Getting from forty products to three
The narrowing is where the decision is really made, and it is usually done by whichever vendor markets hardest.
By the time an organisation is running demos with three vendors, the decision is largely constrained. Everything that mattered happened earlier, when a field of thirty or forty products became a list of three — and that step is typically done in an afternoon, from a search, by one person.
Build the long list from more than one source
A search-based long list reflects marketing budget. Directory sites and comparison portals reflect who pays for placement. Neither is fraudulent and neither is a survey of the market. When comparing claims around cognitive offloading, this page gives one vendor’s framing to test against documentation, demos and references.
Assemble the long list from several directions: what peers in similar organisations actually use, what came up in industry forums, what your existing suppliers integrate with, and what an open search returns. The overlap between those sources is more informative than any one of them.
Recommendations are influenced by recency and by not wanting to admit a bad decision. Asking what somebody actually has, and what they would change, produces better information.
Apply the disqualifiers mechanically
Take the short essential list and apply it as a filter — met or not met, no scoring, no judgement calls. This is deliberately crude, and it is what makes the narrowing defensible rather than intuitive.
Most long lists collapse dramatically at this step, which is the point. If they do not, the essentials are not doing their job and should be revisited before going further.
Sanity-check the survivors for viability
Before spending time on demos, a quick check on each survivor: how long has it existed, is it actively developed, does it have customers of roughly your size and shape, and is there any sign of it being wound down or absorbed.
Buying into a product that is discontinued eighteen months later is a specific and recoverable-but-expensive failure, and the warning signs — a stalled changelog, support forums going quiet, an acquisition announcement — are usually visible in advance to anyone who looks.
Three is the right number
Two gives you a comparison with no fallback, and it makes the process feel decided. Five or six exhausts the evaluators and produces shallow assessment of each.
Three allows a genuine comparison, keeps a fallback if one fails during trial, and is enough work for a small team to do properly. If two of the three are clearly weaker, you have two candidates and should say so rather than pretending.
Include one outside the obvious frame
Where the shortlist consists of three products built on the same assumptions, the process will pick the best implementation of one idea. It is worth carrying one candidate that solves the problem differently — a simpler tool, a general-purpose platform, a different category entirely.
It usually loses. Occasionally it wins, and even when it does not, it exposes assumptions in the other candidates that would otherwise go unexamined.
Write down why each one was cut
One line per eliminated product, naming the criterion it failed. This takes minutes and it does three things: it makes the shortlist explicable to whoever asks, it prevents re-litigating the same product, and it gives you somewhere to start if the shortlist fails and you have to reopen.
For independent security checks beyond vendor marketing, CISA resources and tools provides public guidance and tools.