Protoxol
Request a demo
Platform Modules Plans Blog Request a demo
INV · Module

Asset inventory

Ground truth across cloud, on-prem and identity.

Compare with 5 alternatives ↓

Overview

What INV does.

Asset Inventory is the ground-truth layer the rest of Protoxol stands on. It reconciles signal from EDR agents, NDR sensors, cloud APIs, IdP and VM scanners into a single record per asset — with an owner, a tier, a service, a blast radius and a lifecycle state. When the EDR sees a new host or VM scanner sees a new IP, it shows up here in minutes, not weekly CMDB syncs.

Features

Inside INV.

Multi-source reconciliation

EDR, NDR, IdP, cloud, VM — every source contributes to one record.

Owner & service mapping

Every asset has an owner. Every alert routes to the right human.

Drift detection

Unmanaged endpoints, shadow VMs, unknown IPs flagged within minutes.

Lifecycle tracking

Onboarding, active, decommissioning, retired — state changes audited.

CMDB sync

Bidirectional sync to ServiceNow, Jira Insight or your CMDB of choice.

Use cases

Where INV earns its keep.

Shadow IT discovery

Find devices and SaaS apps your IT team didn't approve.

M&A integration

Build an inventory of the acquired environment in days, not months.

Asset lifecycle audits

Prove decommissioning. Catch zombie assets before they're attacked.

Technical specs

INV under the hood.

Sources Agents, cloud APIs, IdP, VM, DHCP
Reconciliation Real-time with confidence scoring
Asset attributes 60+ default fields, fully extensible
Sync targets ServiceNow, Jira, custom REST

Figures from internal testing; test method and date to be published.

Compare alternatives

Protoxol Asset inventory compared with five alternatives

An asset inventory answers a question that comes back with every alert: what is this machine, who owns it and what else does it touch. This comparison sets the Protoxol inventory module against five relevant alternatives. Mind the scope: some are discovery platforms for IT, OT and IoT, some aggregate data from your tools, and Protoxol INV is a module that reconciles what the other Protoxol modules report. They are not equivalent products, and the table says so row by row.

What Protoxol offers

Comparison table

Each cell shows the status and the scope. Statuses are explained below the table.

Show alternative:

Scroll the table sideways to see every column.

Protoxol Asset inventory compared with five alternatives
CriterionProtoxol Asset inventoryLansweeper (cloud platform, IT Asset Discovery)Axonius Asset Cloud (Cyber Asset Attack Surface Management)runZero PlatformArmis Centrix for Asset Management and SecurityQualys CyberSecurity Asset Management (CSAM)
Discovery method (agent / agentless) Depends on setupBuilds the record from EDR agents, NDR sensors, cloud APIs, IdP, VM and DHCP signal. No standalone scanner is described. AvailableThree routes: Network Discovery (sensors, with or without credentials), IT Agent and API-based Cloud Discovery. ↗ Needs integrationNo agents or scanners: API adapters into EDR, cloud, SaaS, identity and other tools. ↗ AvailableNo agents or credentials: its own active scanning, passive discovery by traffic sampling and API integrations. ↗ AvailableCombines integrations with existing tools and network traffic analysis with deep packet inspection. Agent requirement not stated. ↗ Depends on setupCloud Agent, scanner, passive sensor and connectors. The agent carries most of it; the rest depends on which sensors you license. ↗
Hardware and software detail Not confirmedThe page mentions extensible asset fields but does not detail hardware or installed-software inventory. AvailableEnriches each asset with hardware specifications and installed-software inventory. ↗ Needs integrationDevice and software data come from the connected tools, normalised into a common schema. ↗ Depends on setupIdentifies device, OS and services by network fingerprint. Installed software comes via integrations and is not described directly. ↗ Depends on setupEnriches records with user, classification and location; software detail depends on asset type and source. ↗ AvailableNormalised hardware and software inventory, with end-of-life and end-of-support tracking and authorised software. ↗
Managed and unmanaged assets AvailableDrift detection flags unmanaged endpoints, shadow VMs and unknown IPs against what the inventory already knows. AvailableNetwork Discovery finds managed and unmanaged devices, including shadow IT. ↗ AvailableFlags devices missing coverage (EDR, scanner, SSO) and ephemeral or unmanaged assets as far as adapters see them. ↗ AvailableBuilt for what has no agent: finds unmanaged and unknown assets across IT, OT and IoT. ↗ AvailableInventory of managed and unmanaged assets, including those outside the corporate network. ↗ AvailableThe Cloud Agent can act as a passive sensor (CAPS) to detect unmanaged devices; it needs agents already deployed. ↗
Scope: IT, OT/IoT and cloud Depends on setupCovers endpoint, network, cloud and identity depending on active modules and sources. OT/IoT/ICS coverage is not described. AvailableIT, OT, IoT and cloud (AWS, Azure, GCP), with IT and OT sensors and passive monitoring of mirrored traffic. ↗ Needs integrationDevices, identities, cloud, SaaS and IoT/OT through connectors. No sensor of its own on the network. ↗ AvailableIT, OT, IoT, cloud, mobile and remote. Passive mode covers fragile OT where scanning is not allowed. ↗ AvailableIT, IoT, cloud, virtual, and OT and IoMT per the brief. Exact protocol coverage is not detailed. ↗ Depends on setupAgent-covered IT and external EASM. Detects IoT/OT passively; cloud workloads need the TotalCloud module. ↗
Update frequency Depends on setupReconciles as each source reports. The real interval depends on the source and is not documented. Depends on setupIT Agent scans every 24 hours by default, adjustable. Cloud scans can be scheduled. ↗ Depends on setupEach adapter pulls data at configurable intervals; discovery runs on a schedule rather than streaming. ↗ Depends on setupRecurring scan tasks plus continuous passive discovery. Community allows 10 recurring tasks; Platform, unlimited. ↗ Depends on setupDescribes a continuous, always-on inventory. The brief publishes no update intervals. ↗ Depends on setupQualys describes continuous tracking through agents and sensors. No concrete interval appears on the pages opened. ↗
Asset identity and deduplication AvailableMerges several sources into one record per asset with confidence scoring. Matching rules are not published. AvailableA reconciliation engine merges the same device seen through different routes into one record. ↗ AvailableCorrelation engine on stable fields (MAC, hostname, serial), with per-source confidence and field provenance kept. ↗ AvailableMerges assets across sources and shows the field, value and task that triggered each merge. ↗ AvailableAggregates, deduplicates and normalises data from several tools before pushing it to the CMDB. ↗ Not confirmedThe pages opened do not explain the inventory's correlation and deduplication rules.
Relationships and integrations (CMDB, EDR, cloud) AvailableSync to ServiceNow, Jira Insight or custom REST. The documented catalogue is short, with no list of third-party EDR connectors. Needs integrationSyncs to ITSM, CMDB and security tools, for example ServiceNow and Jira Service Management. ↗ AvailableOver a thousand bidirectional adapters: ServiceNow, CrowdStrike, Tanium, Entra, AWS and more. ↗ Needs integration30+ inbound integrations: AWS, Azure, GCP, CrowdStrike, SentinelOne, Tenable, Rapid7 and ServiceNow as CMDB. ↗ Needs integrationHundreds of prebuilt integrations; enriches the CMDB and connects to network enforcement systems and SOC tools. ↗ Needs integrationBidirectional sync with the ServiceNow CMDB (Service Graph Connector) and connectors such as Active Directory or BMC Helix. ↗
Ownership and asset context AvailableEach asset carries an owner, tier, service, blast radius and lifecycle state, with audited state changes. Not confirmedOwner and service fields are not documented on the official pages. AvailableEach asset profile includes ownership details, installed agents, applications and IPs. ↗ AvailableAssigns owners per asset, manual or rule-based tags and asset criticality. ↗ Depends on setupAdds user, classification and location to the asset. Business-service ownership is not detailed in the brief. ↗ Depends on setupTags by function, environment, service and business criticality. A named-owner field is not confirmed. ↗
Use in incident investigation AvailableAlerts route to the asset owner, and the console lets you pivot from alert to asset, actor and host. Not confirmedThe pages opened do not describe an incident-investigation workflow on top of the inventory. Depends on setupLists incident response among its use cases; the Action Center runs actions, such as isolation, through adapters. ↗ Depends on setupQueryable data and guided remediation to locate exposed assets. No case workflow of its own is described. ↗ AvailableNetwork activity timeline of a device before, during and after an incident, with IOC detection. ↗ Needs another productQuarantining suspicious devices belongs to Qualys Patch Management, not to the inventory itself. ↗
Risk and vulnerability context Depends on setupJoins VM findings, EDR alerts and identity activity to the asset. Needs the VM module active. Depends on setupShows CVE, CVSS, EPSS and exploitation signals (CISA, MSRC, NVD, VulnCheck). Licence tier not confirmed. ↗ Needs integrationAggregates findings from Qualys, Tenable, Rapid7 and others and joins them to asset context. It does not scan. ↗ AvailableDetects exposures with templates and scores risk per asset; also imports scanner data such as Tenable. ↗ AvailableRisk factors covering CVEs and network-observed risks (NTLMv1, plaintext credentials), with remediation recommendations. ↗ Depends on licenceTruRisk scoring with end-of-life, missing EDR and exposed ports; the full context leans on VMDR. ↗
Deployment model Depends on setupPlatform module: EU-hosted SaaS or self-hosted. Activated on the shared console; dependence on the platform core is not confirmed. Depends on setupCloud-hosted Site plus local sensors and hub (outbound HTTPS only). An on-premises edition also exists. ↗ AvailableAxonius-hosted SaaS or customer-hosted (on-premises or private cloud); a Gateway reaches internal sources. ↗ AvailableSaaS or self-hosted console (Platform only, with a support package) and light Explorers on each network. ↗ AvailableDelivered as a SaaS platform. ServiceNow says Centrix stays available standalone after the acquisition. ↗ AvailableQualys cloud service with Cloud Agents and virtual or hardware scanners and passive sensors. ↗
Licensing model Depends on licenceIncluded in Team and Enterprise, not Starter. Priced per protected endpoint by plan, by quote. AvailablePer-asset licence: the Free plan includes 100 fully detailed assets; non-billable assets do not count. ↗ Depends on licenceTiered by unique assets, with modules and SaaS hosting as extras (2024 G-Cloud document). Priced by quote. ↗ AvailableLicensed by asset count. Free Community up to 100; paid Platform by contract. ↗ Not confirmedLicence and metering unit are not published in the sources opened; treat it as a sales quote. Depends on licencePaid subscription on top of the free Global AssetView (included with VMDR). Metering unit not published. ↗

What each status means

Available
Native feature of the product or plan compared.
Needs integration
Works through a connector or a third-party product.
Depends on setup
Exists, but its scope depends on deployment or configuration.
Depends on licence
Only in a higher plan or as a paid add-on.
Needs another product
Covered by a different product from the same vendor.
In development
Announced or being built; not generally available.
Not confirmed
Not enough evidence. It does not mean “no”.

Five comparisons

One per product, naming the plan that was compared.

Lansweeper (cloud platform, IT Asset Discovery)

Plan or edition: Lansweeper cloud platform (Site) with Network Discovery, IT Agent and Cloud Discovery. The paid tiers could not be read; the cells describe the product documentation.

Lansweeper starts from the IT inventory: it discovers over the network without agents, adds a light agent for remote laptops and queries AWS, Azure and GCP through APIs. Each asset arrives with hardware, software and, depending on plan, vulnerability data. Protoxol INV does not scan on its own: it reconciles what its EDR agents, NDR sensors, cloud APIs, IdP and VM scanners already report, and ties that to alerts and owners. Lansweeper fits when you need the hardware and software at each site, OT included. INV fits if you already run other Protoxol modules. Condition: the IT Agent reports every 24 hours by default, so a new host can take a while to show up without a network scan.

Official source ↗

Axonius Asset Cloud (Cyber Asset Attack Surface Management)

Plan or edition: Axonius Platform: cyber asset management with adapters; additional modules depend on the contract. The cells describe asset management.

Axonius does not watch the network: it asks the tools you already own. Its adapters pull data from EDR, cloud, SaaS and identity, correlate it on MAC, hostname or serial number and keep which source supplied each field. That makes it strong when the question is which devices lack EDR or a scanner, or when the CMDB needs reconciling. The difference from Protoxol INV is origin: INV feeds on the platform's own modules and serves its alerts, while Axonius is vendor-neutral with a much wider catalogue. It fits when you already run many tools from different vendors. Condition: the inventory only sees what each adapter knows, and an asset absent from every source will not appear.

Official source ↗

runZero Platform

Plan or edition: runZero Platform (paid). The free Community Edition is limited to 100 assets. Dragos announced the acquisition on 21 September 2026.

If the problem is a network full of machines no agent reaches, runZero is the logical reference: it probes actively, listens passively for fragile OT and fills the gaps from integrations. Its asset merges show which field caused them, which helps when auditing duplicates. Protoxol INV starts elsewhere: it probes nothing itself and its value lies in joining what EDR, NDR, cloud and identity already see to owners and alerts. Pick runZero to map an unknown environment, a merger or an OT plant. Condition: Dragos announced it was buying runZero on 21 September 2026 and talks of folding it into its platform; confirm the roadmap and support with the vendor before you sign.

Official source ↗

Armis Centrix for Asset Management and Security

Plan or edition: Asset management and security module of the Armis Centrix SaaS platform. The cells follow the 2024 solution brief and the ServiceNow closing note; the product page could not be opened.

Armis is usually bought when the inventory has to come from traffic: cameras, medical equipment, sensors and PLCs that take no agent. Its engine classifies each device with behaviour profiles, resolves duplicates and feeds the CMDB, and it also spots network threats and suggests segmentation. Next to it, Protoxol INV is a much narrower module: it reconciles what other Protoxol modules report and claims no OT or medical coverage. Armis fits hospitals, industry or large campuses; INV fits if your asset state already lives in Protoxol. Condition: ServiceNow closed the Armis purchase on 20 April 2026, and licence and price could not be verified from the official sources opened.

Official source ↗

Qualys CyberSecurity Asset Management (CSAM)

Plan or edition: CSAM as a paid subscription of the Qualys Cloud Platform (with EASM as part of the module). Global AssetView, included with VMDR, is the free baseline and is not what is compared.

Qualys CSAM makes sense when the agent is already deployed and vulnerability management runs on Qualys. The same agent supplies inventory, finds unmanaged devices from traffic and scores risk with TruRisk, and the ServiceNow CMDB syncs both ways. EASM adds internet-exposed assets. Protoxol INV has no external scanner and no software end-of-life tracking, and its risk context needs the Protoxol VM module. In return, INV carries owner and service all the way to the alert. Qualys fits a large organisation that already has Qualys under contract; INV fits a team operating Protoxol. Condition: CSAM is paid and separate from the free Global AssetView; check what your subscription actually covers.

Official source ↗

When to choose Protoxol

  • You already run Protoxol EDR, NDR or VM and want every alert to arrive with owner, service and blast radius.
  • You need to spot unmanaged endpoints and shadow VMs against what Protoxol already sees, and sync it to ServiceNow or Jira Insight.
  • You prefer one asset model across inventory, VM findings and alerts, with EU SaaS or self-hosted.

When to consider something else

  • You have OT, IoT or medical devices with no agent and need active and passive discovery: runZero, Armis or Lansweeper's OT sensors fit better.
  • Your inventory must reconcile dozens of tools from different vendors and a large CMDB: Axonius has the widest adapter catalogue.
  • You need detailed IT hardware and software inventory with per-asset licensing: Lansweeper is built for that.
  • You already run Qualys VMDR with agents deployed: CSAM reuses that base and syncs the ServiceNow CMDB.

See the module in a demo

Questions about this comparison

01Do I need an agent to have an asset inventory?

It depends on the product. Axonius and runZero work without agents (API adapters, scanning or passive discovery); Qualys CSAM leans on its Cloud Agent; Lansweeper offers both routes. Protoxol INV is fed by the signal its EDR agents and NDR sensors already report.

02How are unmanaged assets detected?

Through network traffic or active scanning, or by comparing sources: what is on the network but has no EDR or scanner. runZero, Armis and Lansweeper run their own discovery; Axonius compares sources; Protoxol INV flags drift against what it already knows.

03What separates an IT inventory from a security inventory?

The IT one counts hardware, software and licences. The security one adds owner, exposure, control coverage and risk. Some products do both; check what your plan covers before comparing.

04Can Protoxol INV act as a CMDB?

It is not presented that way. The module page talks about syncing with ServiceNow, Jira Insight or REST, not replacing your CMDB. If you need OT discovery or to reconcile many third-party sources, consider another product.

Sources and review date

Reviewed on October 2, 2026. Reviewed by The Protoxol team.

Protoxol capabilities are based on the current commercial documentation on this site and were not technically validated in this review; anything undocumented is shown as “Not confirmed”. Vendor data comes from each vendor's public documentation on the date shown and may have changed.

Selection

See INV against your data.

Thirty minutes. Your environment. The modules that fit. No slideware.

Book a demo See pricing