Orbital tech stack agent
Salesforce users email list, rebuilt on every run by the Orbital tech stack agent.
A detection agent crawls a company website, runs signature and pattern detection across many tech categories, and returns a structured profile per account. Live, with the matched pattern recorded inside the profile.
Stored index vs on-demand detection. Orbital maps 13,549,104 US SMBs at the company grain; the agent runs Salesforce detection on demand across any subset you bring, and ships the decision-maker contact alongside the tech profile.
What the agent ships
A list, with a structured tech profile per company.
Three things sit behind every Salesforce CRM detection. The universe Orbital maps. The verticals already fully built inside it. The shape of the signature library the agent runs against each crawl.
US small businesses Orbital maps
Mapped at the company grain, enriched with Google Maps and LinkedIn signals; contacts attached via the email waterfall and owner finder agents. The universe the agent runs Salesforce detection across on demand. See the B2B contact database page for the underlying graph.
Source: Orbital company graph, April 2026.
companies across 5 fully mapped verticals
A subset of the 13,549,104 total, broken out at dental, HVAC, med spa, restaurant, and roofing. The agent runs Salesforce detection on top of each vertical slice when asked.
Source: aggregate of five live /data vertical pages.
categories in the signature library
The signature library covers multiple categories including CMS, analytics, payments, POS, field service, marketing automation, and others. The Salesforce signature set sits across the marketing automation and CRM-widget surfaces. The agent returns the matched pattern within the structured profile.
Source: Orbital tech stack agent, category taxonomy v2026-04.
The honest comparison
Agent vs BuiltWith on Salesforce CRM detection.
Pulling a quarterly tech-stack catalog for analytics? BuiltWith. Running detection on tomorrow's outbound list? The agent. Eight rows below, three of them go to BuiltWith. The catalog-breadth, install-history, and procurement-comfort questions are theirs to win. The freshness, SMB long-tail, and contact-attach rows are ours. Here is when to use which.
| Dimension | Orbital tech stack agent | BuiltWith | Better fit |
|---|---|---|---|
| Product shape | On-demand detection. The pipeline crawls a company's site and runs signature and pattern detection live for every request. | Stored index. A catalog refreshed on a fixed cadence, queried by company URL for the cached tech tags. | Different jobs |
| Detection freshness | Runs per account on demand. A result from this morning is a result from this morning. | Crawled on a recurring schedule. Lag between an install or churn event and the database update. | Orbital |
| Category coverage | Signature library covers CMS, analytics, payments, POS, field service, e-commerce, marketing automation, and adjacent SMB-software categories. | Tens of thousands of technology categories tracked across many years. The widest catalog in the category. | BuiltWith |
| SMB long-tail coverage | Orbital maps 13,549,104 US SMBs at the company grain, so any account list within that universe is fair game. The 5-to-50-person Salesforce shops are the part of the output we built for. | Coverage skews toward companies with a public web footprint. Tiny owner-run SMBs with thin sites are the rows that thin out. | Orbital |
| Decision-maker contact attached | Yes, via the email waterfall and owner finder agents that run on each detected company, not the tech stack agent itself. | Technographic detection only. Contact data is a separate bolt-on or a different vendor entirely. | Orbital |
| Structured tech profile per detection | The agent returns a structured profile dict (categories mapped to detected tools), with the matched pattern recorded inside the profile. | Reports the tech category and a confidence band. Underlying matching surface is not the default view. | Orbital |
| Historical install history | On-demand re-runs only. The agent does not keep a multi-year install-history corpus. | Years of crawl history. "When did this company first install Salesforce" is a question they answer well. | BuiltWith |
| Single-platform IT procurement comfort | Newer vendor. Procurement at large enterprises will ask for a security review and references. | Known line item in many enterprise IT toolchains. Already approved at many large companies. | BuiltWith |
Source: Orbital tech stack agent, April 2026. BuiltWith descriptions summarised from BuiltWith's public product documentation as of 2026-04. We are not paid to compare against them and they are not paid to compare against us.
When to pick each
Two clean tests. Run them before you buy anything.
Pick the Orbital tech stack agent if
- You need a fresh "is this account on Salesforce today" answer per company, not a tag from a quarterly index.
- Your ICP includes the 5-to-50-person SMB layer where stored technographic indices thin out.
- You want the matched pattern recorded inside the structured profile, so a rep can read what the agent saw before they send.
- You sell something Salesforce-adjacent (an integration, an enrichment layer, a managed services play) and the decision-maker contact matters as much as the tech match.
Pick BuiltWith if
- You need a single technographic platform that covers tens of thousands of technologies across one query, not a focused per-account crawl.
- "When did this company first install Salesforce" is the question you are answering, and you need a multi-year install-history corpus.
- Your procurement team has already approved BuiltWith and switching vendors carries a higher cost than the marginal detection lift.
- Your ICP is enterprise IT buyers and the contact-data attach is something you already solve through ZoomInfo or your own enrichment stack.
How the agent runs
Crawl, match, profile. The pipeline in plain terms.
The agent takes a company URL and name. It crawls the site within configurable bounds (crawl limit, crawl depth, excluded paths), runs the signature library across multiple categories including CMS, analytics, payments, POS, field service, marketing automation, and others, and returns a structured technology profile of what the company appears to run. An optional online research stage extends the lookup when the first crawl is inconclusive.
Inputs
Required: company URL and company name. Optional: a categories list (CMS, analytics, payments, POS, field service, and others), a techs list, and a flag to opt into the online research stage when first-crawl signal is thin.
Bounded crawl
The agent crawls the company's own website. Crawl limit, depth, and excluded paths are all configurable, so you control how deep the agent goes before it tries to match.
Signature and pattern detection
The crawl output runs through the signature library. For Salesforce, that means matching patterns that appear in the crawled HTML and JavaScript: script tags from Salesforce-owned hosts, embedded Web-to-Lead and Pardot form patterns, Lightning component fingerprints on customer portals, and other public-facing widget signatures.
Optional online research
If the first crawl does not match cleanly, an opt-in online research stage can be enabled. It is opt-in because it is heavier than the default crawl, so we leave it off by default and let the buyer decide.
Output
The agent returns a structured profile dict (categories mapped to detected tools, with the matched pattern recorded inside the profile) plus any errors. That is the surface every downstream system reads from.
Contact attach
Firmographics and the decision-maker contact are not part of the tech stack agent's own output. They get attached downstream by Orbital's email waterfall and owner finder agents, which run on each detected company before the row reaches the export.
Source: Orbital tech stack agent, category taxonomy v2026-04. Combined with the email waterfall and owner finder agents to attach the decision-maker contact alongside the detected tech profile.
Use cases
Six things B2B vendors do with Salesforce CRM detection.
If your motion sells into or around Salesforce CRM accounts, the agent's output plugs into the work directly. Six patterns we see most often.
ICP targeting
Pre-qualify outbound by tech match
Filter the SMB universe to companies the agent flagged as live on Salesforce CRM, then route to the AEs whose product only lands on Salesforce-running accounts.
Integration partner research
Find AppExchange-ready accounts
If you sell a Salesforce-native integration, the agent's output is the addressable market for your AppExchange listing, sized at the company grain with the buyer attached.
Competitive displacement
Map Salesforce vs HubSpot footprints
Run the agent for both products in the same query. The delta is the displacement list: companies on the other tool that fit your replacement-platform pitch.
Churn-risk modelling
Spot Salesforce deprecation signals
Re-run the agent monthly on your customer list. Accounts where Salesforce signatures stop matching across crawls are early indicators of platform churn worth a save call.
Services and consulting
Find admins to talk to
For Salesforce consultancies, MSPs, and managed-services teams, the agent ships the company plus the admin or RevOps lead contact, ready to email about a Salesforce-specific engagement.
Investment research
Size Salesforce ecosystem segments
For VC and PE diligence on Salesforce-adjacent companies, the agent quantifies addressable account count plus reachable contact count for any vertical slice.
The argument in three paragraphs
A scraped list goes stale before you finish loading it.
The standard playbook for a "salesforce users email list" is to buy a quarterly tech-stack scrape from a broker, dedupe it against the CRM, and start sending. The list was already three months old on the day it arrived. The accounts that churned off Salesforce in week six are still on it. The new SMB deployments that signed up in week ten are not. The reps email the wrong half of the file and the campaign data tells you the cohort is bad, when really the cohort is just expired.
The Orbital tech stack agent is built around the opposite default. It runs per account, on demand, across any subset of the 13,549,104 US small businesses Orbital maps at the company grain. When a buyer asks for the SMB slice that is live on Salesforce CRM today, the agent crawls each company's site, runs the signature library across multiple categories including CMS, analytics, payments, POS, field service, marketing automation, and others, and returns a structured profile per company with the matched pattern recorded inside. Firmographics and the decision-maker contact get attached downstream by the email waterfall and owner finder agents. A result from this morning is a result from this morning, not a result from last quarter.
The honest trade-off: BuiltWith has a wider technology catalog and a longer install-history corpus. If the question is "show me every technology any of these 50,000 companies has ever installed since 2018", that is the stored-index job, buy BuiltWith. If the question is "which of these SMBs on my outbound list has a Salesforce signature on the site today, and who do I call there", that is the on-demand-detection job, run the agent. We tell people which job the agent fits. We do not pretend it fits every job.
Questions
Before you run the agent on your account list.
What is the Orbital tech stack agent?
An on-demand detection agent that takes a company URL and name, crawls the site within configurable bounds, runs signature and pattern detection across multiple categories including CMS, analytics, payments, POS, field service, e-commerce, marketing automation, and others, and returns a structured technology profile. An optional online research stage kicks in when the first crawl is inconclusive. For Salesforce CRM, the agent looks for patterns that appear in the crawled HTML and JavaScript and records the matched pattern inside the profile. Firmographics and a decision-maker contact are attached downstream by Orbital's email waterfall and owner finder agents. The agent re-runs on demand, so a result from yesterday is not a result from last quarter.
How does the agent compare to BuiltWith for Salesforce CRM detection?
Different jobs. BuiltWith is a stored index, a catalog refreshed on a fixed cadence that you query for a company's tech tags. The Orbital tech stack agent is on-demand detection, you point it at a list of accounts and the pipeline runs the crawl plus signature pass live, returning a structured profile per company with the matched pattern recorded inside. The two work well together: BuiltWith for historic and catalog-breadth queries, the Orbital agent for fresh and pattern-targeted detection on a specific account list. For Salesforce specifically, the decision-maker contact is also attached downstream via the email waterfall and owner finder agents, which BuiltWith does not offer.
Does the agent find Salesforce on small businesses, or only enterprise?
Both. Salesforce spans Sales Cloud Essentials at the 5-person team end through Marketing Cloud at 10,000-employee enterprises. BuiltWith and HG Insights bias toward the public-facing enterprise footprint. Orbital maps 13,549,104 US SMBs at the company grain, and the agent runs detection on demand across whichever slice you bring, including the long-tail 5-to-50-person Salesforce shops. Enterprise detection works too: the agent runs the same crawl plus signature pass at any company size.
Where does BuiltWith win, honestly?
Three places. First, breadth of tech catalog: BuiltWith tracks tens of thousands of technology categories, and the Orbital tech stack agent is purpose-built for the categories our customers ask for most often. Second, historical depth: BuiltWith has a deep installation-history corpus from years of crawls, so 'when did this company install Salesforce' is a question they can answer better than we can. Third, single-tool enterprise IT buyer comfort: a procurement team buying one technographic platform across many tech categories is the BuiltWith ICP. We are the better pick when Salesforce CRM detection plus reachable SMB contact is the specific job.
What does the agent actually look at to detect Salesforce?
The agent crawls the company's website within configurable bounds (crawl limit, depth, excluded paths) and runs a signature library against the pages it pulls back. The Salesforce part of that library matches on artefacts that show up in the crawled HTML and JavaScript: script tags loaded from Salesforce-owned hosts, embedded Web-to-Lead and Pardot form patterns, Lightning component fingerprints on customer portals, and other public-facing widget signatures across the broader Salesforce surface. If the first crawl is inconclusive, an optional online research stage can extend the lookup. The output is a structured profile dict with the matched pattern recorded inside, plus any errors.
Can I import the output into Salesforce or HubSpot?
Yes. CSV export for direct upload, and a HubSpot direct push if your workflow goes through HubSpot first. There is no native Salesforce AppExchange app yet, so push-button enrichment inside a Salesforce list view is not in the surface today. If that workflow is load-bearing for your team, that is a real switching cost worth naming up front.
How accurate is the Salesforce detection?
Higher than a stored scrape, lower than a self-reported survey. The agent records the matched pattern inside the structured profile (the script tag, the form pattern, the widget fingerprint), so a buyer can read what the agent saw before sending an email. False positives come from two places: shared assets that any Salesforce visitor loads (the agent filters most of these with multi-signature confirmation), and one-time Salesforce trials that the company has since churned off (we re-run on demand to keep this tail small). We do not publish a single accuracy number because it varies per signature and per crawl bound, and any vendor quoting one is rounding.
Can I get a free sample before deciding?
Yes. Tell us the SMB vertical or metro you sell into and the kind of buyer you target inside Salesforce-running accounts (RevOps lead, founder, head of sales). We run the agent against a slice of the universe and send a sample of around 100 records so you can check the detection quality and the contact reach against your own data.
Methodology. Source: Orbital tech stack agent, April 2026. Orbital maps 13,549,104 US SMBs at the company grain, enriched with Google Maps signals and LinkedIn profiles; contacts are attached via the email waterfall and owner finder agents. The tech stack agent runs on demand across any subset of that universe. Inputs are the company URL and name, with optional categories list, techs list, online-research opt-in, and crawl bounds (limit, depth, excluded paths). The agent crawls the company's website and runs signature and pattern detection across multiple categories including CMS, analytics, payments, POS, field service, marketing automation, and others, returning a structured technology profile with the matched pattern recorded inside. Firmographics and the decision-maker contact are attached downstream by Orbital's email waterfall and owner finder agents, not by the tech stack agent itself. BuiltWith descriptions are summarised from BuiltWith's public product documentation as of 2026-04. We are not paid to compare against them and they are not paid to compare against us.
Run the agent on your account list.
Tell us the SMB vertical or metro you sell into and the role you target inside a Salesforce-running account. We run the Orbital tech stack agent against a slice of the universe and send a sample of around 100 records you can verify against your own data.
Get a free sample