Read the stack from what each company publishes, such as site code, job postings and integration pages, then keep the ones with a recent dated event.
Key takeaways
- BuiltWith passed 100,000 tracked web technologies in April 2024, according to its own blog. Third-party 2026 reviews put the count above 127,700 technologies.
- Zylo's 2026 SaaS Management Index reports that organisations hold 305 applications on average, which means most of a stack never shows on a website.
- A stack read in spring is out of date by autumn.
- In G2's 2026 Buyer Behavior Report, 84% of more than 1,000 B2B software buyers consolidated at least three tools into one platform in the past year.
- G2 announced in January 2026 that it would acquire Capterra, Software Advice and GetApp, forming a review marketplace with nearly 6 million verified reviews.
A list of companies that run a tool is an audience. It is not yet a campaign. The campaign needs a reason to write this month, and that reason is almost always a dated event next to the tool.
Where does a company publish the software it uses?
Companies reveal their tools in six public places. The website source shows front-end tags and widgets. Job postings name the tools a hire must use. Integration and customer pages list who runs what. DNS records show email and verification services. Reviews and ad libraries add the rest.
Technographic tools such as BuiltWith and Wappalyzer automate the first row at scale. BuiltWith said on its blog in April 2024 that it had passed 100,000 tracked technologies. Reviews published in 2026 by ZoomInfo and by Derrick both report more than 127,700 technologies, as of October 4, 2026.
That coverage is wide but shallow on one point. A crawler sees what runs in the browser. Zylo's 2026 SaaS Management Index counts 305 applications per organisation on average. Most of those are internal tools that no crawler will ever see, which is why job postings and integration pages matter as much as site code.
Which situation are you building the list for?
The right source depends on why you want users of the tool. Replacing a competitor, selling an add-on, selling services and timing a migration each need a different proof of the tool and a different event. Pick the situation first, because it decides which source to read and which event makes the email timely.
How do you find companies using a competitor you want to replace?
Start with the tools that leave a trace in the browser or in reviews. Read site code or a technographic export for the competitor's tag. Then filter on reviews: companies in your segment whose staff left low ratings for the incumbent are the warmest rows. The review gives the reason to write. The competitor's own customer page and case studies also name accounts that agreed to be shown.
Reviews work the other way. A reviewer's company name is often hidden, but industry, company size and role usually appear. Match those details to your segment and you know which kind of account is unhappy, even when you cannot name the account.
Consolidation is the opening to watch. In G2's 2026 Buyer Behavior Report, a survey of more than 1,000 B2B software buyers, 84% had folded at least three point tools into one platform in the past year. A displacement campaign that offers fewer tools speaks to that movement.
Our guide to the buying signals worth prioritising scores review waves and leadership changes on how long their window stays open.
How do you find companies for an integration or add-on?
Use the platform's own ecosystem. Marketplace listings, partner directories and integration pages show which companies build on or with the platform. For buyers rather than partners, combine site code with storefront checks. An app that only works on one store platform needs a list of stores running it.
A partner directory is a list of companies that already bought into the ecosystem and said so in public. Each one is a row with a reason attached.
Storefronts are the clearest case. The store platform, the payment widget and the review app all load in the browser. That makes commerce add-ons one of the few markets where site code alone can produce a usable list.
The dated event then decides the order. A store that just raised money, opened a new market or started advertising has a new budget line and new work. Write to those rows first.
How do you find clients for services around a platform?
Read job postings. A company advertising for an administrator, a developer or a consultant on a named platform is telling you it runs that platform and lacks the hands to run it well. For an agency, an implementer or a support partner, that posting is the strongest public proof available.
Look at the body of the posting, not the title. The title says "Operations Manager". The requirements say "three years of experience with the platform, including a migration". That second line is your list criterion.
The posting also gives the timing. While the role is open, the company is trying to solve the problem with headcount. A services offer that covers the gap until the hire lands, or replaces the hire, is relevant this week.
How do you time a switch around a migration or renewal?
Watch for change, not state. A tool that appears or disappears in site code, a posting that mentions "migrating to" or "replacing", and a new head of the function are the public traces of a decision being made. A renewal date is rarely published, so these traces are the closest proxy you can see.
A stack read once and stored goes stale fast. Read it again before the send and compare it with the last reading.
DNS records help for one category. The MX record shows the email provider. Sender records and verification entries often name the marketing, help desk or signature tools that send mail for the domain. A change in those entries is a dated sign that a switch happened.
How do you pair the tool with a dated event, like a second location?
Build two lists and keep the overlap. The first holds companies that run the tool. The second holds companies with a recent event, such as a new location, a funding round or a hiring wave. Rows in both lists have an audience and a reason, which is what a displacement campaign needs.
- Pick your situation
- Find proof of the tool
- Add a dated event
- Keep the overlap
- Verify the contacts
- Write from the event
A second location is a good example. Maps listings, store finders and local job postings show a new site within days. A company that runs the tool and just opened a second location now runs it in two places, with new staff to train and a reason to revisit the setup.
Record the date of each event in its own column. Our guide to building a list from a description explains why attributes and dated evidence should stay in separate columns.
Before a call, our guide on how to research an account before a sales call covers what to check.
How accurate is technographic data?
It is accurate about what loads in the browser and weak about everything else. Detection reads tags, scripts and DNS, so it misses back-office tools and can lag behind removals. A tag left on a page after a cancellation still reads as a customer. Confirm with a second source before you write.
Two checks catch most errors. First, look for the tool in a second source type, such as a job posting or an integration page. Second, check the date of the detection. A tag seen last week is evidence. A tag seen a year ago is a hypothesis.
Reviews need the same care. G2 announced in January 2026 that it would acquire Capterra, Software Advice and GetApp, which gives the combined marketplace nearly 6 million verified reviews. Each review is still one person's view on one date.
Ad libraries are reliable on one point. Meta's Ad Library shows ads currently running across its apps. A running ad is proof of activity today.
Where Freelvy fits
Freelvy is our product, an AI sales platform used the way you use ChatGPT or Claude. You describe the customer you want in one prompt, including the tool and the event. Freelvy searches 40+ live sources at query time (maps, official company registries, job boards, storefronts, ad libraries) instead of filtering a stored database.
Each row is then enriched with verified contacts through provider waterfalls, 18 for email and 12 for phone. The waterfalls find and verify more than 92% of emails and find more than 90% of phone numbers. A row that fails verification is never delivered and never billed. Search, enrichment and sequencing sit in one thread, and the sequencer sends from your own Google or Microsoft mailbox.
For marketing and ABM teams building a switch campaign, that keeps the tool, the event and the message on the same row. Buying signals cover hiring, funding, reviews and ads, and a brief can run on a schedule. Plans start at €49 a month for 1,500 credits, with unlimited team members and no lock-in. Free 7-day trial, no credit card, at freelvy.com.
How we verified this
We read the pages listed under Sources on October 4, 2026. The BuiltWith blog post is dated April 19, 2024. The situation table and the method are our own work.
FAQ
How do I find out what software a company uses?
Check six public places. The website source shows front-end tags and widgets. Job postings name required tools. Integration, partner and customer pages list users of a platform. DNS records show email and sending services. Reviews and ad libraries add context. Confirm each finding in a second source type before you rely on it.
Can I find companies using a competitor's software?
Yes, for any tool that leaves a public trace. Browser tools show in site code and technographic exports. Back-office tools show in job postings that name them. The competitor's own customer page lists some accounts. Reviews show which segments are unhappy, even when the reviewer's company is hidden.
Is technographic data reliable?
It is reliable for what runs in the browser and weak for internal tools. Zylo's 2026 index counts 305 applications per organisation on average, and most never touch a website. Tags can also linger after a cancellation. Check the detection date and look for a second source before writing.
How do I find companies using a tool that also opened a second location?
Build two lists. One holds companies that run the tool. The other holds companies with a new location, found on maps listings, store finders or local job postings. Keep the overlap, record the date of the opening, and write about running the tool across two sites.
What makes a good reason to write to a competitor's customer?
A dated event that changes their situation. A run of low reviews of the incumbent, a new leader in the function, a migration posting or a new location all qualify. The tool alone tells you who could switch. The event tells you why this month is different from last month.
How often should a technology list be refreshed?
Before every send. Stacks move fast. Re-read the stack on the morning of the campaign, compare it with the last reading, and treat any addition or removal as a fresh event.
Sources and methodology
All pages below were read on October 4, 2026. Figures are attributed in the text to the pages that published them. The situation table and the method are our own.
- blog.builtwith.com, 100,000 technologies tracked
- pipeline.zoominfo.com, BuiltWith review
- derrick-app.com, BuiltWith review
- zylo.com, 2026 SaaS Management Index
- company.g2.com, buyer behavior 2026
- sell.g2.com, 2026 buyer behavior report
- demandgenreport.com, G2 to acquire Gartner's Capterra, Software Advice and GetApp
- transparency.meta.com, Ad Library tools