Salesforce and EPAM Systems both run enterprise B2B websites. Both have a solutions page, a "request a demo" button, customer logos, and a pricing conversation that starts with a sales call. If you're inferring a business model from what a website looks like, they read the same.
Their SEC filings aren't the same, though. Salesforce is registered under SIC code 7372: Services-Prepackaged Software. EPAM is registered under 7371: Services-Computer Programming Services. Salesforce sells a product you license and EPAM sells engineering hours to build your spec.
This distinction has been publicly checkable on EDGAR for years, and it has nothing to do with either company's marketing. You can use this method for classifying companies by the codes they use to file with the government, rather than what their website is trying to sell you.
The weak signals most tools already lean on
Most enrichment and prospecting tools infer "product vs. service" (when they infer it at all) from a small set of website artifacts: does the company have a pricing page, does it have a "book a demo" flow, what does its careers page talk about. Some use a company's LinkedIn industry label.
Each of these signals is weaker than it looks.
A pricing page is a conversion-funnel, not a business-model fact. Plenty of services firms productize part of their offering and put a price on it without becoming product companies. A "book a demo" CTA tells you the sales motion is high-touch; it doesn't tell you whether what's being demoed is software or a project you're commissioning.
LinkedIn's industry field is chosen by whoever administers the company page, and it's more of a marketing decision made once and rarely revisited. It can also drift a long way from reality: Amazon's LinkedIn page lists its industry as "Software Development." Its SEC filing says otherwise (more on that below).
LinkedIn's own documentation is explicit that its ~400-industry taxonomy doesn't map cleanly onto NAICS, because it isn't trying to. That's because it's a marketing taxonomy, not a classification system.
And when providers try to infer industry from website text , published approaches top out around 84–93% accuracy across roughly a dozen coarse categories. On the other hand, six-digit NAICS distinguishes over a thousand.
Nobody fully trusts any single one of these signals, and it shows in how GTM teams actually work. They stack five or more enrichment providers and reconcile the disagreements, because no one inferred field is reliable enough to take at face value. A website tells you how a company wants to be sold to. A filing code tells you where its money actually comes from.
What SIC and NAICS actually are
SIC, the Standard Industrial Classification, is a 4-digit US government taxonomy dating to 1937. It was last revised in 1987 and has been frozen ever since, but it hasn't been retired. SEC EDGAR still requires a SIC code on every company's filings, and the SEC uses it operationally to route filings to the right review office.
NAICS, the North American Industry Classification System, replaced SIC as the primary standard in 1997. It's a 6-digit hierarchical taxonomy (2-digit sector → 3-digit subsector → down to a 6-digit national industry), maintained jointly by the US, Canada, and Mexico under the Office of Management and Budget, and revised on a five-year cycle: 2002, 2007, 2012, 2017, 2022. The next revision is already in motion; OMB published proposed 2027 updates in the Federal Register this month.
What's interesting about these codes is that nobody assigns them. The Census Bureau is explicit about this. There's no central government agency with the role of assigning, monitoring, or approving NAICS codes. A company selects its own code, based on a simple rule: the activity that generates the largest share of its revenue.
That same rule is what connects NAICS to how companies file. When a US company files its federal tax return, it reports a six-digit principal business activity code, built directly on NAICS, for whichever activity accounts for the largest share of its receipts. The IRS doesn't assign this code, and it doesn't audit it as a matter of course. The company reports it the same way it reports everything else on the return.
This "self-reported fact" isn't verified by a regulator line by line. It's reported under a real filing obligation, alongside numbers the company has every incentive to get right for other reasons, which is meaningfully different than a marketing team picking a LinkedIn category once and never touching it again. The code isn't bulletproof, but it is answering to a different, higher-stakes audience than a website is.
Reading product, service, or hybrid straight off the code
You don't need the full 6-digit code to get most of the signal. The first two digits, the NAICS sector, already separate "makes or moves things" from "bills for time":
31–33 Manufacturing, 42 Wholesale Trade, 44–45 Retail Trade: companies built around a physical or licensed product.
51 Information: companies that publish or license something (this is where product software lives).
54 Professional, Scientific, and Technical Services, 56 Administrative and Support Services: companies that sell people's time against a client's specific need.
The clearest example is software, because it splits cleanly across exactly this line. NAICS 513210, Software Publishers, covers companies that design and license software as a product. NAICS 541511, Custom Computer Programming Services, covers companies that write software to a particular customer's specification, and the NAICS manual itself is explicit that a company doing product design, development, and publishing belongs in 513210, not 541511. It's the same split under the older SIC system: 7372 for product software, 7371 for custom programming, the exact codes behind Salesforce and EPAM in the opening example.
Hybrid businesses also show up in the same data, if you know where to look. A company with both a product/publishing code and a services code (a secondary NAICS code alongside its primary, or a secondary SIC code representing a meaningful share of revenue) is declaring, not implying, that it runs both revenue streams. This declaration helps eliminate guessing "probably a mix of both" from a website that tries to look like everything at once.
Now we can look at how classification actually gets done at scale. In a recent exercise classifying several thousand companies by whether their field-service work was performed on assets they own versus assets owned by external customers, the overwhelming majority of confidently-reasoned verdicts anchored on the company's registered SIC or NAICS code as the deciding evidence, not on website copy.
One telling example is a scrap-metal and recycling company's LinkedIn page that listed its industry as "Utilities." Its SIC code, 5093 (wholesale scrap and waste), was the one that actually matched what the company does. The label written by a marketing team was wrong. The code filed under a legal obligation was right.
The GTM payoff here is real. Services companies buy seat-based and utilization tooling. Product companies buy infrastructure and usage-metered tooling. Hybrids need messaging that doesn't force a false choice.
Segmenting your TAM on sector code beats segmenting on "has a pricing page" because it's structured, standardized, and doesn't drift every time someone rewrites website copy.
Where the codes fall short
None of this works if you treat the codes as infallible, so here's where they aren't.
They're self-selected and never independently audited. A company can (and in regulated or government-contracting contexts, sometimes does) choose a code strategically rather than descriptively.
A company gets one primary code per establishment, which can flatten a genuinely hybrid business into a single label. Secondary codes exist as a partial fix, but they're not always populated or surfaced.
Codes go stale. Nothing forces an update when a company's business changes. Amazon is still SIC-registered as a catalog and mail-order retailer, a category built for 1980s mail order, while running one of the largest cloud infrastructure businesses in the world. The retail code hasn't caught up, and neither classification captures AWS at all.
They're a North American system. The rest of the world uses ISIC, NACE, or country-specific variants like UK SIC 2007, and there's no official, direct crosswalk between NAICS and those systems, only indirect mappings through ISIC. Any classification built on NAICS alone needs to be scoped to US-filing entities, or paired with the equivalent registry elsewhere.
And they're coarse for modern digital business. A vertical SaaS company, a dev-tools company, and a mobile game studio can all land in the same 6-digit code. SIC is worse, frozen in 1987 before most of the software industry existed in its current form.
In other words, these codes fail legibly. You can see the legacy of a stale code and the limits of a coarse one. A website signal, on the other hand, is harder to know when it fails. You just can't tell, from the outside, whether "has a pricing page" was ever a good proxy for this particular company. So use the filing code as your anchor, and layer behavioral or website signals on top for resolution, not the other way around.
Where this fits into what Enrich Layer classifies today
Today, Enrich Layer's v2 API classifies companies using LinkedIn's industry taxonomy, the same marketing-chosen label this piece has been arguing against as a standalone signal. It does not return SIC or NAICS codes.
That's changing. NAICS classification is designed into the schema for our upcoming v3 company API. Each industry entry carries a NAICS field, and a canonical industry object is built to hold NAICS alongside the LinkedIn label on the same record, so you can see both views and where they agree or disagree.
The more useful way to think about it is that every company has a marketing-based positioning and a real-world, filing-based positioning, and those two views frequently disagree in informative ways. LinkedIn labels and websites are marketing-based. NAICS is a standardized, structured version of something closer to real-world, filing-based. Pairing the two, on one record, is more useful than either alone.
For a single account you need to verify by hand — before a proposal, before you commit budget to an ICP bet — the underlying code registries are public and free to check yourself. SIC codes on SEC EDGAR for any company that files with the SEC, and NAICS codes on SAM.gov for any company registered to do business with the federal government.
The takeaway
A pricing page is a sales asset. It's designed, tested, and changed on a schedule that may have little to do with what the company actually does. A filing code is a declaration the company made under an obligation to a government agency, using a rule that ties directly to where its revenue comes from.
When you're trying to tell a product company from a service company from a hybrid, check the codes.
