Why does every tool count a different number of assets?

What is each tool actually counting?

Ask four teams how many assets the organisation has and you will get four answers. The endpoint team reads the EDR console, which counts devices where its agent is installed and reporting. The identity team reads the directory, which counts accounts, including people who left and service accounts nobody remembers. The cloud team reads the cloud console, which counts workloads that exist right now and forgets the ones that ran for an hour yesterday. The IT team reads the CMDB, which counts what was recorded, whether or not it still exists.

Each number is correct for what it measures. None of them is the inventory.

Why do the numbers drift apart?

Three things push them apart over time.

1. Coverage. A laptop without the EDR agent is invisible to the EDR console. A server on a network segment the scanner cannot reach is invisible to the scanner. Every tool has a blind spot shaped like its collection method.
2. Identity of the record. The same laptop is a hostname in one tool, a serial number in another, a MAC address in a third and a user's device in a fourth. Without matching those, one laptop looks like four assets, or four laptops look like one.
3. Time. Tools refresh on different schedules. A device retired last month may still be in the CMDB, already gone from the EDR console and still active in the directory.

What do the gaps tell you?

The differences between counts are where the risk sits. A device the CMDB knows about but the EDR console does not is probably missing its agent. An account in the directory with no matching device or person may be orphaned. A cloud workload that is not in the CMDB was probably created outside the normal process.

That is the reason the CAASM approach exists. Instead of picking one count and trusting it, a CAASM platform reads all of them, works out which records describe the same asset, and shows where they disagree. Vendors handle the matching differently: Lansweeper documents deduplication on MAC address, serial number and hostname, runZero profiles each asset against nearly 1,000 attributes, and Axonius describes correlating data from every connected adapter into one record per asset.

Is there a single right number?

Not really. There is a number you can defend, which is the merged count with every source's view attached and the gaps listed. That is more useful than a single figure, because it tells you what to do next.

What next?

If your tools disagree and you run many of them, start with CAASM aggregation. If you have few tools to read, start with agent-based inventory. The CAASM finder weighs both against your other answers.