Skip to content
CAASM FinderCAASM Finder

FIVE APPROACHES

Asset inventory approaches: CAASM, agents, EASM, CMDB and exposure management

SHORT ANSWER

There are five common ways to build an asset inventory: connect the tools you already run and merge their records (CAASM aggregation), collect again with your own agents or scans (agent-based inventory), look from the internet inward (EASM), make the CMDB the system of record (CMDB-centred), or start from exposures and work back to assets (exposure management). Most estates need two of them working together. The useful question is which one your estate needs first.

By The Inventory Desk · CAASM Finder · Published 2026-10-11

Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.

What does each approach do?

  • CAASM

    CAASM aggregation

    Connects to the security and IT tools you already run through API connectors and merges what they report into one record per asset.

    Described by 4 of 10 vendors, with a condition for 3

    Read the CAASM guide
  • AGENT

    Agent-based inventory

    Collects inventory itself, through an agent on each device or its own network scanning, instead of reading other tools.

    Described by 2 of 10 vendors, with a condition for 2

    Read the AGENT guide
  • EASM

    External attack surface management

    Looks at your organisation from the internet to find exposed assets nobody listed.

    Described by 4 of 10 vendors, with a condition for 1

    Read the EASM guide
  • CMDB

    CMDB-centred inventory

    Makes the configuration management database the system of record and feeds it from discovery and connectors.

    Described by 0 of 10 vendors, with a condition for 5

    Read the CMDB guide
  • EXPO

    Exposure management

    Puts asset, vulnerability and threat data together to decide which exposures to fix first and route the work.

    Described by 3 of 10 vendors, with a condition for 5

    Read the EXPO guide

Which vendor describes which approach?

  • Full bar: described on the vendor's pages we read
  • Hatched bar: described with a condition (another product, a higher tier, or part of the approach)
  • Stub: not in our sources (it may exist; we did not find it)
From each vendor's own pages, read 27 September and 11 October 2026. Not in our sources means we did not find it; it may exist.
VendorAt a glanceCAASM aggregationAgent-based inventoryExternal attack surface managementCMDB-centred inventoryExposure management
Armis CentrixArmis Centrix: described for 1 of 5 approaches, with a condition for 3.With a conditionWith a conditionNot in our sourcesWith a conditionDescribed
AxoniusAxonius: described for 2 of 5 approaches, with a condition for 1.DescribedNot in our sourcesNot in our sourcesWith a conditionDescribed
Censys ASMCensys ASM: described for 1 of 5 approaches, with a condition for 1.Not in our sourcesNot in our sourcesDescribedNot in our sourcesWith a condition
JupiterOneJupiterOne: described for 1 of 5 approaches, with a condition for 1.DescribedNot in our sourcesNot in our sourcesNot in our sourcesWith a condition
LansweeperLansweeper: described for 1 of 5 approaches, with a condition for 2.With a conditionDescribedNot in our sourcesWith a conditionNot in our sources
Microsoft Defender EASMMicrosoft Defender EASM: described for 1 of 5 approaches, with a condition for 1.Not in our sourcesNot in our sourcesDescribedNot in our sourcesWith a condition
Qualys CSAMQualys CSAM: described for 1 of 5 approaches, with a condition for 3.Not in our sourcesDescribedWith a conditionWith a conditionWith a condition
Rapid7 Surface CommandRapid7 Surface Command: described for 2 of 5 approaches, with a condition for 1.DescribedNot in our sourcesDescribedNot in our sourcesWith a condition
runZerorunZero: described for 1 of 5 approaches, with a condition for 2.DescribedWith a conditionNot in our sourcesWith a conditionNot in our sources
Tenable OneTenable One: described for 2 of 5 approaches, with a condition for 1.With a conditionNot in our sourcesDescribedNot in our sourcesDescribed
Vendors describing it4 described, 3 with a condition2 described, 2 with a condition4 described, 1 with a condition0 described, 5 with a condition3 described, 5 with a condition

How do the approaches fit together?

The five approaches answer different parts of the same question. Agents and scans find what is physically there. CAASM aggregation reconciles what every tool already reports. EASM adds what the internet can see that nobody listed. The CMDB holds the record that IT workflows run on. Exposure management decides which of all that to fix first.

They are not rivals so much as layers. A CAASM platform is only as good as the tools it reads; an agent only sees devices it is installed on; a CMDB is only as good as what feeds it. That is why the finder usually picks two approaches, not one, and why several vendors here describe more than one.

The order matters more than the label. A team whose tools disagree should reconcile before it buys another collector. A team with no tools at all should collect before it reconciles. A team whose CMDB runs IT workflows should feed and check it rather than route around it.

Questions people ask

Is CAASM a replacement for a CMDB?

No. A CMDB is the system of record that IT workflows depend on. A CAASM platform reads the CMDB along with security and IT tools, shows where they disagree, and can feed corrections back. Axonius, runZero, Armis, Lansweeper, Censys and Qualys CSAM all describe sending data to a CMDB.

Do I need agents if I have CAASM?

CAASM reads what your existing agents and tools already collect. If a device has no agent and answers no scan, a CAASM platform will only see it if another source does, such as the network, the identity provider or the cloud console. That gap is why some teams pair aggregation with their own discovery.

Where does exposure management fit?

On top of the inventory. Exposure management takes asset data, vulnerability findings and threat signals such as the CISA KEV catalog, and decides what to fix first. It needs a good inventory underneath it to be trusted.

Read next