Firmographics tell you a company is a 400-person fintech in Berlin. Technographics tell you it runs HubSpot, Segment, Stripe and Cloudflare, and moved off Marketo eight months ago.
The second kind is more actionable, and considerably harder to get right.
Where the signals come from
Almost all of it is sitting in public HTML. The work is knowing what to look at and how much to trust it.
| Signal | What it reveals | Confidence |
|---|---|---|
| Script tags and CDN hosts | Analytics, chat, A/B testing, ad pixels | Very high |
| DNS records (MX, TXT, CNAME) | Email provider, SaaS verification, CDN | Very high |
| HTTP response headers | Server, framework, WAF, hosting | High |
| Cookie names | Session tooling, consent platform | High |
| JavaScript globals | Anything that registers on window | High |
| Job postings | Aspiration, or tools in one team | Low |
| Case studies and logos | That it was true once | Low |
The top of that table is near-conclusive. If a page loads js.hs-scripts.com, HubSpot is installed — there is no other reason for that request to exist. A DNS MX record pointing at Google is not an inference, it is a fact about where their mail goes.
The bottom of the table is where vendors quietly lose accuracy. A job ad asking for Salesforce experience might mean the company runs Salesforce, or that one manager wants to, or that the posting was copied from a template. Sold as "technographic data" it looks identical to the DNS record. It is not remotely the same quality of evidence.
What it is worth
Three uses justify the effort.
Compatibility filtering. If your product integrates with Shopify, a list of Shopify stores is worth more than a list of e-commerce companies. You are not guessing at fit, you are observing it.
Displacement timing. The valuable signal is not what a company uses, it is what it just changed. Someone who swapped analytics last month is in a buying posture; someone who has run the same stack for six years is not. That requires tracking over time, which is why one-off snapshots underdeliver.
Message specificity. "I noticed you're running Segment alongside GA4" opens differently to "I wanted to reach out about data infrastructure." The first proves you looked.
Why collection is harder than it sounds
Fetching one homepage is trivial. The problems arrive with scale and with time.
Signals move. Vendors rename scripts, move to first-party subdomains, get proxied behind a tag manager. A detection rule written last year silently stops matching, and nothing alerts you — your data just quietly becomes wrong.
One page is not the site. Marketing tools live on the homepage. Payment processors live on checkout. Support widgets live on the docs. Scanning only the root and concluding a company has no payment provider is a common and embarrassing error.
Repeat visits look like scraping. Tracking change over time means revisiting thousands of domains on a schedule. From one address that pattern is unmistakable, and you will start seeing challenge pages and stale cached responses rather than clean 200s.
That last point is the practical reason this work uses residential IPs rather than a datacenter range. Not for anonymity — for getting a representative response rather than a bot-detection page.
Reading it honestly
The failure mode is treating every row as equally true. A record saying "uses Salesforce" derived from a DNS record and one derived from a job ad are wildly different claims presented identically.
If you build this yourself, store the evidence alongside the conclusion — which signal, which URL, which date. If you buy it, ask the vendor what the underlying signal was. A vendor who cannot tell you is selling you inference dressed as observation, and you will find out which when a rep opens with a tool the prospect has never used.
Frequently asked questions
What is technographic data?
Data about the technology a company uses - CRM, analytics, payment processor, hosting, ad platforms. Firmographics tell you a company's size and industry; technographics tell you what is installed.
How is technographic data collected?
Mostly by fetching a company's public pages and reading the evidence: script tags, DNS records, HTTP headers, JavaScript globals and cookie names. Some vendors add job postings, which mention tools by name, and public case studies.
How accurate is it?
It varies enormously by signal. A script tag loading a vendor's CDN is close to conclusive. A job posting mentioning a tool proves someone wanted it once. Treat technographics as evidence with confidence levels, not as facts.