FAQ · 22 QUESTIONS
CAASM FAQ: asset inventory questions, answered
SHORT ANSWER
22 short answers on cyber asset attack surface management and asset inventory, grouped by theme: the basics, the CMDB, collection, pricing, the vendors, and how this site works. Each answer links to the page that goes deeper.
By The Inventory Desk · CAASM Finder · Published 2026-10-11
Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.
What is CAASM, and do I need it?
What does a CAASM platform actually do?
It connects to the tools you already run, such as EDR, MDM, identity, cloud and the CMDB, merges what each one reports about an asset into one record, and shows the gaps between them. See CAASM aggregation.
Why does every tool report a different number of assets?
Each counts only what it can see: devices with its agent, accounts in its directory, workloads in its cloud. None is the inventory on its own. See the lesson on counts.
How do I know which approach I need?
Answer the six questions in the CAASM finder. Where your assets live, whether you can install agents and the state of your CMDB decide most of it.
Is CAASM the same as EASM?
No. CAASM works from the inside through your tools; EASM looks from the internet inward. See external attack surface management.
How does CAASM relate to the CMDB?
Does CAASM replace a CMDB?
No. The CMDB is the system of record that IT workflows depend on. A CAASM platform reads it, compares it with security and IT tools, and can send corrections back. See CMDB-centred inventory.
Our CMDB is not trusted. Where do we start?
Compare it with sources you do trust, such as EDR, identity and cloud consoles, and look at what is missing or stale. See When the CMDB and security tools disagree.
Which vendors here write back to a CMDB?
On the pages we read, Armis Centrix, Axonius, Censys ASM, Lansweeper, Qualys CSAM and runZero describe feeding or updating a CMDB. See the asset census.
What changed between ServiceNow and Armis?
ServiceNow completed its acquisition of Armis in April 2026; Armis Centrix remains available standalone and as part of the ServiceNow AI Platform. See the log post.
Agents, scans or connectors?
Do I need to install agents?
Not necessarily. CAASM reads the agents you already have; network scanning and passive discovery find devices without agents. You need an agent where nothing else sees a device, often remote laptops. See Connectors or agents.
Which vendors work without new agents?
Armis Centrix, Axonius, Censys ASM, JupiterOne, Lansweeper, Microsoft Defender EASM and runZero describe working without new agents. See agent-based inventory.
How do I inventory OT and IoT devices safely?
With passive discovery that listens rather than probes, agreed with the OT team. See the OT and IoT lesson.
Are SaaS apps and identities assets?
For security purposes, yes: an unapproved SaaS app or an orphaned service account is as much a gap as an unmanaged laptop. See SaaS apps and identities as assets.
What do these tools cost?
Do asset inventory vendors publish prices?
Some do. On the pages we read, Axonius, JupiterOne, Lansweeper and runZero publish a price, Armis Centrix, Censys ASM, Microsoft Defender EASM, Rapid7 Surface Command and Tenable One publish a pricing basis, an adjacent price or a free account, and one quote through sales. See the published prices post.
Can I try before buying?
Lansweeper, Microsoft Defender EASM, Qualys CSAM, Rapid7 Surface Command and runZero offer a trial or free tier on the pages we read; Censys ASM and Tenable One offer a free account with conditions. See platform notes.
Does Axonius publish a price?
Yes, since our 11 October 2026 read. Axonius publishes device-based pricing on unique, correlated devices, and its pricing page shows a starting rate of $8.55 per asset for 15,000 to 24,999 assets. An AWS Marketplace listing prices 500 assets at $90,625 for 12 months. No free tier or trial is listed. See Axonius platform notes.
What should I know about the vendors?
Which vendors describe CAASM aggregation?
Axonius, JupiterOne, Rapid7 Surface Command and runZero describe it; Armis Centrix, Lansweeper and Tenable One describe it with a condition. See CAASM aggregation.
Which vendors look from the outside in?
Censys ASM, Microsoft Defender EASM, Rapid7 Surface Command and Tenable One describe external attack surface management. See EASM.
Where is Axonius strong, and where are its limits?
Axonius's pages describe 1,306 adapters in its directory, correlation into one record per asset, SaaS and identity coverage, published device-based pricing, and workflows including ServiceNow CMDB updates. It depends on the tools you connect, with no agent or native scanner of its own, describes no external discovery, and lists no free tier or trial. See Axonius platform notes.
What happened to runZero?
Dragos announced on 21 September 2026 that it had acquired runZero and NetRise; existing customers continue to be served. See the log post.
How does this site work?
Does this site rank or score vendors?
No. The finder orders vendors by fit to your answers, using published rules; equal fits are shown alphabetically. See How matching works.
Where do the facts come from?
Public vendor pages, documentation, pricing pages, marketplace listings, press releases and blog posts read on 27 September and 11 October 2026, plus public pages from CISA, FIRST and NIST. No hands-on testing. See How matching works.
How do I report a mistake?
Use the contact page with the topic Correction and a public source.
Read next
- CAASM finder
Six questions about your estate
- Asset terms
Plain definitions of the terms vendors use
- CAASM lessons
Short lessons on building an inventory
- Approaches
The five approaches compared