Workday’s SEC filing (S-3ASR, fiscal 2026) reports more than 11,500 customers. Wappalyzer, a popular detection extension, tracks about 2,500 live websites running Workday. The two numbers measure different things, but the distance between them shows how much of the installed base never appears on a public page.
That gap is the problem this guide is built around. Whether you run marketing, sales operations, an SDR team or data analysis, or you sell to HR as a software vendor, you need to know which HR platform an account runs, and you rarely get told. Knowing it lets you:
Below you will find what each platform actually is, the footprints each one leaves, four ways to identify the accounts that use them (from free manual checks to technographic data), what to do with the answer, and the pitfalls that make a recorded answer wrong.
Each vendor leaves a different mark. The table shows the quickest tells.
| Platform | Careers-site address | Ecosystem hint |
|---|---|---|
| Workday | {company}.wd{N}.myworkdayjobs.com | Roles that ask for Workday skills, and Workday consultants on LinkedIn |
| SAP SuccessFactors | career{N}.successfactors.eu or career{N}.sapsf.eu, or a company subdomain with postings at /job/{slug}/{id} | SAP ERP in the same stack, such as S/4HANA or Ariba |
| Oracle | {client}.taleo.net/careersection/{code}/jobsearch.ftl, or {tenant}.fa.{datacenter}.oraclecloud.com/hcmUI/CandidateExperience | Oracle ERP or financials in the same stack, PeopleSoft or JD Edwards |
Ecosystem hints are weaker than addresses. A company that runs SAP ERP is a likelier SuccessFactors customer, but plenty of SAP ERP shops run another HR system, so treat a hint as a reason to look closer. Span’s SAP ERP users list is one way to find those accounts.
| Platform | Example address | What it tells you |
|---|---|---|
| Workday | nvidia.wd5.myworkdayjobs.com | A Workday recruiting site. This proves Workday for recruiting only. Ask about core HR, payroll and workforce management next. |
| SAP SuccessFactors | career5.successfactors.eu | A SuccessFactors recruiting site on a SAP data-center host. It proves the Recruiting module, which does not confirm Employee Central. |
| Oracle Taleo | uhg.taleo.net | A Taleo career section. Many Taleo customers have since moved, so check whether the account now runs Oracle Recruiting Cloud. |
| Oracle Recruiting Cloud | {tenant}.fa.{datacenter}.oraclecloud.com | A Fusion pod address points to Oracle Recruiting, which is part of Fusion Cloud HCM. Some customers hide it behind a custom careers domain. |
| No Vendor Address | careers.company.com | A custom careers domain may hide the vendor. Try LinkedIn mining, public records or technographic data. |
The four methods run from free and manual to paid and automated. The table compares them, and each one is covered below.
| Method | Effort | Best at | Main gap |
|---|---|---|---|
| 1. Source code and extensions | Free, technical | Quick checks of one account | Sees only what a public page loads |
| 2. LinkedIn mining | Semi-automated | Finding the people who run the system | Profiles can describe a past employer |
| 3. RFPs and case studies | Free, slow | Public sector and announced deployments | Private companies rarely publish |
| 4. Technographic data | Paid, automated | A whole account list filtered by platform | Depends on the provider’s sources and refresh cycle |
Browser tools read the footprints in the table above directly. Press F12 on a careers or login page, open the Network tab and look for requests to vendor domains such as myworkdayjobs.com, successfactors.eu or taleo.net. Extensions such as Wappalyzer run this check automatically on every page you visit.
Look at what these tools report and the limit shows. Wappalyzer’s list of sites using Workday is dominated by wd1.myworkdayjobs.com and myworkday.com hostnames, so the tool is mostly rediscovering careers-site addresses. Its blind spot is the public page: it sees only what a public page loads, and employee portals behind a login stay hidden. Use it to settle one account quickly, and expect it to struggle with a 3,000-account territory.
People who run a system tend to say so on their profiles. Sales Navigator accepts boolean keyword searches: LinkedIn recognizes AND, OR and NOT in capitals, quotation marks for exact phrases and parentheses for grouping. A string such as “Workday HCM” AND “HR Director” surfaces HR leaders who mention the platform, and (“Workday” OR “SuccessFactors” OR “Oracle HCM”) AND “implementation” widens the net to the people who deployed it.
Look for roles that exist only where the system does, such as Workday analysts, SuccessFactors consultants and HRIS architects. Watching how many of those roles a company hires over several quarters tells you whether it is expanding a platform or winding one down. Two cautions apply. A profile can describe a previous employer, so look for more than one current employee before you record a platform, and a consultant listed at a company may work for an implementation partner and not the customer.
Vendors publish customer stories, and Workday and SAP both keep case-study pages that name the companies they feature. Public sector buyers often publish the decision itself. North Carolina’s Office of State Human Resources reported that it selected and contracted with Workday on December 13, 2024, with Deloitte as the implementation partner, and that HCM went live on October 8, 2025. Delaware’s ERP implementation RFP, made available to vendors on February 9, 2026, states that Workday has been selected as the primary solution for payroll, HCM, financial management and budgeting.
These documents give you more than a platform name. They name the implementation partner and the go-live date, which tells you when an account is likely to buy adjacent tools. They cover only governments and announced deployments, though, and most private companies never publish their HR system.
The first three methods work account by account. Technographic data answers the question for a whole list at once. Landbase’s 2026 detection counts find 5,622 sites on Workday HCM and 3,288 on Oracle HCM Cloud, against more than 11,500 Workday customers in the SEC filing. Technology Checker estimated on April 8, 2026 that domain-level detection captures roughly 20% of the Workday install base. Part of that gap likely reflects systems that sit behind logins, which is where a provider that combines several sources earns its place.
Technographic data records which software a company runs, so you can filter a list by platform instead of opening careers pages one at a time. Span Global Services publishes install lists for Workday, SAP SuccessFactors and PeopleSoft, the closest Oracle HR list, plus a wider HR software users list. The SuccessFactors list, for example, carries fields for deployment environment, HRIS or ERP integration and payroll processing. If your CRM already holds the accounts, tech installs append adds install data to those records. Our guides on using technographics in B2B sales and marketing and companies that use SAP solutions go deeper.
Provider data is only as good as its sources and refresh cycle, so spot-check your top accounts with Method 1 before a campaign goes out.
