CAASM · Unified asset inventory
An asset inventory your team can rely on.
CAASM consolidates data from EDR, vulnerability scanners, CMDB, cloud, and directory services into a single inventory and identifies the assets that lack protection, vulnerability assessment, or an assigned owner. Each data point is shown with its source and collection date, and an unavailable source does not generate false alerts. Integrations are included.
The problem
Each tool maintains its own inventory, and the figures rarely agree.
When auditors request the asset list, the team exports spreadsheets from the EDR, the vulnerability scanner, the CMDB, and the cloud consoles and reconciles them manually. The same server appears under different names, devices without an agent are left out, and the list is outdated before it is complete.
CAASM performs this reconciliation automatically and continuously. The result is a reliable asset count and a clear list of the assets that remain uncovered.
How it works
Data from every tool, consolidated per asset.
Connectors collect data from each tool. CAASM determines which records correspond to the same asset and delivers an inventory that documents the origin of every data point.
Inventory accuracy
Accuracy based on evidence.
Many solutions promise a single source of truth without explaining how they achieve it. The table below presents three situations in which inventories commonly fail and how CAASM handles each of them.
| Situation | Typical outcome | How CAASM handles it |
|---|---|---|
| The EDR connector loses access | Hundreds of devices are reported as "no EDR," and the team loses confidence in the inventory. | The assets move to an unknown state and the console identifies the connector that requires attention. A coverage gap is recorded only when evidence supports it. |
| Two devices with the same name | The records are merged by name, and one of the devices disappears from the inventory along with its vulnerabilities. | Records are unified only on a strong identifier, such as an instance ID or agent ID. Blocking rules prevent incorrect merges, and every decision is logged. |
| Sources disagree on a data point | The most recent import prevails, with no record of where the value came from. | Each field displays its source and date, with priority given to the most reliable source for that type of data. |
Use cases
Applications of a reliable inventory.
Coverage gaps
A list of assets without EDR, vulnerability assessment, or an assigned owner, routed to the appropriate team for each case.
See coverage gaps →Audit and compliance
An exportable inventory with the origin of every data point and a change history, for PCI DSS 4.0 and ISO 27001.
Vulnerability prioritization
Each vulnerability is associated with the correct asset, including its owner, function, and internet exposure. Your team knows exactly whom to ask for the fix.
Incident response
When an alert is raised, the team can immediately identify the device's owner, the system it supports, the protection installed, and its exposure.
CMDB data quality
Identification of obsolete records and of assets in production that were never registered.
Mergers and acquisitions
Visibility into the acquired company's inventory and coverage before the networks are integrated.
Integrations included
Connectors included, with no per-connector fee.
Integrations are part of CAASM. Each tool is connected from the console with read-only access, without an integration project or custom development.
- Read-only. CAASM queries your tools without changing any configuration.
- Credentials in a vault. They are stored encrypted and never exposed in logs, error messages, or API responses.
- Customer isolation. Each company's data is kept in a dedicated database.
Audit
An asset inventory ready for audit.
Standards such as PCI DSS 4.0 and ISO 27001 (control 5.9, inventory of assets) require an asset inventory that is maintained and periodically reviewed. CAASM provides that inventory with the origin of every data point and a change history, so the compliance team can assess adherence.
- A complete, exportable inventory with the source and date of every data point.
- EDR and vulnerability scan coverage per asset.
- Assets without an owner and outdated CMDB records.
- A history of additions, changes, and removals for each asset.
With the platform
Broader coverage with the CSURFACE platform.
Assets exposed on the internet
External assets discovered and validated by CSURFACE are incorporated into the inventory, which brings to light shadow IT that internal tools do not know about.
Explore CSURFACE → + BeforeTHEMInternal network, OT, and IoT
Servers, workstations, network equipment, and automation devices identified by BeforeTHEM, including those that cannot run an agent.
Explore BeforeTHEM →Frequently asked questions
FAQ
What is CAASM?
CAASM (Cyber Asset Attack Surface Management) is the practice of managing assets through the tools a company already uses. Without requiring new agents or scanners, CAASM collects data from EDR, scanners, CMDB, cloud, and directory services, consolidates it into a single inventory, and identifies coverage gaps.
Do I need CSURFACE or BeforeTHEM to use CAASM?
No. CAASM operates with the tools your company already uses. CSURFACE and BeforeTHEM serve as additional sources when licensed.
Does CAASM work alongside the scanners and EDR we already use?
Yes. CAASM connects to the scanners, EDR, and CMDB your company already uses and consolidates the information from those tools. None of them needs to be replaced.
Are integrations billed separately?
No. Integrations are included in CAASM, with no per-connector fee.
Does CAASM change anything in my tools?
No. Access to your tools is read-only.
How does CAASM know two records are the same asset?
It relies on trusted identifiers, such as the cloud instance ID, the EDR agent ID, or the serial number. Without a strong identifier in common, the records remain separate. Similar names are not sufficient to unify them.
See the actual inventory of your organization.
During the demo, we connect your organization's inventory sources and present the consolidated count and the coverage gaps.