Connectors or agents: which way should you collect asset data?

What does a connector see?

A connector, which Axonius calls an adapter, reads another tool's API with a set of credentials and pulls its asset records. It installs nothing on devices. What it sees is exactly what the source tool sees: the EDR console's devices, the identity provider's accounts, the cloud account's workloads, the SaaS management tool's apps.

That makes connectors strong where devices are not the point. SaaS applications, user and service accounts, and cloud resources live in APIs, not on a network you can scan. A connector approach can reach them on day one if you have the access.

The cost is inheritance. If the source tool has a blind spot, so does the connector. And each connector needs API access, credentials and someone to notice when the source changes its API or its permissions.

What does an agent or scan see?

An agent installed on a device reports what is on it, first-hand, wherever the device goes. ServiceNow describes a unified agent; Lansweeper offers an optional IT agent for laptops that rarely touch the network.

Network scanning collects first-hand too, without installing anything. runZero describes active scanning with no agents, authentication or appliances, plus passive discovery for fragile OT. Lansweeper runs passive detection by default alongside agentless scanning.

The strength here is finding what nothing else knows about: the unmanaged device on the office network, the printer with default settings, the server someone built under a desk. The cost is reach. An agent sees only the device it is on. A scan sees only the networks it can reach. Neither sees a SaaS app or a service account.

How do you choose?

Ask what your estate is mostly made of, and what you already run.

• If most of your estate is SaaS, identities and cloud, and you already run many tools, connectors will cover more, faster.
• If you have few tools and a lot of physical devices, own collection gives you a baseline that connectors cannot.
• If you cannot install new agents because of policy, a change freeze or fragile devices, lean on connectors and passive discovery.

Why do most estates use both?

Because each covers the other's blind spot. A connector platform can read the results of a network scanner, and several scanning tools also read other tools: runZero lists integrations with CrowdStrike, Intune, Tenable and ServiceNow. The useful question is which comes first, and the finder's agents question and existing tools question weigh exactly that.

What about freshness?

Collection method also decides how current the data is. A connector is as fresh as its source and its own refresh schedule; Axonius, for example, refreshes on each discovery cycle. An agent reports as often as it is configured to. Passive discovery sees changes as traffic happens. Ask each vendor how quickly a new device appears and how quickly a retired one disappears, because stale records are as misleading as missing ones.

What next?

Read the two approach guides, CAASM aggregation and agent-based inventory, then answer question 02 in the finder honestly.