IT Asset & Software Inventory (CMDB · CAASM)
Knows what you own before you defend it.
Overview
CIS Controls 1 and 2 are the enterprise asset inventory and the software inventory, in that order, before anything else — because you cannot patch, scope an audit, price a risk or prove a control covers the estate against a list you do not have. The category has split: classic ITAM and CMDB tools (Lansweeper, Device42, ServiceNow) discover and record assets, while CAASM tools (Axonius, runZero) build a queryable inventory by reconciling what your existing security tools each think they see — which is how you find the twelve hosts EDR covers and the vulnerability scanner does not. SaaS-management platforms cover the third estate nobody owns: the applications bought on a credit card.
Every other control, audit scope and risk estimate is measured against this list; without it they are all estimates.
Advantages
- CIS Controls 1 and 2 — literally the first two controls, and the prerequisite for the rest
- Reconciling several tools against each other finds the coverage gaps each one reports as fine
- Audit scoping stops being a guess: you can show the population a sample was drawn from
- Asset criticality turns a generic vulnerability count into a prioritised one
- SaaS discovery surfaces the applications finance is paying for and security has never seen
Trade-offs
- Inventories decay the moment they are built; without automated discovery they are fiction within a quarter
- CMDB projects have a long history of stalling on ownership rather than technology
- Reconciliation surfaces disagreements between tools that someone then has to adjudicate
- Per-asset pricing punishes exactly the ephemeral cloud estates that most need it
- Discovery in OT and IoT environments can be actively unsafe if done with active scanning
Open-source option
Snipe-IT is a mature open-source IT asset manager with a real API, GLPi covers ITAM and service management together, and runZero offers a free tier for small estates whose unauthenticated discovery is genuinely best in class. The gap is reconciliation breadth: none of them aggregates your EDR, vulnerability scanner, cloud and identity sources the way a commercial CAASM tool does.
Vendors & tools in this area
Crown-jewel inventory joined to risk, controls and frameworks.
Visit site →