CAASM LESSONS · 8 LESSONS
CAASM lessons: building an asset inventory you can trust
SHORT ANSWER
Eight lessons in four tracks: counting what you have, reconciling sources that disagree, covering the hard corners (SaaS, identities, OT and the internet-facing edge), and running a proof of concept. Each takes a few minutes, ends with what to do next, and links to the approaches and platform notes it mentions.
By The Inventory Desk · CAASM Finder · Published 2026-10-11
Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.
Count it
- 01Why Every Tool Counts a Different Number of Assets
The EDR console, the identity provider, the cloud console and the CMDB each count what they can see. Why the numbers never match, and what that tells you.
3 min
- 02Connectors or Agents: Two Ways to Collect Asset Data
API connectors read what your tools already know; agents and scans collect it again first-hand. What each sees, what each costs you, and why most estates use both.
3 min
Reconcile it
- 03When the CMDB and the Security Tools Disagree
Why a CMDB drifts from what security tools report, how to find the differences, who should decide which record wins, and how to feed corrections back.
3 min
- 04Coverage Gaps: Asking Which Devices Lack a Control
The most useful inventory question is not how many assets you have but which of them are missing something. How to write coverage questions and turn answers into work.
3 min
Cover the corners
- 05SaaS Apps and Identities as Assets
Why an unapproved SaaS app or an orphaned service account belongs in the inventory, where the data comes from, and which approaches can see it.
3 min
- 06OT and IoT: Inventory Without Touching Fragile Devices
Why OT and IoT devices need passive discovery, what vendors describe for them, where NIST's draft OT guidance points, and how to work with the OT team.
3 min
- 07Outside-In and Inside-Out: Where EASM Meets CAASM
EASM looks at your organisation from the internet; CAASM looks from the inside through your tools. What each misses, how they connect, and when you need both.
3 min
Buy it
- 08Running a 30-Day CAASM Proof of Concept
How to scope, run and judge a 30-day proof of concept for an asset inventory or CAASM platform, with questions that separate real coverage from a good demo.
3 min