What changed in asset inventory between February and September 2026?

Who changed hands?

Two acquisitions reshaped the field this year.

On 20 April 2026 ServiceNow completed its acquisition of Armis. Armis says Armis Centrix remains available as a standalone product and as part of the ServiceNow AI Platform. For buyers this matters because ServiceNow is the CMDB that many IT workflows run on, and Armis brings agentless discovery of IT, OT, IoT and medical devices. We look at the questions it raises in ServiceNow now owns Armis.

On 21 September 2026 Dragos, an OT security company, announced it had acquired runZero and NetRise to extend its xOT security platform. Dragos says runZero CEO HD Moore will lead integration work while existing customers continue to be served, and no deal terms were disclosed. See Dragos buys runZero.

What did vendors add to the inventory itself?

The theme of the year was reconciling sources and making the inventory easier to ask questions of.

• CMDB reconciliation. On 22 July Axonius described a CMDB Reconciliation Workspace that compares a CMDB such as ServiceNow with its correlated adapter data, flags assets missing from the CMDB and mismatched field values, and can create missing records through its Action Center.
• AI access to asset data. On 21 July Axonius announced an MCP server that makes its asset data queryable from other AI tools, in early access, and an AI agent inside its Asset Cloud, in preview. On 13 May JupiterOne announced a tool that maps how AI agents, cloud resources and identities connect, queryable in plain English.
• Integrations. On 10 September runZero 5.1 let users generate integration scripts, written in Starlark, with an AI provider of their choice, running in a sandbox. Earlier in the year Armis launched a developer portal around its API v3 (24 February) and a marketplace for partner integrations (3 March).

What did vendors add on top of the inventory?

Exposure features kept growing. JupiterOne's May announcement included Unified Vulnerability Management, which deduplicates findings across tools. On 24 September Axonius said it was named a Strong Performer in The Forrester Wave: Proactive Security Platforms, Q3 2026, an evaluation of 12 vendors. On 4 March Armis said it was named a Leader in the 2026 Gartner Magic Quadrant for CPS Protection Platforms for the second year running. Those are the vendors' own statements about third-party reports, which we have not read.

What did the data say?

On 7 September Lansweeper published endpoint protection data from about 30,000 organizations: 96% had some protection, while 68.1% ran full EDR or next-generation antivirus. We look at what that means for coverage questions in Endpoint protection coverage.

What did NIST publish?

Two items. On 25 August NIST finalized SP 1347, a quick-start guide explaining how informative references map other standards to CSF 2.0 outcomes. On 21 September it released the initial public draft of SP 800-82 Revision 4, its guide to OT security, which expands guidance on asset management and network monitoring, with comments open until 30 November 2026. See NIST's OT draft and CSF references.

What does it add up to?

Three things for buyers. First, ownership of two products changed, so roadmap questions belong in any evaluation of them. Second, vendors are converging on the same problem from different directions: discovery tools add integrations, aggregation tools add reconciliation and workflows, and CMDB owners add discovery. Third, the questions you can ask an inventory are getting easier to phrase, which raises the bar on whether the answers can be trusted. A plain-English query over badly merged records gives a confident wrong answer, so correlation quality matters more as the interfaces get friendlier. The CAASM finder has not changed its rules for any of this; it still matches your estate to what each vendor's pages describe.