THE INVENTORY DESK · VENDOR PAGES READ 27 SEPTEMBER AND 11 OCTOBER 2026
Which CAASM approach fits the estate you actually have?
SHORT ANSWER
Cyber asset attack surface management (CAASM) is one of five ways to answer the question of what you own: connect the tools you already run, collect with your own agents or scans, look from the internet inward, make the CMDB the record, or start from exposures. Which one fits depends on where your assets live, whether you can install agents, the state of your CMDB, how many teams own assets, your compliance pressure and the tools you have. The six-question finder weighs the five approaches and shows which of 10 platforms' published facts match, and which systems of record they work alongside, with no scores or rankings.
By The Inventory Desk · CAASM Finder · Published 2026-10-11
Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.
What are the five approaches to asset inventory?
- CAASM
CAASM aggregation
Connects to the security and IT tools you already run through API connectors and merges what they report into one record per asset.
7 of 10 vendors here describe it on the pages we read
Read the CAASM guide - AGENT
Agent-based inventory
Collects inventory itself, through an agent on each device or its own network scanning, instead of reading other tools.
4 of 10 vendors here describe it on the pages we read
Read the AGENT guide - EASM
External attack surface management
Looks at your organisation from the internet to find exposed assets nobody listed.
5 of 10 vendors here describe it on the pages we read
Read the EASM guide - CMDB
CMDB-centred inventory
Makes the configuration management database the system of record and feeds it from discovery and connectors.
5 of 10 vendors here describe it on the pages we read
Read the CMDB guide - EXPO
Exposure management
Puts asset, vulnerability and threat data together to decide which exposures to fix first and route the work.
8 of 10 vendors here describe it on the pages we read
Read the EXPO guide
What does the finder ask?
- 01
Where do your assets live?
Tick every place that holds a meaningful share of your estate.
- 02
Can you install agents on your devices?
Think about change control, device owners and fragile systems.
- 03
What state is your CMDB in?
CMDB means configuration management database.
- 04
How many teams own assets?
Count the teams that buy, run or answer for assets.
- 05
How much compliance pressure do you face?
Audits, regulators and customer questionnaires all count.
- 06
What do you already run?
Pick the one that best describes what you would build on.
Example: a company with servers, cloud workloads and remote laptops, agents on some devices, a CMDB nobody trusts, two to four teams owning assets, periodic audits and many tools that disagree.
Start here
CAASM aggregation
First vendors by fit
runZero
Which vendors does the finder cover?
- Full bar: described on the vendor's pages we read
- Hatched bar: described with a condition (another product, a higher tier, or part of the approach)
- Stub: not in our sources (it may exist; we did not find it)
| Vendor | Approaches | How it collects | CMDB | Public price |
|---|---|---|---|---|
| Armis Centrix | Offers its own agent: Not in our sourcesWorks without new agents: Matches | Matches | No price on armis.com. | |
| Axonius | Offers its own agent: Not in our sourcesWorks without new agents: Matches | Matches | Published: device-based pricing on unique, correlated devices, with tiers from under 500 devices to 10M+ and volume discounts in every tier. | |
| Censys ASM | Offers its own agent: Not in our sourcesWorks without new agents: Matches | Matches | ASM: contact sales. | |
| JupiterOne | Offers its own agent: Not in our sourcesWorks without new agents: Matches | Not in our sources | Published: Small-Market $25,000 a year; Mid-Market $50,000 for 12 months up to 200,000 data points; Enterprise $100,000 for 12 months up to 400,000 data points; custom above 1 million data points. | |
| Lansweeper | Offers its own agent: MatchesWorks without new agents: Matches | Matches | Published, billed annually: Starter from €270 a month (2,000 assets, one installation, service desk ticket-enrichment integrations only); Pro from €474 a month (2,000 assets expandable to 9,000, up to three installations, all integrations); Enterprise custom from 10,000 assets with full API access; free up to 100 assets after a 14-day trial. | |
| Microsoft Defender EASM | Offers its own agent: Not in our sourcesWorks without new agents: Matches | Not in our sources | Billed through Azure on billable assets (approved host:IP combinations, domains and IP addresses) after a 30-day free trial. | |
| Qualys CSAM | Offers its own agent: MatchesWorks without new agents: Not in our sources | Matches | Not published | |
| Rapid7 Surface Command | Offers its own agent: Not in our sourcesWorks without new agents: Not in our sources | Not in our sources | No amounts published. | |
| runZero | Offers its own agent: Not in our sourcesWorks without new agents: Matches | Matches | Published: Community Edition free for 100 or fewer assets with 30-day retention; runZero Platform starts at $5,000 with 3-year retention; free 21-day trial. | |
| Tenable One | Offers its own agent: Not in our sourcesWorks without new agents: Not in our sources | Not in our sources | Attack Surface Management: demo request only. |
Why do my tools all report a different number of assets?
Every tool counts what it can see. The EDR console counts devices with its agent, the identity provider counts accounts, the cloud console counts workloads, the CMDB counts what someone recorded, and a network scan counts what answered. None of them is wrong, and none of them is the inventory. The five approaches differ in how they settle that: by reading all of those tools and merging the records, by collecting again with their own agents or scans, by looking from outside, by making one record authoritative, or by starting from what is exposed. Most estates end up combining two of them.
Vendors whose pages describe merging records from several sources: Axonius, Rapid7 Surface Command and runZero. Partly: Armis Centrix, JupiterOne, Lansweeper and Tenable One.
How is this different from a ranking?
We do not score or rank vendors. The finder applies published rules to your answers: first to weigh the five approaches, then to check each vendor's published facts against your estate. Two teams with different answers will see different orders, and vendors with the same fit are shown as equals. The rules are the same for every vendor and are written out on How matching works.
Where to go next
- CAASM finder
Answer six questions
- CAASM aggregation
What CAASM aggregation does, and where it stops
- Asset census
Put two to five vendors' facts side by side
- Asset terms
Plain definitions of the terms vendors use
Questions people ask
What is CAASM?
Cyber asset attack surface management: tools that connect to the security and IT systems you already run, merge what each one reports about an asset into one record, and show the gaps, such as a laptop with no EDR agent or a cloud workload missing from the CMDB. It is one of five approaches the finder weighs.
Is CAASM the same as EASM?
No. EASM (external attack surface management) looks at your organisation from the internet to find exposed assets. CAASM works from the inside, through the tools you already run. Some products, such as Rapid7 Surface Command, describe both.
Does this site rank asset inventory tools?
No. There are no scores, totals or winners. Vendors are listed alphabetically, or in order of fit to your quiz answers, and equal fits are shown as equals.