Every device, account, cloud resource and data store your integrations can see — one record per asset.
It builds itself from the integrations you already run, merges every tool's view of the same asset into one record, and never mistakes "unreported" for "no". Nothing to create. Nothing to maintain. Populates on your next sync.
Start Free Book a Demo
4.8/5 across 223 reviews on SourceForge · #1 vCISO platform on G2, Summer 2026 · Early Access
You already built it. You just can't see it yet.
Asset Inventory is derived, not maintained.
It fills itself
Every evidence collection that returns an asset also feeds the inventory — on the same sync that gathers your automated compliance evidence. Connect an integration and it populates on the first sync; as assets are decommissioned it empties itself.
One record per real asset
A laptop enrolled in your MDM that also runs your EDR agent and gets swept by your vulnerability scanner is one device with three sources, not three rows. Merging is deterministic: serial number, email, cloud resource ID.
Unreported is not "no"
Every posture field is Yes, No or Unreported. A device showing Unreported for disk encryption is not counted as unencrypted — nothing has told you about it. Filter to Unreported and you find gaps in your tooling, not your controls.
Every count appears twice: the large number is logical assets, the line beneath it is how many provider records were merged to produce them. When two tools disagree, the source closer to the asset wins — per field — and a lower-precedence source still fills in anything the higher one never reported.
Endpoints, identities, infrastructure and data
An integration appears only in the lists it can actually speak to. Connecting an MDM populates Devices; it will never populate Cloud.
Devices
Laptops, desktops, servers and other endpoints — serial number, OS, disk encryption state, MDM compliance, critical CVE counts. Fed by MDM and endpoint management, EDR, vulnerability scanners and network asset intelligence.
People
User and service accounts — email, MFA state, privileged status, last sign-in. Fed by identity providers, directories and cloud providers.
Cloud
Compute and infrastructure resources — resource type, region, public exposure. Fed by cloud providers.
Data stores
Databases, buckets and other stores holding data — type, region, public exposure, encryption at rest. Fed by cloud providers.
Ten posture gaps, worst first
The overview surfaces every non-empty gap across all four inventories; each links straight to the filtered list that produced it.
Coverage gaps only fire for tools you actually have. "No EDR" stays silent until you connect an EDR, and "Not in MDM" until you connect an MDM — so you never open the page to a wall of red for products you never bought. Counts are asset counts, not occurrence counts: "Critical CVEs 11" means eleven devices carry at least one critical CVE.
Every view is a filter, and every filter is a link
Stat cards are filters
The cards along the top of each list are that inventory's exception counts. Click one to filter to exactly what it counted; click again to clear.
Shareable by URL
Every filter lives in the URL, so a filtered view is a link. Send a colleague "devices with no EDR" and they see exactly what you saw. Filter by environment, provider, tri-state posture, or search by name, email, serial and hostname.
Every source, on the record
Open any asset to see the resolved value for each field plus one card per source: that provider's identifier, first seen, last collected, and a click-through to the underlying evidence collection.
Assets by source
See which integration is telling you about what, with each cell linking into that provider's slice of the list — alongside a coverage summary of which security roles you have connected and which you don't.
What you bought, and what it's actually protecting
RealCISO keeps both, because they answer different questions.
Security Inventory
A point-in-time record of the security products you have purchased and the controls they cover — the coverage claim, curated by you, snapshotted on a cadence you choose.
Asset Inventory
The live list of the assets those products are protecting, built from what your integrations actually report — the ground truth the claim runs against.
Retired, not deleted
When a sync stops seeing an asset, the record is marked retired with the date it was last seen. A merged asset is retired only once every source has stopped reporting it; retired assets are hidden by default, excluded from every count, and removed 90 days after last seen. If a provider reports it again, it comes straight back.
Tests never change your control assessment
Integrations collect evidence. Automated tests run against that evidence and return pass or fail. Then they stop. A test result appears on the control page and is recorded in its history, but the control status stays exactly where you set it until a person changes it. A test can only see what is connected — if a test could set your control status, the platform would be telling you your MFA is compliant while fifty people sit on a local directory it has never heard of. A test result is an input to a judgment, not a substitute for one. How integrations work →
Asset Inventory FAQ
What's the difference between an asset inventory and a security inventory?
Security Inventory is the point-in-time record of the security products you have bought and the controls they cover — the coverage claim, curated by you. Asset Inventory is the live list of the assets those products are actually protecting, built from what your integrations report — the ground truth the claim runs against. RealCISO keeps both because they answer different questions.
What does "unreported" mean in an asset inventory?
Every posture field is tri-state: Yes, No, and Unreported. A device showing Unreported for disk encryption is not counted as unencrypted — it is a device nothing has told you about. Filtering to Unreported finds gaps in your tooling rather than gaps in your controls.
How are assets from different tools merged into one record?
Deterministically: serial number for devices, email for people, cloud resource ID for cloud resources. A laptop in your MDM that also runs your EDR agent and is swept by your vulnerability scanner is one device with three sources. When two tools disagree, the source closer to the asset wins, field by field — your device manager knows more about a laptop than the scanner that swept it once — and a lower-precedence source still fills in anything the higher one never reported. Data stores are not merged across providers.
Do I have to build or maintain the inventory?
No. There is no importer, no CSV, and no list to keep current. Every evidence collection that returns an asset feeds the inventory on the same sync that collects your automated compliance evidence. Connect an integration and it populates on the first sync; as assets are decommissioned it empties itself — retired records are kept for 90 days, then removed.
Why might a device show "No EDR" when we have one?
The exception only fires once an EDR source is connected, and only for devices that source doesn't report. If your EDR is a tool RealCISO doesn't collect from — or is built into a platform whose integration collects device management only — the device will show Unreported or No EDR. Connect an EDR source RealCISO reads, or treat the count as a coverage question rather than a control finding.
Go deeper on any capability
Where the inventory comes from and what it feeds.
See what your tools can — and can't — see
Asset Inventory sits at the organization level and spans every environment you have access to. If it's empty, connect an integration from Environment → Settings → Cloud Integrations and it populates on the first sync.
Start Free Book a Demo