer free account (50 lookups a month), the NerdyData free account (up to 100 rows per report) and TheirStack's free sign-up.

How reliable is BuiltWith's technographic data?

Reliable for what it measures: the technologies a website loads, updated weekly across 491.9 million domains. It cannot see software that leaves no trace on the website, and a tag can outlive the contract behind it. Confirm important accounts with a second signal such as an MX record, a job post or a case study.

Where can I get technographic data for free?

Run the six manual checks in this guide: page source, a browser extension, DNS lookups, job posts, partner and case-study pages, and certificate logs on crt.sh. Free single-site scanners such as CRFT Lookup do check 1 for you. The free tiers of BuiltWith, Wappalyzer, NerdyData and TheirStack cover small volumes.

Is technographic data covered by GDPR?

Company-level technology data is usually not personal data: the European Commission lists a company registration number and an address such as info@company.com as data that is not personal. It becomes personal data when it relates to an identified or identifiable person, such as the contact who manages the CRM; the same guidance lists name.surname@company.com as personal data. Record the source and your lawful basis for those contacts. For EU contacts, Spona's rule is: "Buying a B2B list does not grant permission to email it; establish a lawful basis for personal data processing, meet transparency and objection duties, and follow the recipient country's electronic marketing rules, including prior consent where required."