APPROACH · AGENT

What is agent-based inventory? Collecting asset data yourself

SHORT ANSWER

Agent-based inventory collects asset data directly, with an agent installed on each device or with the tool's own network scanning, instead of reading other tools. It sees detail other tools may miss, such as installed software and hardware serials, and it finds devices no other tool knows about. It fits best when you have few tools to read from and can install software or scan the network.

By The Inventory Desk · CAASM Finder · Published 2026-10-11

Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.

How does agent-based inventory work?

An agent is a small program installed on a laptop or server that reports what is on it: hardware, operating system, installed software, users and configuration. Agents keep reporting when the device leaves the office network, which is why some tools offer an agent specifically for remote laptops.

Many tools in this approach also scan without agents. Active scanning sends probes across the network and fingerprints whatever answers. Passive discovery listens to network traffic and identifies devices from what they send, which matters for fragile OT and medical devices that should not be probed.

The result is first-hand data: what the tool saw itself, rather than what another tool reported. Most products here combine an optional agent with agentless scanning, and several also read data from other tools to fill gaps.

When does it fit?

You have few existing tools to read from, so there is little to aggregate.
You can install software on most devices, or scan the network you own.
You suspect unmanaged devices on the network that no existing tool knows about.
You have OT or IoT devices that need passive discovery rather than an agent.
Laptops spend most of their time off the office network.

Where does it stop?

An agent sees only devices it is installed on, and a scan sees only networks it can reach. SaaS applications, identities and cloud services that run outside your network are usually invisible to both. Agents also add an install and update burden, and some devices cannot take one. Pair own collection with CAASM aggregation where SaaS, identity and cloud data matter, and feed the results to the CMDB if IT workflows depend on it.

Which finder answers point to AGENT?

+2 if servers and network gear in offices or data centres (Where do your assets live?)
+2 if laptops that rarely touch the office network (Where do your assets live?)
+2 if oT, IoT or medical devices (Where do your assets live?)
+3 if yes, on most devices (Can you install agents on your devices?)
+1 if on some devices only (Can you install agents on your devices?)
+1 if we do not have one (What state is your CMDB in?)
+1 if one team runs IT and security assets (How many teams own assets?)
+2 if a handful of tools, no central platform (What do you already run?)

Try the finder

Which vendors describe AGENT?

2 of 10 vendors describe agent-based inventory on the pages we read, 2 with a condition, and 6 are not in our sources.

Vendors in alphabetical order, from their own pages.
Vendor	Status	What their pages say	Source
Armis Centrix	With a condition	Collects its own data without agents: agentless, passive discovery of managed and unmanaged devices.	Source: Armis Centrix platform · Read 27 Sep 2026
Axonius	Not in our sources	Not described on the pages we read.	None
Censys ASM	Not in our sources	Not described on the pages we read.	None
JupiterOne	Not in our sources	Not described on the pages we read.	None
Lansweeper	Described	Agentless scanning and passive detection by default, plus an optional IT agent for laptops that rarely touch the network.	Source: Lansweeper product · Read 27 Sep 2026
Microsoft Defender EASM	Not in our sources	Not described on the pages we read.	None
Qualys CSAM	Described	Collects through the Qualys agent, which can also act as a passive sensor.	Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026
Rapid7 Surface Command	Not in our sources	Not described on the pages we read.	None
runZero	With a condition	Collects its own data by active scanning and passive discovery, without agents.	Source: runZero platform · Read 27 Sep 2026
Tenable One	Not in our sources	Not described on the pages we read.	None

Not in our sources is not a no. Ask the vendor, and send us a public source if one exists.

What should you ask a vendor?

Which parts of our estate need an agent, and which can be scanned or discovered passively?
Is the agent optional, and what does it add over agentless scanning?
How do you discover OT or medical devices without disrupting them?
Which other tools can you read from to fill the gaps your own collection leaves?

Questions people ask

Is agentless discovery the same as CAASM?

No. Agentless discovery means the tool scans or listens to the network itself without installing software. CAASM means reading other tools through their APIs. runZero and Lansweeper do the first; Axonius and JupiterOne do the second.

Do I need an agent for remote laptops?

Often, yes, if they rarely touch the office network. Lansweeper offers an optional IT agent for this, and ServiceNow describes a unified agent. A CAASM platform can instead read the endpoint management or EDR tool that already has an agent on them.

Can I scan OT networks safely?

Vendors here describe passive discovery for fragile OT devices: runZero, Armis and Lansweeper all document passive or traffic-based detection. Check with your OT team before any active scan.