Skip to content
CAASM FinderCAASM Finder

FINDER · SIX QUESTIONS

CAASM finder: which asset inventory approach fits your estate?

SHORT ANSWER

Answer six questions and the finder weighs five approaches (CAASM aggregation, agent-based inventory, external attack surface management, CMDB-centred inventory and exposure management), shows the weight of your answers as copper bars, then checks each vendor's published facts against them. Every rule is written out on How matching works. The page opens with an example company's answers; change any answer to see your own result.

01 / 06Where do your assets live?

Tick every place that holds a meaningful share of your estate.

02 / 06Can you install agents on your devices?

Think about change control, device owners and fragile systems.

03 / 06What state is your CMDB in?

CMDB means configuration management database.

04 / 06How many teams own assets?

Count the teams that buy, run or answer for assets.

05 / 06How much compliance pressure do you face?

Audits, regulators and customer questionnaires all count.

06 / 06What do you already run?

Pick the one that best describes what you would build on.

Show my result

Your answers point to CAASM aggregation

Your answers: CAASM aggregation 10 pts, agent-based inventory 5 pts, CMDB-centred inventory 4 pts, exposure management 1 pt, external attack surface management 0 pts.CAASMConnect10 ptsAGENTCollect5 ptsEASMOutside-in0 ptsCMDBRecord4 ptsEXPOPrioritise1 pt
  • Full bar: described on the vendor's pages we read
  • Hatched bar: described with a condition (another product, a higher tier, or part of the approach)
  • Stub: not in our sources (it may exist; we did not find it)
  • Copper bars: the weight of your answers
The bars show what each vendor's own pages describe, or how your answers weigh the five approaches. They are not a measure of how well a product works.
  • CAASMpicked for your answersConnect10 pts
  • AGENTpicked for your answersCollect5 pts
  • EASMOutside-in0 pts
  • CMDBRecord4 pts
  • EXPOPrioritise1 pt

Start here

  • CAASM aggregation 10 pts

    +2 cloud workloads · +1 agents on some devices only · +3 a CMDB people do not trust · +1 two to four owning teams · +3 many tools that disagree

Also relevant

  • Agent-based inventory 5 pts

    +2 servers and network gear · +2 off-network laptops · +1 agents on some devices only

Lower on your list or not suggested

Vendors whose published facts match

Ordered by how many of your checks each vendor's own pages satisfy. Equal fits are listed alphabetically. This is a fit to your answers, not a quality ranking.

    • runZeroMatches 6 checks fully, 1 partly, 0 not in our sourcesDescribes 2 of 2 picked approaches, 1 with a condition
      • Servers and network devices Matches

        Active scanning of IT, OT, IoT, cloud, mobile and remote assets.

        Source: runZero platform · Read 27 Sep 2026

      • Cloud workloads Matches

        Cloud assets, with AWS, Azure and Google Cloud integrations.

        Source: runZero integrations · Read 27 Sep 2026

      • Off-network laptops Matches

        Remote assets are a listed class.

        Source: runZero platform · Read 27 Sep 2026

      • Works without new agents Matches

        No agents, authentication or appliances.

        Source: runZero platform · Read 27 Sep 2026

      • Merges records from several sources Matches

        Profiles each asset against nearly 1,000 attributes.

        Source: runZero homepage · Read 27 Sep 2026

      • Feeds or updates a CMDB Matches

        ServiceNow integration for CMDB enrichment.

        Source: runZero integrations · Read 27 Sep 2026

      • Cross-source queries and reports Partly

        AI-assisted reporting on the Platform plan.

        Source: runZero pricing · Read 27 Sep 2026

      runZero: described for 1 of 5 approaches, with a condition for 2.Platform note
    • AxoniusMatches 5 checks fully, 2 partly, 0 not in our sourcesDescribes 1 of 2 picked approaches, 0 with a condition
      • Servers and network devices Partly

        Network devices are covered through adapters to network tools; a native network scanner is not described.

        Source: Axonius platform · Read 27 Sep 2026

      • Cloud workloads Matches

        Cloud is a listed asset type.

        Source: Axonius platform · Read 27 Sep 2026

      • Off-network laptops Partly

        Devices are collected through the endpoint and management tools you connect, such as Microsoft Intune or CrowdStrike Falcon; no Axonius agent is described.

        Source: Axonius docs: Microsoft Intune adapter · Read 11 Oct 2026

      • Works without new agents Matches

        Collects through adapters (API connections) to tools you already run; the pages we read describe no Axonius endpoint agent.

        Source: Axonius platform · Read 27 Sep 2026

      • Merges records from several sources Matches

        Correlates data from every connected adapter into one record per asset.

        Source: Axonius platform · Read 27 Sep 2026

      • Feeds or updates a CMDB Matches

        Enforcement actions create, update, and disable or remove assets in ServiceNow, and can create ServiceNow incidents.

        Source: Axonius docs: ServiceNow adapter · Read 11 Oct 2026

      • Cross-source queries and reports Matches

        Query Wizard for questions across all connected sources.

        Source: Axonius documentation · Read 27 Sep 2026

      Axonius: described for 2 of 5 approaches, with a condition for 1.Platform note
    • LansweeperMatches 4 checks fully, 2 partly, 1 not in our sourcesDescribes 2 of 2 picked approaches, 1 with a condition
      • Servers and network devices Matches

        The network, including OT, is one of its three discovery systems.

        Source: Lansweeper homepage · Read 27 Sep 2026

      • Cloud workloads Partly

        Cloud discovery is documented; providers are not named on the product page.

        Source: Lansweeper product · Read 27 Sep 2026

      • Off-network laptops Matches

        Off-network laptops are one of its three discovery systems, through an optional agent.

        Source: Lansweeper homepage · Read 27 Sep 2026

      • Works without new agents Matches

        Agentless scanning; passive detection runs by default.

        Source: Lansweeper product · Read 27 Sep 2026

      • Merges records from several sources Partly

        Deduplicates on MAC address, serial number and hostname.

        Source: Lansweeper homepage · Read 27 Sep 2026

      • Feeds or updates a CMDB Matches

        ServiceNow, Jira Service Management, HaloITSM, Freshservice and TOPdesk are shown integrations.

        Source: Lansweeper homepage · Read 27 Sep 2026

      • Cross-source queries and reports Not in our sources
      Lansweeper: described for 1 of 5 approaches, with a condition for 2.Platform note
    • Armis CentrixMatches 4 checks fully, 1 partly, 2 not in our sourcesDescribes 2 of 2 picked approaches, 2 with a condition
      Armis Centrix: described for 1 of 5 approaches, with a condition for 3.Platform note
    • JupiterOneMatches 2 checks fully, 4 partly, 1 not in our sourcesDescribes 1 of 2 picked approaches, 0 with a condition
      • Servers and network devices Partly

        Networks are a listed asset class; network devices are not called out.

        Source: JupiterOne platform · Read 27 Sep 2026

      • Cloud workloads Partly

        Covered through integrations; cloud workloads are not named as a class on the platform page.

        Source: JupiterOne platform · Read 27 Sep 2026

      • Off-network laptops Partly

        Devices are a listed asset class, through the endpoint tools you integrate.

        Source: JupiterOne platform · Read 27 Sep 2026

      • Works without new agents Matches

        Builds its graph from API integrations.

        Source: JupiterOne platform · Read 27 Sep 2026

      • Merges records from several sources Partly

        The graph maps relationships between assets; how duplicate records merge depends on the data each integration supplies.

        Source: JupiterOne platform · Read 27 Sep 2026

      • Feeds or updates a CMDB Not in our sources
      • Cross-source queries and reports Matches

        Graph queries in plain English, a pre-built query library and compliance insights.

        Source: JupiterOne platform · Read 27 Sep 2026

      JupiterOne: described for 1 of 5 approaches, with a condition for 1.Platform note
    • Rapid7 Surface CommandMatches 1 checks fully, 3 partly, 3 not in our sourcesDescribes 1 of 2 picked approaches, 0 with a condition
      • Servers and network devices Partly

        Internal attack surface visibility is described; network devices are not called out.

        Source: Rapid7 Surface Command · Read 27 Sep 2026

      • Cloud workloads Partly

        InsightCloudSec sits in the same platform.

        Source: Rapid7 products · Read 27 Sep 2026

      • Off-network laptops Not in our sources
      • Works without new agents Not in our sources
      • Merges records from several sources Matches

        A unified asset inventory (CAASM).

        Source: Rapid7 Surface Command · Read 27 Sep 2026

      • Feeds or updates a CMDB Not in our sources
      • Cross-source queries and reports Partly

        Asset graph and blast radius views.

        Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026

      Rapid7 Surface Command: described for 2 of 5 approaches, with a condition for 1.Platform note
    • Censys ASMMatches 3 checks fully, 0 partly, 4 not in our sourcesDescribes 0 of 2 picked approaches, 0 with a condition
      • Servers and network devices Not in our sources
      • Cloud workloads Matches

        Names AWS, Google Cloud and Azure among its integrations.

        Source: Censys integrations · Read 27 Sep 2026

      • Off-network laptops Not in our sources
      • Works without new agents Matches

        Discovery runs from the internet, starting from seeds added in the console or through the API.

        Source: Censys docs: seed your attack surface · Read 27 Sep 2026

      • Merges records from several sources Not in our sources
      • Feeds or updates a CMDB Matches

        ServiceNow CMDB is a named integration.

        Source: Censys integrations · Read 27 Sep 2026

      • Cross-source queries and reports Not in our sources
      Censys ASM: described for 1 of 5 approaches, with a condition for 1.Platform note
    • Qualys CSAMMatches 1 checks fully, 0 partly, 6 not in our sourcesDescribes 1 of 2 picked approaches, 0 with a condition
      • Servers and network devices Not in our sources
      • Cloud workloads Not in our sources
      • Off-network laptops Not in our sources
      • Works without new agents Not in our sources
      • Merges records from several sources Not in our sources
      • Feeds or updates a CMDB Matches

        Syncs with ServiceNow and BMC ITSM tools.

        Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026

      • Cross-source queries and reports Not in our sources
      Qualys CSAM: described for 1 of 5 approaches, with a condition for 3.Platform note
  9. Equal fit
    • Microsoft Defender EASMMatches 1 checks fully, 1 partly, 5 not in our sourcesDescribes 0 of 2 picked approaches, 0 with a condition
      • Servers and network devices Not in our sources
      • Cloud workloads Not in our sources
      • Off-network laptops Not in our sources
      • Works without new agents Matches

        An Azure service that discovers from seeds and a prebuilt inventory.

        Source: Microsoft Learn: Defender EASM overview · Read 27 Sep 2026

      • Merges records from several sources Not in our sources
      • Feeds or updates a CMDB Not in our sources
      • Cross-source queries and reports Partly

        Dashboards for vulnerabilities, compliance and hygiene.

        Source: Microsoft Learn: Defender EASM overview · Read 27 Sep 2026

      Microsoft Defender EASM: described for 1 of 5 approaches, with a condition for 1.Platform note
    • Tenable OneMatches 0 checks fully, 2 partly, 5 not in our sourcesDescribes 1 of 2 picked approaches, 1 with a condition
      • Servers and network devices Partly

        Tenable One includes vulnerability management alongside external attack surface data.

        Source: Tenable: buy · Read 27 Sep 2026

      • Cloud workloads Not in our sources
      • Off-network laptops Not in our sources
      • Works without new agents Not in our sources
      • Merges records from several sources Partly

        Tenable One Connectors bring third-party data into the platform.

        Source: Tenable One · Read 27 Sep 2026

      • Feeds or updates a CMDB Not in our sources
      • Cross-source queries and reports Not in our sources
      Tenable One: described for 2 of 5 approaches, with a condition for 1.Platform note

Works alongside your CMDB and service desk

Keep the CMDB. ServiceNow, Freshservice and Device42 are systems of record that the platforms above feed; they are not alternatives to them. The check 'Feeds or updates a CMDB' shows which platforms write to one.

How does the finder decide?

Two steps. First, each answer adds points to the approaches it makes more relevant; the highest becomes your starting approach and the copper bars show the balance. Second, each vendor gets points for describing your picked approaches and for matching the checks your answers trigger. The full rule table is on How matching works. A vendor marked Not in our sources may still offer something; we did not find it on the pages we read, so ask the vendor.

How matching works

Questions people ask

Why does the finder point me to CAASM aggregation?

Usually because you run many tools that disagree, your CMDB is not trusted, or SaaS and cloud make up much of your estate. In those cases the inventory problem is reconciling what you already collect, not collecting more.

Why are some vendors shown as an equal fit?

Their published facts satisfy your checks to the same degree. We list equal fits alphabetically rather than invent a tiebreak.

What does Not in our sources mean?

We did not find that capability or fact on the vendor pages we read on 27 September and 11 October 2026. It may exist; it counts zero in the finder, not a penalty, and the platform notes say so.

Does the finder store my answers?

No. Answers live in the page's address bar so you can share a result. Nothing is sent anywhere.

Read next