How we match CAASM and asset inventory tools to your answers

What do we record for each vendor?

For each of the five approaches we record one of three statuses with a note and a source: Described (the vendor's pages we read describe it), Described with a condition (it sits in another product, a higher tier, or covers only part of the approach), and Not in our sources (we did not find it). We also record fifteen checks: servers and network devices, cloud workloads, SaaS applications, identities as assets, off-network laptops, OT and IoT devices, internet-facing discovery, an agent of its own, working without new agents, merging records from several sources, feeding or updating a CMDB, cross-source queries and reports, workflows or actions, a published price or pricing basis, and a free tier or trial. Each check is Matches, Partly or Not in our sources.

What does Not in our sources mean, and is it fair?

It means we did not find the item on the pages we read. It counts zero, not against the vendor. It does affect order: a vendor whose pages name a Tenable integration can match a Tenable shop, and one whose pages do not cannot, even if the integration exists. This cuts against vendors with long integration catalogues that we did not reproduce in full, Axonius among them: its adapter directory lists 1,306 adapters, and we recorded only those with documentation we read. The fix is a source, not a guess: send it through the contact page and we will add it.

Which vendors are covered, and why these ten?

Ten platforms whose products answer the question of what you own, from five directions, with public pages detailed enough to record: Armis Centrix, Axonius, Censys ASM, JupiterOne, Lansweeper, Microsoft Defender EASM, Qualys CSAM, Rapid7 Surface Command, runZero and Tenable One. ServiceNow, Freshservice and Device42 are covered as the CMDB and service desk systems these platforms work alongside, not matched as options. Oomnitza is relevant but not covered: its pages describe IT asset lifecycle management more than security coverage. We will add vendors as our sources grow.

Where do the facts come from?

• Vendor product pages, documentation, pricing pages, marketplace listings, press releases and blog posts, read on 27 September 2026, with pricing, adapter, deployment and trial pages for several vendors read again on 11 October 2026. Each fact on the site carries its source link and its own read date.
• Prices from AWS Marketplace listings are labelled as marketplace prices; they are list prices for a stated contract, and private offers may differ.
• Vendor figures such as asset counts, adapter counts or customer numbers are quoted as the vendor's statement and are never our finding.
• Where a vendor does not publish a price, we write Not published.
• Definitions of CVE, CVSS, EPSS and the CISA KEV catalog link to the public pages of FIRST and CISA, and references to NIST link to NIST's own pages.

What are the limitations?

Public sources only. No hands-on testing, no demos, no vendor interviews. A vendor's pages describe what it sells, not how well it works on your estate, and integration catalogues are longer than the examples we recorded. That is why the Not in our sources status exists. Use the finder to decide what to ask and what to put into a proof of concept, not as a test result.

Do the same rules apply to every vendor?

Yes. The same rules apply to every vendor, they are published on this page, and vendors with equal fit are listed alphabetically. With other answers, other vendors come first: a ServiceNow shop with a working CMDB is pointed to Lansweeper and runZero as equals, a small IT team that can install agents to Lansweeper, an Azure team worried about what faces the internet to Microsoft Defender EASM, a Rapid7 shop to Rapid7 Surface Command, a Tenable shop to Tenable One, and the example mixed estate to runZero.

How do we handle corrections?

Send a correction through the contact page with the topic Correction and a public source. We check it against the vendor's page and update the data; finder results recompute automatically.

Contact