APPROACH · CAASM

What is CAASM aggregation? One asset record from the tools you already run

SHORT ANSWER

CAASM aggregation connects to the security and IT tools you already run through API connectors, merges what each one reports about an asset into one record, and shows where they disagree: a laptop the EDR console has never seen, a cloud workload missing from the CMDB, an account with no owner. It collects nothing new on the device. It fits best when you already run many tools and none of them agrees on how many assets you have.

By The Inventory Desk · CAASM Finder · Published 2026-10-11

Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.

How does CAASM aggregation work?

A CAASM platform keeps a connector, often called an adapter or integration, for each source: endpoint management, EDR, identity providers, cloud accounts, SaaS management, vulnerability scanners, network tools and the CMDB. Each connector uses that tool's API and a set of credentials to pull asset records on a schedule.

The core work is correlation. The same laptop appears as a hostname in one tool, a serial number in another, a MAC address in a third and a user's device in a fourth. The platform works out which records describe the same asset and builds one record with every source's view attached, so you can see which tools know about it and which do not.

Once the records are merged, the questions get easier: which devices lack an EDR agent, which cloud workloads are missing from the CMDB, which SaaS apps nobody approved, which accounts have no owner. Some platforms then act on the answer, through tickets, workflows or by writing corrected data back to the CMDB.

When does it fit?

You run many tools (EDR, MDM, identity, cloud, scanners) and they report different numbers of assets.
Your CMDB exists but nobody trusts it, and you need to show where it is wrong.
SaaS apps and identities make up a large part of your estate, and no device agent sees them.
You cannot install new agents, but you can grant read access to the tools you already run.
Audits ask you to prove that every device has a given control, and the evidence lives in several consoles.

Where does it stop?

Aggregation is only as complete as its sources. A device that no connected tool has ever seen will not appear, and the connector for each source needs API access, credentials and someone to look after it when the source changes. Aggregation also does not look at your estate from the internet. Pair it with your own discovery where tools are thin, and with external attack surface management if unlisted internet-facing systems are a concern.

Which finder answers point to CAASM?

+2 if cloud workloads in AWS, Azure or Google Cloud (Where do your assets live?)
+3 if saaS applications and the identities that use them (Where do your assets live?)
+1 if on some devices only (Can you install agents on your devices?)
+2 if no new agents: policy, a change freeze or fragile devices (Can you install agents on your devices?)
+3 if we have one, but people do not trust it (What state is your CMDB in?)
+1 if two to four teams, for example IT, security and cloud (How many teams own assets?)
+1 if many teams or business units, and owners are often unknown (How many teams own assets?)
+3 if many tools (EDR, MDM, identity, cloud, scanners) that disagree with each other (What do you already run?)
+1 if microsoft (Azure, Intune, Entra ID or Sentinel) (What do you already run?)

Try the finder

Which vendors describe CAASM?

4 of 10 vendors describe CAASM aggregation on the pages we read, 3 with a condition, and 3 are not in our sources.

Vendors in alphabetical order, from their own pages.
Vendor	Status	What their pages say	Source
Armis Centrix	With a condition	Builds most of its inventory from its own agentless discovery and enriches it through more than 200 pre-built integrations.	Source: Armis Centrix platform · Read 27 Sep 2026
Axonius	Described	Its adapter directory lists 1,306 adapters to security and IT tools; correlating what each reports into one record per asset is the core of the product.	Source: Axonius adapter directory · Read 11 Oct 2026
Censys ASM	Not in our sources	Not described on the pages we read.	None
JupiterOne	Described	200+ pre-built integrations feed a security graph of devices, users, networks, applications, data, code repositories, security controls and owners.	Source: JupiterOne platform · Read 27 Sep 2026
Lansweeper	With a condition	Its own discovery does most of the work; shown integrations include ServiceNow, Jira Service Management, Microsoft Sentinel, Splunk and Armis, and duplicates merge on MAC address, serial number and hostname.	Source: Lansweeper homepage · Read 27 Sep 2026
Microsoft Defender EASM	Not in our sources	Not described on the pages we read.	None
Qualys CSAM	Not in our sources	Not described on the pages we read.	None
Rapid7 Surface Command	Described	Asset discovery and a unified inventory (CAASM) including devices, software, identities and controls.	Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
runZero	Described	Describes itself as CAASM: integrations with ServiceNow, CrowdStrike, Intune, AWS, Azure, Google Cloud, Entra ID, Tenable, Rapid7, Qualys and others combine with its own scan data.	Source: runZero integrations · Read 27 Sep 2026
Tenable One	With a condition	Tenable One Connectors bring third-party data into the platform; a unified asset inventory is not described in detail on the pages we read.	Source: Tenable One · Read 27 Sep 2026

Not in our sources is not a no. Ask the vendor, and send us a public source if one exists.

What should you ask a vendor?

Which of the tools we run do you have a connector for today, and which are read-only versus able to write back?
How do you decide that two records describe the same asset, and can we see why a merge happened?
How often does each connector refresh, and what happens when a source is unavailable?
Can you write corrections back to our CMDB, and with what approval step?

Questions people ask

What is the difference between CAASM and an asset inventory tool?

An asset inventory tool usually collects its own data, with agents or scans. A CAASM platform reads the tools you already run and merges their records. Several products here do some of both: runZero describes itself as CAASM and also scans the network.

How many connectors does a CAASM platform need?

As many as you have sources worth reading. Axonius's adapter directory lists 1,306 adapters, JupiterOne states 200+ integrations and Armis more than 200; the number that matters is how many of your own tools are covered.

Does CAASM find vulnerabilities?

Not by scanning. A CAASM platform reads findings from the vulnerability scanners you connect and attaches them to the right asset, which helps decide what to fix first. The scanning itself happens in the scanner.