SHEET 07 · HOW INVENTORY WORKS · LESSON 2 OF 3 · SURVEY DATE: SEPTEMBER 2026
How Asset Correlation Works
By Asset Inventory Ranked research team · 18 September 2026 · 2 min read
Bottom line
Correlation decides which records from different tools describe the same asset, merges them into one record and settles conflicts between them. It is what turns several partial lists into one inventory a team can trust.
Last updated 18 September 2026
What problem does correlation solve?
A laptop can appear in the endpoint manager, the EDR console, the directory, the vulnerability scanner and the CMDB, each time with slightly different details: a short hostname in one, a fully qualified name in another, two MAC addresses because of a docking station. Without correlation, that one laptop is five rows, and every count of assets or gaps built on those rows is wrong.
How are records matched?
Tools compare identifiers and decide how likely two records are to describe the same asset. Hardware serial numbers and MAC addresses are strong signals. Hostnames help but change after renaming and reimaging. IP addresses are weak because they are reassigned. Lansweeper documents deduplication on MAC address, serial number and hostname. runZero profiles each asset against nearly 1,000 attributes. For Axonius, reconciling what each connected tool reports into one record per asset is the core of the product.
What happens when sources disagree?
Once records are merged, their fields can conflict: two tools report different owners, or different operating system versions. A good tool shows each source's value and applies a rule, field by field, for which one wins. A weak one keeps whichever value arrived last, so the record changes every time a sync runs.
How do you test correlation in a trial?
Pick a sample of assets you know well, including a reimaged laptop, a renamed server and a cloud workload that was rebuilt. Check that each appears once, with the right owner and the right status. Then compare the asset count before and after correlation. A large drop usually means duplicates were merged, which is the point. Correlation and deduplication carry 18% of the score in our methodology.