How to Find Devices Missing an EDR Agent

Why can't the EDR console answer this question?

Every EDR product lists the devices that run its agent. A device without the agent is, by definition, not on that list. The same is true of endpoint management, the vulnerability scanner and the CMDB: each knows its own population and nothing else. The question "which devices have no EDR agent" can only be answered by comparing lists.

The gap is measurable. On 7 September 2026 Lansweeper published an analysis of several million endpoints across 30,000 organizations. It reported that 96% of endpoints had some protection, but only 68.1% ran full EDR or next-generation antivirus, and that 7.6% of servers had no detected protection, against 2.6% of laptops. Those figures describe Lansweeper's own customer data, not every estate, but they suggest where to look first: servers.

Step 1: Which sources should build the device list?

Use every source that sees devices without relying on the EDR agent:

• Endpoint management (MDM or configuration management) for enrolled laptops and servers.
• The directory or identity provider for computer objects and the users who sign in to them.
• Cloud accounts for virtual machines, including short-lived ones.
• Virtualization platforms for guests that never enrolled anywhere.
• Network discovery for devices that no management tool knows about.

Network discovery matters most for that last group. runZero documents discovery with no agents, credentials or appliances. Lansweeper documents agentless scanning with passive detection on by default. Armis documents agentless, passive discovery across IT, OT and IoT devices.

Step 2: How do you match devices across sources?

Match on hardware identifiers first, serial number and MAC address, then hostname, and on the instance ID for cloud virtual machines. Hostnames alone produce false matches after reimaging and renaming. Keep one row per physical or virtual device, with a column for each source showing whether it reports that device.

This is the correlation work that aggregation platforms automate. Axonius reconciles what each connected tool reports into one record per asset through its adapters. JupiterOne maps entities and their relationships across its integrations in a security graph. With either approach, check a sample of merged records by hand before trusting the totals.

Step 3: Which gaps are real?

Not every unmatched device needs an agent. Before opening tickets, filter out:

• Devices the EDR product does not support, such as printers, network gear and many OT devices. These need a different control, and the inventory should record which one.
• Records that are stale in a source, such as a directory object for a laptop retired months ago.
• Duplicates caused by weak matching in step 2.

What remains is the working list: supported devices that are active, recently seen and not reporting to EDR. Split it into three groups, because each has a different fix: agent never installed, agent installed but not reporting, and agent reporting under a different hostname from the other sources.

Step 4: Who fixes each gap?

Give each device an owner from the most reliable source for ownership, usually endpoint management or the directory. Then open a ticket in the service management tool where that team already works. ServiceNow, Jira Service Management and Freshservice are all targets that tools in our ranking document integrations for. Close the loop on the same record, so the next comparison shows the device as covered instead of opening a new ticket. Record the date each gap was opened and closed: the time to close is a useful measure of whether the process works.

How often should you repeat the check?

Continuously if the tooling allows, and at least weekly. Agents stop reporting after updates, new servers are built from images that lack the agent, and cloud workloads start and stop within hours. A one-time audit clears the backlog; only a recurring comparison keeps the list short.

Which tools in our ranking answer this question directly?

Query and reporting is one of our seven criteria, weighted at 12%, and its test question is exactly this one: can a team ask which laptops have no EDR agent across all sources? JupiterOne scores 88 on that criterion and Axonius 86. Discovery-first tools such as runZero (68) and Lansweeper (64) are strongest at finding the devices in the first place, and hand the list to other systems for comparison. Many teams run one of each kind.

The ranking shows how the seven tools score on every criterion, and the coverage grid shows which of them document laptops and servers.