SHEET 07 · HOW INVENTORY WORKS · LESSON 3 OF 3 · SURVEY DATE: SEPTEMBER 2026
How to Read an Asset Coverage Gap
By Asset Inventory Ranked research team · 17 September 2026 · 2 min read
Bottom line
A coverage gap is an asset that exists but is missing something it should have: a CMDB record, an EDR agent, an owner or a place in the scanner's scope. Reading gaps well means asking which source proves the asset exists, which control is missing and who owns the fix.
Last updated 17 September 2026
What counts as a coverage gap?
- Missing from the system of record: the asset reports in to other tools but has no CMDB record.
- Missing a control: no EDR agent, no endpoint management enrollment, or outside the vulnerability scanner's scope.
- Missing an owner: nobody is accountable, so nobody receives the ticket.
- Missing from identity governance: a service account or API key that no review covers.
How do you prove the asset is real?
A gap is only real if at least one source sees the asset without relying on the missing control, and saw it recently. A laptop that appears only in a directory object last updated a year ago is probably retired, not unprotected. Check that the record is not a duplicate created by weak matching before opening a ticket.
Which gaps should you handle first?
Rank gaps by what the asset is and what is missing. Servers and internet-facing systems without an EDR agent usually come before a laptop missing a CMDB field. Asset criticality rules, based on business unit, environment and data, make that ranking repeatable instead of a judgement call each week.
How is this different from our coverage grid?
The coverage grid is a vendor-level view: which asset classes each tool documents covering, from its own public pages. An asset-level gap is about your estate: which of your assets lack a control. The grid helps choose a tool; the gap list is what the tool produces once it is running. On the grid, identities are the hardest class: two of seven tools document full coverage.