Active, Passive, Agent and API: How Asset Inventory Tools Find Assets

What does active scanning see?

Active scanning sends probes to a range of network addresses and records what answers: open ports, running services and enough detail to fingerprint the device. Its main value is finding devices no other tool knows about, including ones with no agent and no owner. runZero documents active scanning with no agents, credentials or appliances, and profiles each asset against nearly 1,000 attributes. Lansweeper and Device42 document agentless scanning, and ServiceNow Discovery documents agentless discovery of on-premises, cloud and container infrastructure.

The limits are reach and timing. A scan sees only the networks it can route to, and only at the moment it runs. A laptop on a home network is invisible to an office scanner, and a device that joins after the scan waits for the next one.

What does passive discovery add?

Passive discovery identifies devices from the traffic they already send, without sending anything to them. That matters on OT networks, where some industrial devices are fragile and should not be probed. It also runs continuously, so a new device appears as soon as it communicates. Armis describes agentless, passive discovery that captures network traffic continuously; it scores 88 on data freshness, the top data freshness score in our ranking.

runZero documents passive discovery for OT alongside its scans, and Lansweeper says passive detection runs by default. The limit is placement: a passive sensor sees only the segments whose traffic reaches it, and only devices that communicate.

When do agents make sense?

An agent is software installed on the device that reports its state. It sees detail a network scan cannot, such as installed software, the signed-in user and whether security tools are running, and it keeps reporting wherever the device goes. Lansweeper offers an optional IT agent for off-network laptops, and ServiceNow documents a unified agent for endpoints.

The trade-off is coverage. An agent reports only from devices where it is installed, so it cannot tell you about the device that never received it. That is why a device list built only from an agent's console cannot answer which devices are missing the agent; the EDR note walks through the fix.

What do API integrations contribute?

The fourth method reads other tools. Endpoint management, EDR, the identity provider, cloud consoles, vulnerability scanners, SaaS management and the CMDB each hold a list of what they manage. An aggregation platform pulls those lists through each product's API and correlates them. Axonius documents more than 1,200 adapters, JupiterOne more than 200 integrations and Oomnitza more than 1,500 data surfaces.

API integrations are the practical way to inventory SaaS apps and identities, which a network scan cannot see. Their freshness depends on each source and on how often each integration syncs, and every integration needs API access and credentials, which is the main setup cost.

How do the methods fit together?

• Active scanning and passive discovery find what exists on the networks you can reach, including unmanaged devices.
• Agents give depth on managed laptops and servers, wherever they are.
• Cloud APIs list workloads that never touch the corporate network.
• Identity and SaaS integrations cover accounts, service identities and applications.

No tool in our coverage grid documents all seven asset classes. Tools that discover assets themselves tend to score higher on deployment effort, and tools that aggregate many sources higher on source coverage. A discovery tool can also be one of the sources an aggregation platform reads: Lansweeper lists Armis among its integrations, and runZero lists integrations with CrowdStrike, Microsoft Intune and the major cloud providers.

What should you ask a vendor?

• Which of the four methods does the product use natively, and which through integrations?
• Which network segments need a scanner or sensor, and what does it need to run?
• How often does each integration sync, and can you change it?
• Which asset classes in your estate would the product not see?

Terms in this lesson

• Active scanning
• Passive discovery
• Agent
• Adapter
• Asset discovery
• Fingerprinting