What AssetObserve can see, prove and operate

Azure resources are usually created by whoever needed them, not by whoever maintains the asset register. A subscription-scoped, read-only collector closes that gap: virtual machines that were spun up for a project appear in the same inventory as the office estate, with the subscription they belong to attached, so nobody has to open the portal to answer 'what do we actually run in Azure?'.

For most organizations Entra ID already knows about more devices than any scan can reach -- laptops that spend their life on home networks, tablets that only ever touch the VPN. Reading that device list through Microsoft Graph gives you the roaming half of the estate without installing anything on it, and makes the difference between 'directory knows it' and 'we have scanned it' explicit.

AWS accounts multiply quietly -- one per team, one for that migration, one that came with an acquisition. Reading EC2 instances directly from the account puts those workloads on the same inventory and risk footing as everything else, and gives finance and security the same list instead of two different ones.

Google Cloud is often the platform a single team adopted for one workload, which is exactly the kind of estate that never reaches the asset register. A scoped service account reads Compute Engine across all zones in one pass, so that team's machines are documented alongside everything else without asking them to file anything.

Third-party applications get connected to Workspace by end users who are simply trying to get work done, and the resulting OAuth grants are rarely reviewed again. Delegated read-only access surfaces what is connected and what it was allowed to read, which turns SaaS sprawl into a list somebody can actually work through.

OCI usually shows up because a specific application requires it, which means it sits outside whichever cloud your team is fluent in. Tenancy-scoped compute inventory keeps that island documented in the same place as the rest, so it is not the environment everyone forgets during an audit.

Organizations that chose Open Telekom Cloud usually did so for a data-residency or procurement reason, and that reason tends to matter to the same auditor who asks for the asset register. Project-scoped ECS inventory means the German-hosted part of the estate is documented as precisely as the rest, region included.

Cloud spend arguments usually stall because finance has a bill and IT has an inventory, and neither can map one onto the other. Importing provider cost data next to the discovered resources puts both halves in one view, so 'what is this costing us and who asked for it?' becomes a question with an answer.

Supplier questionnaires ask which providers hold your workloads and how important those workloads are. If the answer is assembled by email each time, it is stale before it is sent. Deriving the provider register from what is actually running keeps the list current and defensible.

Some devices are simply never online when a scan runs: the field laptop, the consultant's machine, the workstation that only appears for two hours a week. A persistent agent collects locally and replays when it reconnects, so those devices stop being permanent blanks in the register. It stays optional -- most of the estate never needs it.

The Windows estate is where most audit questions land, and it is also where the answers are hardest to gather by hand. Read-only WinRM collection returns hardware, installed software, patch level, disk state and chassis type in one pass, which is the difference between an afternoon of remote sessions and a report you can send.

Linux servers and Macs tend to be documented by the person who set them up, which works right up until that person is on holiday. Read-only SSH collection records packages, services, disk usage and -- on macOS -- FileVault, firewall and Gatekeeper state, so the mixed part of the estate is evidenced to the same standard as Windows.

One vSphere connection documents dozens of machines at once, including the ones that are powered off and therefore invisible to any network scan. It also records which host a virtual machine sits on, which is the detail that matters when you are explaining the blast radius of a single hardware failure.

Container platforms are usually the part of the estate that the asset register ignores entirely, because 'the cluster' is one line item. Reading nodes, namespaces and image metadata through a scoped service account turns that line item into something you can reason about -- including which images are running where.

Knowing what is installed is what turns an asset list into a risk list. The same software evidence drives three separate conversations: which versions are vulnerable, which products have passed end of life, and which titles are deployed more widely than they were licensed for.

Warranty status is the sort of fact that is trivially available from the vendor and almost never recorded anywhere useful. Looking it up by serial number against the manufacturer's own API means replacement planning stops being a surprise line in next year's budget.

Almost every compliance framework and every cyber-insurance questionnaire asks the same posture questions: is the disk encrypted, is the firewall on, is malware protection running, is the machine patched. Collecting that per device turns a set of yes/no declarations into evidence with a device list behind it.

Anything you install on customer machines becomes something you have to be able to account for. Tracking agent versions, update requests and signed installer delivery means you can answer 'what is running on our endpoints, and who shipped it' about the monitoring tool itself, not just about everything it monitors.

Switches, routers and printers are the assets most likely to be missing from the register and most likely to still be running the firmware they shipped with. Read-only SNMP collection identifies the vendor, the interface count and -- for printers -- consumable levels, without touching a single configuration line.

DHCP and DNS know about devices that were online yesterday but not during your scan window. Snapshotting that state gives discovery a second opinion, and reverse-DNS coverage turns into a quiet quality signal: hosts with no PTR record are usually the ones nobody has documented.

Industrial controllers are the assets people are most nervous about touching, and with good reason. A single standard Read Device Identification request -- the same read-only probe standard scanning tools use -- returns vendor, product and revision without ever writing a coil or register, so OT can be documented rather than avoided.

The reason discovery projects stall is rarely technical -- it is that nobody wants to authorize an unbounded scan. Explicit quick, site and enterprise scopes make the boundary a decision somebody signs off, which is what turns 'maybe later' into a scheduled run.

Expired certificates cause outages that are entirely predictable and still happen regularly, usually on the internal service nobody owns. Collecting expiry, issuer and self-signed status during discovery means the renewal list builds itself from what is actually serving traffic.

Recognizing a business-critical platform during discovery changes how the asset is treated from the first scan. Identifying SAP components and Microsoft KMS hosts from their default ports means the machines that matter most are flagged as such rather than arriving as another anonymous server.

Most organizations with OT cannot say how much of it is reachable from the office network. Recognizing the signatures of common industrial protocols marks those candidates for review, which is usually the first factual input a segmentation discussion has ever had.

In an environment where even a light probe is unwelcome, listening to traffic that is already on the wire still reveals what is there. It stays behind an explicit gate and is meant for networks you own, because passive observation is a capability that should require a deliberate decision.

Firewalls and wireless controllers already hold a device list for the segments a scanner cannot reach -- guest networks, remote sites, isolated VLANs. Importing that list extends coverage into places where deploying another scan point would be hard to justify.

Change approval and incident triage both come down to the same question: what else does this touch? A map built from observed links, connections and cloud relationships answers it from evidence, and unlike a hand-drawn diagram it does not quietly go stale.

Active Directory is usually the closest thing an organization has to a complete device list, and it is also where stale computer accounts accumulate for years. Reading it over LDAPS gives discovery a strong reference list and makes the gap between 'the directory has an object' and 'the machine exists' visible.

The fastest way to lose trust in an inventory is duplicates: the same laptop listed three times because it was seen by a scan, by the directory and by an import. Resolving observations on stable identifiers -- serial number, SMBIOS UUID, directory GUID, MAC -- keeps one machine as one asset, and sends the ambiguous cases to a human instead of guessing.

Entra device records carry the management and compliance state that a network scan cannot see. Linking them to discovered assets is what lets you ask the useful question -- which machines are on the network but not enrolled in management -- instead of two separate incomplete ones.

Multi-factor coverage is asked about by insurers, auditors and frameworks in almost identical language, and it is usually answered from memory. Recording the declaration alongside the identity evidence means the answer is written once, dated, and reusable across every questionnaire that asks.

Once more than a handful of colleagues use the workspace, account administration becomes the risk. Enterprise SSO and SCIM move joiner-mover-leaver handling to the identity provider you already govern, so a departure removes access here without anyone remembering to do it.

An asset inventory is a map of where everything valuable lives, which makes it worth protecting properly. Ordered roles from auditor through owner let an auditor read evidence without gaining the ability to launch scans, and tenant scoping keeps one customer's data out of another's view.

Every reconciliation engine eventually meets a case it cannot decide. Putting those in a queue for a person is what keeps the automatic decisions trustworthy -- the system is explicit about the limits of what it inferred, so the rest can be relied on.

When an auditor asks who changed a scan scope or exported an inventory, 'we think it was probably one of us' is not an answer. Keeping administrative actions attributable means the platform holding your evidence can itself be evidenced.

The catalogue is the honest version of an integrations page: every connector carries a release-state label, so you can tell at a glance what is live today and what is scaffolding. That distinction is worth more during an evaluation than a longer list would be.

If you already run a vulnerability scanner, its findings are authoritative and its asset context usually is not. Importing those results against a reconciled inventory gives each finding an owner, a site and a criticality, which is what turns a long list into a prioritized one.

Attack-surface tools are good at finding what you did not know you had. Reconciling their output against your inventory turns 'here are some hosts' into the far more actionable 'here are the hosts that are not in your asset register'.

Endpoint protection is only as good as its coverage, and the machines it is missing are by definition the ones it cannot report on. Matching EDR inventory against discovered assets produces the difference list -- machines on the network with no protection agent -- which is the number that actually matters.

Findings that stay in a security tool tend to stay unfixed, because the work happens in the ticket system. Pushing a prioritized finding into ServiceNow, Jira or Freshservice puts it in the queue the team already works from, with the asset context attached.

Smaller teams run on a service desk rather than a full ITSM platform, and the same principle applies: work that is not in the queue does not happen. Opening tickets directly from a prioritized finding keeps the loop short.

Management platforms and asset databases each hold part of the truth, usually with conflicting fields. Reconciling them against discovery evidence resolves which records describe the same machine and exposes the ones that describe a machine nobody has seen in months.

Monitoring systems watch the assets somebody decided were important, which makes them a useful second census. Anything monitored but not discovered points at a network segment your scanner cannot reach.

For managed service providers the RMM platform is the working device list, but it is organized around what can be managed rather than what exists. Importing it alongside discovery shows which customer devices are managed, which are merely present, and where the contract and reality disagree.

The firewall sees traffic from segments a scanner will never be placed in. Importing its device view extends the inventory into guest networks, remote sites and isolated VLANs without weakening the segmentation that keeps them separate.

Where a dedicated software asset management platform is already in place, it holds the entitlement data that discovery cannot see. Combining purchased seats with observed installations is what makes the compliance position calculable rather than estimated.

Somebody in every organization needs the data in their own tool -- for a board pack, a budget model or an internal dashboard. Scheduled and on-demand exports serve that without anyone asking for a database login.

A SIEM correlates best when it knows what an asset is. Forwarding findings and evidence events gives detection rules the asset context they otherwise lack, and keeps the security team inside the console they monitor from.

A dashboard only helps the person looking at it. Routing critical findings and scan summaries into the channel the team lives in means a newly exploited vulnerability gets noticed the same day rather than at the next review meeting.

Every organization has one workflow no product anticipated. An API plus signed outbound webhooks means that workflow can be built rather than requested, and the signature means the receiving system can verify the event really came from here.

Cost allocation fails when the bill cannot be mapped to an owner. Pulling billing data next to inventory that already carries site, owner and criticality is what makes showback possible without a manual tagging campaign.

Not every organization runs one of the three big service-management platforms, and the ones that do not should not be pushed onto a parallel workflow. Additional connectors mean remediation still lands in the queue the team actually uses.

Patch management and orchestration platforms are where remediation actually happens. Comparing their coverage against the inventory answers a question they cannot answer themselves: which machines is the patching tool not managing at all?

Framework preparation is mostly evidence gathering, and the evidence overlaps far more than the frameworks admit. Mapping one set of discovery facts to every framework you are asked about means the inventory, patching and encryption evidence is collected once and reused, with the open questions listed rather than glossed over.

NIS2 asks for risk-management measures across asset management, vulnerability handling, backup, access control and supply chain -- and asks you to evidence them. Mapping the readiness report directly to Article 21(2) turns a legal text into a worklist where each item either has scan evidence behind it or an open question attached.

IT-Grundschutz preparation is document-heavy, and much of the underlying evidence is exactly what discovery already collects. Generating draft declarations and working papers from that evidence removes the transcription step that consumes most of the preparation effort.

Annex A opens with asset inventory for a reason: several later controls quietly depend on it. Aligning discovery evidence to those controls means the inventory control is satisfied by something live, and the controls built on top of it inherit the same foundation.

Article 32 asks for appropriate technical measures, and 'appropriate' has to be argued with facts. Encryption state, access control, patch level and supplier context per asset is the material that argument is made from -- particularly for the devices that actually hold personal data.

DORA moves third-party dependency from a procurement topic to a supervised one. Deriving the provider register from the platforms your workloads actually run on keeps it accurate between reviews, instead of accurate only on the day it was compiled.

Automotive suppliers face TISAX because their customers require it, usually on a deadline set by someone else. Preparing the information-security, access, operations and continuity evidence from existing discovery data shortens the part of the assessment that is pure evidence collection.

CIS Controls begin with enterprise and software asset inventory because everything after them depends on it. That makes discovery evidence the natural starting point, and gives a security programme a defensible order of work rather than a menu.

CSF is the vocabulary many boards and insurers have settled on. Presenting the same evidence through Govern, Identify, Protect, Detect, Respond and Recover means the security conversation can be held in the language the audience already uses, without a separate assessment.

The Essential Eight is deliberately short and maturity-scored, which makes it a good fit for teams that want a small number of things done properly. Patch currency, MFA and backup posture map onto evidence that discovery already produces.

SOC 2 usually arrives as a customer requirement with a date attached. Because it is evidence-over-a-period rather than a point-in-time check, having access, monitoring and change evidence accumulating from the start is worth considerably more than a pre-audit scramble.

PCI scope is defined by what touches cardholder data, and scope arguments are won with an accurate network and asset picture. Knowing what is in a segment -- and what unexpectedly reaches into it -- is the difference between a contained assessment and one that expands.

The Security Rule expects a documented risk analysis and technical safeguards across systems that handle health information. Device-level encryption, access and backup evidence supplies the technical half; the administrative half stays with the people who own the policy.

Insurance questionnaires ask a narrow set of questions -- MFA, backups, patching, endpoint protection, incident readiness -- and the answers affect both premium and whether a future claim is contested. Answering from evidence rather than optimism is the point of the pack.

Sustainability reporting increasingly reaches IT, and the honest version of it starts with hardware age, reuse and retirement rather than an offset calculation. The same lifecycle data also happens to make the case for extending equipment life instead of replacing it on a schedule.

The week before an audit is usually spent assembling documents from a dozen places. A bundle that collects evidence, reports and declarations with their provenance intact turns that week into an export, and gives the assessor a trail they can follow without another meeting.

The dangerous failure mode for a discovery run is not an error -- it is a task that silently did not happen, leaving a gap that looks like a clean result. Leases, checkpoints and retry state make failed work explicit, so an incomplete scan is reported as incomplete.

An inventory tool that becomes unusable at ten thousand assets has failed exactly when it mattered. Server-side search, cursor pagination and asynchronous export keep the console responsive at size, and saved views mean the queries people run weekly are one click rather than one reconstruction.

'96% coverage' is a comforting number that hides the question that matters: what is in the other 4%, and why. Keeping reachable, unreachable, excluded, credential-failed and unknown as separate outcomes is what makes coverage a working instrument rather than a reassurance.

The management report and the technical report have to agree, or both lose credibility. Rendering every report from the same evidence -- and from language-neutral keys, so the German version is the same report and not a re-interpretation -- keeps that guaranteed.

A findings list without owners and dates is a list of things that will still be there next quarter. Boards, campaigns and due dates make remediation trackable, and recorded risk acceptance means a deliberate decision not to fix something looks different from having missed it.

Contracts, certificates, warranties and licences all fail the same way: they expire while everyone assumes somebody else is watching. One queue for all of them turns four separate reminder systems into a single recurring review.

Software spend leaks in two directions: seats bought and never deployed, and applications deployed beyond what was bought. Comparing entitlements against observed installations shows both, and SaaS and OAuth visibility covers the subscriptions that never went through procurement.

Cloud savings usually sit in resources nobody remembers creating. Pairing cost data with inventory that knows ownership and criticality means an idle resource can be turned off by the person responsible, instead of being left running because nobody is sure what it does.

When you run several workspaces, the problem is knowing which one needs attention this week. Health signals across coverage, limits and activity answer that without opening each workspace in turn to find out.

Service providers need two things at once: strict separation between customers, and one view across them. Portfolio roll-up gives the cross-customer picture for prioritizing the week, while each customer's data and reporting stay in their own workspace.

Nobody watches a dashboard continuously, and the findings that matter most are the ones that appear between reviews. Routing them to email, a security contact or a webhook means the console is somewhere you go to investigate, not somewhere you have to sit.

Being able to leave cleanly is part of being safe to adopt. A full export answers data-access requests and end-of-contract handover, and an irreversible deletion workflow means 'remove our data' is a supported operation with a clear outcome.