Shortlist on evidence, not on brand
10 min
A shortlist is a claim that these three products could plausibly solve your written problem. It is not a list of the vendors you have heard of.
Start where the evidence is
Filter reviews to organisations near your size and in your industry. A platform that is a delight at 5,000 seats with a dedicated team can be unusable at 200 seats with one engineer, and the review that says so is worth more than any quadrant.
Read the cons first. Everyone writes an even-handed summary and then tells the truth in the drawbacks.
Ask the question only peers can answer
"What did you replace, and why?" is the most useful question in security procurement. It surfaces the failure mode that made someone spend money to leave — which is the failure mode you are about to buy into if you are not careful.
Same questions, same data, everyone
Cut to three. Send each vendor the same written questions and the same description of your environment. Refuse the discovery call that precedes the demo: you have done the discovery, it is on your one page, and the call exists to reshape your requirements around their strengths.
Three is not a magic number. It is the largest number of proofs of concept a normal team can run properly. Four vendors means four shallow evaluations, and shallow evaluations are decided on charisma.