Skip to content
CAASM FinderCAASM Finder

THE INVENTORY LOG · METHOD

What does the CAASM finder recommend for eight different estates?

SHORT ANSWER

Six different vendors come first across eight example estates, with Lansweeper and runZero as equals for the ServiceNow shop, and the approach the finder starts with changes from agent-based inventory to CAASM aggregation, the CMDB, EASM and exposure management depending on the answers. Axonius comes first for one estate, a SaaS-heavy company with many owners, and second for the mixed example. The result cards below are computed by the finder, not typed.

By The Inventory Desk · CAASM Finder · Published 2026-10-12 · Updated 2026-10-14

Desk research from public vendor pages read on 27 September, 11 October and 15 October 2026. Profiles follow our published method; we did not run the products.

3 min read

Why run examples at all?

A finder with published rules can still hide a bias in the rules. The quickest way to check is to run it on very different estates and see whether different answers produce different results. Each card below is computed by the same code the finder uses.

Mixed estate, many tools, a CMDB nobody trusts

FINDER RESULT · COMPUTED

Mixed estate, many tools, a CMDB nobody trusts

Where do your assets live?
Servers and network gear in offices or data centres; Cloud workloads in AWS, Azure or Google Cloud; Laptops that rarely touch the office network
Can you install agents on your devices?
On some devices only
What state is your CMDB in?
We have one, but people do not trust it
How many teams own assets?
Two to four teams, for example IT, security and cloud
How much compliance pressure do you face?
Periodic audits that ask for asset evidence
What do you already run?
Many tools (EDR, MDM, identity, cloud, scanners) that disagree with each other
Your answers: CAASM aggregation 10 pts, agent-based inventory 5 pts, CMDB-centred inventory 4 pts, exposure management 1 pt, external attack surface management 0 pts.

Start here: CAASM aggregation (10 pts)

Also relevant: Agent-based inventory (5 pts)

First fit (16 pts): runZero

Computed from the finder rules at build time. How matching works

This is the finder's default example. Servers, cloud and remote laptops, agents on some devices, a distrusted CMDB and many tools that disagree push CAASM aggregation to the top with agent-based inventory second. runZero comes first because its pages describe both approaches, agentless collection, merging records and writing to a ServiceNow CMDB. Axonius is second: it covers the same checks except network devices and remote laptops, which it reaches only through the tools it connects.

ServiceNow shop with a working CMDB

FINDER RESULT · COMPUTED

ServiceNow shop with a working CMDB

Where do your assets live?
Servers and network gear in offices or data centres; Cloud workloads in AWS, Azure or Google Cloud
Can you install agents on your devices?
Yes, on most devices
What state is your CMDB in?
It works, and IT workflows depend on it
How many teams own assets?
Two to four teams, for example IT, security and cloud
How much compliance pressure do you face?
Periodic audits that ask for asset evidence
What do you already run?
ServiceNow
Your answers: CMDB-centred inventory 10 pts, agent-based inventory 5 pts, CAASM aggregation 3 pts, exposure management 1 pt, external attack surface management 0 pts.

Start here: CMDB-centred inventory (10 pts)

Also relevant: Agent-based inventory (5 pts)

Equal first fit (13 pts): Lansweeper, runZero

Computed from the finder rules at build time. How matching works

A CMDB that works and a ServiceNow answer make the CMDB-centred approach the starting point. ServiceNow itself is not matched: it is the CMDB the platforms here feed, so the finder shows it under Works alongside. Device42, which describes a CMDB of its own, is shown there too. Lansweeper and runZero come first as equals: both describe collecting with their own scans and name a ServiceNow integration on the pages we read.

Small IT team that can install agents

FINDER RESULT · COMPUTED

Small IT team that can install agents

Where do your assets live?
Servers and network gear in offices or data centres; Laptops that rarely touch the office network
Can you install agents on your devices?
Yes, on most devices
What state is your CMDB in?
We do not have one
How many teams own assets?
One team runs IT and security assets
How much compliance pressure do you face?
Little formal pressure today
What do you already run?
A handful of tools, no central platform
Your answers: agent-based inventory 11 pts, CMDB-centred inventory 3 pts, CAASM aggregation 0 pts, external attack surface management 0 pts, exposure management 0 pts.

Start here: Agent-based inventory (11 pts)

First fit (12 pts): Lansweeper

Computed from the finder rules at build time. How matching works

One team, few tools, agents allowed and no CMDB point almost entirely to agent-based inventory. Lansweeper comes first: an optional agent, agentless scanning, off-network laptops, and a published price and trial, which the finder checks for single-team estates.

Plant floor with OT and no new agents

FINDER RESULT · COMPUTED

Plant floor with OT and no new agents

Where do your assets live?
Servers and network gear in offices or data centres; OT, IoT or medical devices
Can you install agents on your devices?
No new agents: policy, a change freeze or fragile devices
What state is your CMDB in?
We do not have one
How many teams own assets?
One team runs IT and security assets
How much compliance pressure do you face?
Little formal pressure today
What do you already run?
A handful of tools, no central platform
Your answers: agent-based inventory 8 pts, CMDB-centred inventory 3 pts, CAASM aggregation 2 pts, external attack surface management 0 pts, exposure management 0 pts.

Start here: Agent-based inventory (8 pts)

First fit (12 pts): Lansweeper

Computed from the finder rules at build time. How matching works

OT devices and no new agents still point to own collection, but without agents. Lansweeper and runZero both describe passive discovery and published prices; Lansweeper edges ahead on the checks these answers trigger.

Azure team worried about what faces the internet

FINDER RESULT · COMPUTED

Azure team worried about what faces the internet

Where do your assets live?
Cloud workloads in AWS, Azure or Google Cloud; Internet-facing systems nobody has listed
Can you install agents on your devices?
No new agents: policy, a change freeze or fragile devices
What state is your CMDB in?
We do not have one
How many teams own assets?
One team runs IT and security assets
How much compliance pressure do you face?
Little formal pressure today
What do you already run?
Microsoft (Azure, Intune, Entra ID or Sentinel)
Your answers: external attack surface management 7 pts, CAASM aggregation 5 pts, agent-based inventory 2 pts, CMDB-centred inventory 2 pts, exposure management 0 pts.

Start here: External attack surface management (7 pts)

Also relevant: CAASM aggregation (5 pts)

First fit (13 pts): Microsoft Defender EASM

Computed from the finder rules at build time. How matching works

Unlisted internet-facing systems and a Microsoft answer put EASM first. Microsoft Defender EASM comes first as the platform the team already runs, with a 30-day trial. Censys ASM and runZero follow as equals.

Rapid7 shop with internet-facing systems

FINDER RESULT · COMPUTED

Rapid7 shop with internet-facing systems

Where do your assets live?
Servers and network gear in offices or data centres; Internet-facing systems nobody has listed
Can you install agents on your devices?
On some devices only
What state is your CMDB in?
We do not have one
How many teams own assets?
Two to four teams, for example IT, security and cloud
How much compliance pressure do you face?
Periodic audits that ask for asset evidence
What do you already run?
Rapid7
Your answers: external attack surface management 6 pts, CMDB-centred inventory 5 pts, agent-based inventory 4 pts, exposure management 4 pts, CAASM aggregation 2 pts.

Start here: External attack surface management (6 pts)

Also relevant: CMDB-centred inventory (5 pts), Agent-based inventory (4 pts)

First fit (12 pts): Rapid7 Surface Command

Computed from the finder rules at build time. How matching works

EASM leads, and Rapid7 Surface Command comes first: its pages describe both external discovery and a unified internal inventory, and it is the platform the team runs. runZero follows, with a listed Rapid7 integration.

Tenable shop with internet-facing systems

FINDER RESULT · COMPUTED

Tenable shop with internet-facing systems

Where do your assets live?
Servers and network gear in offices or data centres; Internet-facing systems nobody has listed
Can you install agents on your devices?
Yes, on most devices
What state is your CMDB in?
We do not have one
How many teams own assets?
Two to four teams, for example IT, security and cloud
How much compliance pressure do you face?
Little formal pressure today
What do you already run?
Tenable
Your answers: agent-based inventory 6 pts, external attack surface management 5 pts, exposure management 5 pts, CMDB-centred inventory 3 pts, CAASM aggregation 1 pt.

Start here: Agent-based inventory (6 pts)

Also relevant: External attack surface management (5 pts), Exposure management (5 pts)

First fit (12 pts): Tenable One

Computed from the finder rules at build time. How matching works

Agents allowed, internet-facing systems and a Tenable answer spread the weight across agent-based inventory, EASM and exposure management. Tenable One comes first, with a clear margin, as the platform the team runs and one that describes EASM and exposure management.

SaaS-heavy company with many owners

FINDER RESULT · COMPUTED

SaaS-heavy company with many owners

Where do your assets live?
Cloud workloads in AWS, Azure or Google Cloud; SaaS applications and the identities that use them
Can you install agents on your devices?
No new agents: policy, a change freeze or fragile devices
What state is your CMDB in?
We do not have one
How many teams own assets?
Many teams or business units, and owners are often unknown
How much compliance pressure do you face?
Regulators or customers expect evidence of control coverage at any time
What do you already run?
Many tools (EDR, MDM, identity, cloud, scanners) that disagree with each other
Your answers: CAASM aggregation 11 pts, exposure management 5 pts, CMDB-centred inventory 2 pts, agent-based inventory 1 pt, external attack surface management 0 pts.

Start here: CAASM aggregation (11 pts)

First fit (16 pts): Axonius

Computed from the finder rules at build time. How matching works

SaaS and cloud, no new agents, many owners, continuous compliance pressure and many disagreeing tools put CAASM aggregation far ahead. Axonius comes first: its pages describe SaaS apps, human and non-human identities, merging records, cross-source queries and workflows, which are exactly the checks these answers trigger. JupiterOne is second.

What do the eight results show?

Two things. First, the starting approach follows the estate: agent-based inventory for small and OT-heavy estates, the CMDB for a ServiceNow shop, EASM where the internet-facing edge is unknown, and CAASM aggregation where many tools and SaaS dominate. Second, the platform you already run matters: in three of the eight profiles the vendor whose platform you named comes first.

How do you get your own result?

Answer the six questions in the finder. Your answers go into the page address, so you can share the result with your team. If your result surprises you, open each vendor's check lines: they show exactly which facts matched, which partly matched and which were not in our sources.

Sources

Source: Axonius platform · Read 27 Sep 2026

Source: runZero platform · Read 27 Sep 2026

Source: Lansweeper pricing · Read 11 Oct 2026

Source: ServiceNow CMDB · Read 27 Sep 2026

Source: Microsoft Learn: understanding billable assets · Read 27 Sep 2026

Source: Rapid7 Surface Command · Read 27 Sep 2026

Source: Tenable One · Read 27 Sep 2026

Read next

More from the Log