How do you find the devices that lack a control?

Why ask about gaps rather than totals?

A total tells you how big the estate is. A gap tells you what to do on Monday. Auditors ask about gaps too: not how many laptops you have, but whether every laptop has disk encryption, an EDR agent and a patch level you can defend.

Lansweeper's data team published an analysis in September 2026 of several million endpoints across about 30,000 organizations: 96% had some protection, while 68.1% ran full EDR or next-generation antivirus. Whatever your own numbers, the point is that "protected" and "protected by the control you think" are different questions, and only the second is useful.

What makes a good coverage question?

Three parts.

1. A population. All laptops, all production servers, all cloud workloads in one account. Be precise, or the answer will include things that should not count.
2. A control. EDR agent installed and reporting in the last seven days; record present in the CMDB; owner assigned. Define it so that two people would reach the same answer.
3. The sources. Which tool says the device exists, and which tool says the control is present. A coverage question always compares at least two sources.

How do tools answer it?

Inventory platforms provide query tools for exactly this. Axonius documents a Query Wizard and describes a natural language interface; JupiterOne describes graph queries in plain English with a pre-built query library. The query is only as good as the merge underneath it: if one laptop appears as two records, it may look covered and uncovered at once.

What do you do with the answer?

Turn each gap into work for someone who can close it. That might be a ticket to the endpoint team, a change request to add a CMDB record, or an automated action. Track the count of each gap over time, so you can show an auditor or a board that it is going down.

How do you keep the answers honest?

Check a sample by hand every time you change a query or connect a new source. Look for devices that appear covered only because two records were merged wrongly, and for devices that appear uncovered because the control reports under a different name. Keep the definition of each control in writing next to the query, so that a new team member reaches the same answer.

Which gaps should come first?

Start with the ones that combine exposure and absence of a control: internet-facing systems with no EDR agent, privileged accounts with no owner, production servers missing from the CMDB. Exposure management tools rank by those combinations; you can do a rough version with a spreadsheet of the top three gaps.

What next?

If audits ask you for this kind of evidence, answer question 05 in the finder accordingly; it triggers the cross-source query check for each vendor. The asset census shows which vendors describe cross-source queries.