--- title: "What is Asset Discovery?" canonical: "https://ai-docs.certero.com/space/Resources/185041419/What%20is%20Asset%20Discovery%3F" format: markdown --- ## Key takeaways - **Asset Discovery** is the automated process of identifying all IT assets across an organization — hardware, software, SaaS, and cloud - Modern discovery combines six methods in parallel: **agent, agentless, network, browser, IdP, and cloud API** - SSO-only discovery misses Shadow IT by design; full visibility requires browser-level telemetry alongside IdP connectors - Embedded AI features (Microsoft 365 Copilot, Salesforce Einstein, Notion AI, etc.) are now a distinct discovery problem from standalone AI tools - Discovery is the foundation of ITAM, SAM, SaaS Management, and Cloud Management — **you cannot manage what you cannot see** - **CerteroX** reconciles all six methods against a **35,000-application catalogue** with **200+ deep SaaS connectors** --- ## What is Asset Discovery? Asset Discovery is the automated detection and identification of IT assets across an organization's technology environment. Unlike manual inventory processes, asset discovery uses technology to find devices, software, applications, and cloud resources without relying on self-reporting or spreadsheets. Discovery answers the fundamental question every IT organization must answer: **What do we actually have?** --- ## Why Asset Discovery matters ### The visibility challenge Modern IT environments are complex and distributed: - Employees work from anywhere on multiple devices - SaaS applications are adopted without IT approval - Cloud resources spin up and down dynamically - Embedded AI features activate inside apps the organization already owns - Shadow IT proliferates across departments Without automated discovery, IT operates with incomplete information — leading to security gaps, compliance failures, and wasted spending. ### The business impact | Without Discovery | With Discovery | | --- | --- | | Unknown devices on network | Complete device inventory | | Unlicensed software | Accurate Effective Licence Position (ELP) | | Hidden SaaS subscriptions | Full SaaS visibility | | Cloud cost surprises | Predictable cloud spending | | Embedded AI features unknown | AI inventory for governance | | Failed audits | Audit-ready documentation | --- ## The six discovery methods No single method sees everything. A complete discovery practice runs six methods in parallel and reconciles the output. ### 1. Agent-based discovery Software agents installed on endpoints collect detailed information: - Hardware specifications - Installed software and versions - Usage data and last logon - Configuration details **Best for:** Endpoints you control (corporate laptops, desktops, servers) **Platforms:** Windows, macOS, Linux ### 2. Agentless discovery Remote scanning without installed software: - **WMI (Windows):** Query Windows machines remotely - **SSH (Linux/Unix):** Secure shell access for system information - **SNMP:** Network device discovery - **VMware/Hyper-V APIs:** Virtual machine inventory **Best for:** Servers, network devices, environments where agents aren't practical ### 3. Network discovery Scanning network segments to identify connected devices: - IP address scanning - MAC address detection - Port and service identification - Device type classification **Best for:** Finding unknown devices, IoT, and rogue hardware ### 4. Browser-based discovery Extensions that detect web application usage: - Chrome, Edge, Firefox extensions - Capture SaaS and web-app access at URL level - Track actual usage, not just authentication - Discover Shadow IT and Shadow AI in real time — **the only method that sees apps outside SSO** **Best for:** SaaS applications, Shadow IT, standalone AI tools, browser-based work ### 5. Identity Provider (IdP) connectors Integration with authentication systems: - **Entra ID (Azure AD):** Microsoft ecosystem apps - **Okta:** SSO application inventory - **Google Workspace:** Google ecosystem apps **Best for:** SSO-enabled applications, the sanctioned baseline **Limitation:** IdP connectors only see apps federated through SSO. Shadow IT is, by definition, not federated — so IdP-only discovery misses it. Browser-based discovery is the complement. ### 6. Cloud connectors Direct integration with cloud platforms: - **AWS:** EC2, S3, RDS, Lambda, and 200+ services - **Azure:** VMs, storage, databases, App Services - **Google Cloud:** Compute, storage, and services - **Oracle Cloud Infrastructure (OCI):** compute, storage, database, autonomous services - **Kubernetes:** container workloads **Best for:** Cloud infrastructure, multi-cloud environments, serverless --- ## What gets discovered ### Hardware assets - Desktops and laptops - Servers (physical and virtual) - Mobile devices - Network equipment (switches, routers, firewalls) - Printers and peripherals - IoT devices ### Software assets - Operating systems and versions - Installed applications - Software versions and patch levels - Licence-relevant information (metrics, editions, components) ### SaaS applications - Enterprise SaaS (Microsoft 365, Salesforce, Workday, ServiceNow, Adobe CC) - Shadow SaaS (credit-card subscriptions, free-tier sign-ups) - AI-first tools (ChatGPT, Claude, Gemini, Perplexity, domain-specific GenAI) ### Embedded AI features Generative AI inside sanctioned apps is a distinct discovery category: - Microsoft 365 **Copilot** (Word, Excel, Outlook, Teams) - Salesforce **Einstein** - **Notion AI** - **Adobe Firefly** in Creative Cloud - **Atlassian Intelligence** (Confluence, Jira) - ServiceNow **Now Assist** - Zoom **AI Companion** - Google Workspace **Gemini** Feature-level discovery requires deep in-app connectors pulling admin configuration and usage — not just app-level inventory. ### Cloud resources - Virtual machines and instances - Storage volumes and buckets - Databases and data services - Containers and Kubernetes workloads - Serverless functions - Cloud-native AI services (Azure OpenAI, AWS Bedrock, Vertex AI) --- ## Asset Discovery vs Asset Inventory | Discovery | Inventory | | --- | --- | | Finding assets | Recording assets | | Automated detection | Structured database | | Point-in-time or continuous | Ongoing repository | | Answers "What exists?" | Answers "What do we own?" | **Key insight:** Discovery feeds inventory. Without discovery, your inventory relies on manual data entry and quickly becomes inaccurate. --- ## How CerteroX delivers Asset Discovery **CerteroX** runs all six discovery methods in parallel and reconciles the output against a unified asset record. The discovery layer feeds **CerteroX ITAM**, **CerteroX SAM**, **CerteroX SaaS Management**, **CerteroX Cloud Management**, and **CerteroX AI Management**. ### Discovery capabilities **Endpoint discovery** - Windows agent (detailed hardware, software, usage, metering) - macOS agent - Linux agent - Agentless options (WMI, SSH) **SaaS discovery — three-method stack** - Browser-extension telemetry (Chrome, Edge, Firefox) — sees every SaaS URL regardless of SSO - IdP connectors (Entra ID, Okta, Google Workspace) - **200+ deep SaaS connectors** pulling licence, activity, and configuration data from inside the major apps - All reconciled against a **35,000-application catalogue** **Cloud discovery** - AWS, Azure, Google Cloud, Oracle Cloud connectors - Kubernetes connector - FOCUS-aligned billing ingestion (AWS, Azure, OCI native; GCP on roadmap) **Network discovery** - SNMP device discovery - Network scanning - VMware / Hyper-V integration **Embedded-AI discovery** - Feature-level visibility inside Microsoft 365, Salesforce, Notion, Atlassian, ServiceNow, Zoom, Adobe, Google Workspace — the apps most enterprises already own - Usage, configuration, and policy alignment surfaced alongside the app record ### Typical results Industry research and Certero customer reports consistently find that organizations discover **substantially more SaaS applications** than IT expected at the start of the programme — ratios of **3–5× the initial IT-known count** are commonly cited. Shadow AI adds further surface area beyond that, particularly when embedded-AI features are included. ### Recognition - **#1 rated** on Gartner Peer Insights for SAM Tools - **Four-time Gartner Customers' Choice** (2019, 2020, 2021, 2024) - **97% of customers** recommend Certero - **Oracle Certified Partner** — the only ITAM/SAM vendor with this accreditation --- ## Frequently asked questions ### How often should discovery run? Continuous discovery is ideal for dynamic environments. Practical cadence: **real-time or hourly** for SaaS and cloud resources (they change fastest), **daily** for endpoints, **weekly** for stable infrastructure. A capable tool runs continuous discovery with no manual cycle required. ### What is the difference between Asset Discovery and Asset Inventory? **Discovery** is the automated detection of what exists in the environment. **Inventory** is the structured record of what is managed. Discovery feeds inventory. Without discovery, inventory is a manual, spreadsheet-based snapshot that drifts from reality within weeks. With discovery, inventory is always current because it is continuously fed from the environment. ### Does SSO-based discovery give complete SaaS visibility? No. SSO / IdP discovery only sees apps federated through the identity provider — which is the sanctioned baseline, not the full portfolio. Apps users sign up for with work email outside the IdP, free-tier tools, personal-productivity apps used for work, and many AI tools without enterprise SSO all sit outside IdP visibility. Complete discovery needs **browser-extension telemetry** and **deep in-app connectors** alongside the IdP. ### How do you discover embedded AI features inside apps we already own? Embedded AI — Microsoft 365 Copilot, Salesforce Einstein, Notion AI, Atlassian Intelligence, ServiceNow Now Assist, Zoom AI Companion, Adobe Firefly, Google Gemini — is a distinct discovery problem from standalone AI tools. The app is sanctioned; the AI feature may or may not be. Discovery needs **feature-level** visibility, meaning deep in-app connectors pulling admin configuration and usage. App-level discovery alone does not surface this. ### Does discovery cover cloud-native services (serverless, databases, containers)? Yes, if the tool uses cloud-platform APIs rather than only network scanning. Serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions), managed databases, container workloads (Kubernetes, ECS, AKS, GKE), and platform services all appear via direct API integration with the cloud provider. ### Does discovery require network changes? Agentless discovery may require firewall rules for WMI / SSH / SNMP traffic. Agent-based discovery only needs outbound connectivity from the endpoint. Cloud connectors use API access (typically outbound HTTPS with a service principal / IAM role). Browser extensions need browser-management deployment through existing MDM / MBM tooling. ### Can discovery detect Shadow IT? Yes — but not through IdP / SSO alone. **Browser-based discovery** is the method specifically designed for Shadow IT. It sees every SaaS URL a user visits, whether the app is federated through SSO or not. Combined with credit-card / expense-report integration, it produces the most complete Shadow-IT inventory available. ### How accurate is automated discovery? Automated discovery is significantly more accurate than manual inventory because it captures what actually exists rather than what people remember. Accuracy depends on two factors: **method coverage** (hardware needs agent or network; SaaS needs browser + IdP + deep connectors; cloud needs API) and **catalogue quality** (normalising raw discovery data into products and publishers). A catalogue of 35,000+ applications is a practical floor for enterprise SaaS recognition. ### What about privacy — what data does discovery collect? Competent discovery tools focus on **what applications run**, not **what users do inside them**. Screen content, keystrokes, and personal communications are not collected. Application-level usage (which apps, when, by whom) is collected and subject to the organization's data-protection policy. GDPR, sector-specific rules, and regional regulations apply. ### How long does an asset discovery programme take to deliver first results? For endpoints and cloud infrastructure: **hours to days** — deploy agents, grant cloud API access, watch the inventory populate. For full SaaS coverage (browser extension rollout, IdP integration, deep connectors): **weeks** to converged inventory. The tool is rarely the bottleneck; enrollment and catalogue normalisation drive the timeline. ### Can discovery handle BYOD, VDI, and terminal-services environments? Yes. BYOD typically relies on browser-extension discovery and network-based detection — agent installation on personal devices is usually not appropriate. VDI (Citrix, AVD, Omnissa Horizon) and terminal services need user-aware metering that tracks individual sessions within a multi-user OS image. A capable discovery tool handles all three. ### What about IoT, OT, and specialist hardware? IoT and OT (operational technology — industrial control, medical devices, building management) typically show up via **network discovery and SNMP**, not through agents. Managing these asset classes is increasingly part of ITAM remit as more OT devices become network-connected and part of the attack surface. --- ## About Certero Certero is an independent software vendor specialising in IT Asset Management, Software Asset Management, SaaS Management, Cloud Management, and AI Management. The **CerteroX** product family shares an asset record across all products so discovery data feeds every use case — ITAM, SAM, SaaS, Cloud, AI — without re-running discovery per product. Certero is the **only four-time Gartner Customers' Choice** for SAM Tools (2019, 2020, 2021, 2024), **#1 rated** on Gartner Peer Insights, an **Oracle Certified Partner**, and a **FinOps Foundation member** with **FinOps Certified Platform** designation. --- ## Related resources - [What is IT Asset Management (ITAM)?](/space/Resources/181731353) - [What is Software Asset Management (SAM)?](/space/Resources/181436474) - [What is SaaS Management?](/space/Resources/181698617) - [What is Shadow IT?](/space/Resources/181436495) - [What is Shadow AI?](/space/Resources/184909854) - [What is a CMDB?](/space/Resources/184909957) - [CerteroX ITAM overview](https://www.certero.com/solutions/itam/) --- *Last updated: April 2026*