Coverage gaps
Uncovered assets, identified and assigned.
Each tool sees only what it has installed or registered. By correlating all of them, CAASM identifies devices without EDR, servers that no scanner assesses, and internet-facing systems that are absent from every inventory.
Gap types
Five coverage gaps identified automatically.
| Gap | How it is identified | Why it matters |
|---|---|---|
| No EDR | The asset appears in the directory, the scanner, or the cloud, but has no EDR agent installed or active. | Unprotected devices are a frequent vector for undetected attacks. |
| No scan | The asset exists in the EDR, the CMDB, or the cloud, but no vulnerability scanner covers it. | The vulnerabilities of this asset are absent from the reports. |
| No owner | The asset has no responsible party recorded in the CMDB. | No one is accountable for remediating the vulnerabilities identified. |
| Shadow IT | CSURFACE sees the asset exposed on the internet, but it does not exist in any internal source. | It represents exposure outside the reach of the company's controls. |
| Stale record | The asset is listed in the CMDB, but no other source has identified it for weeks. | Stale records distort the inventory and the security metrics. |
No false positives
An unavailable source does not generate a false alert.
When the EDR connector loses access, many inventories begin to report hundreds of devices as "no EDR." The alert is false and undermines the team's confidence in the inventory.
In CAASM, the coverage of each asset has three states: covered, uncovered, and unknown. When a source stops responding, its assets are set to unknown, and the console identifies the connector that requires attention. A coverage gap is recorded only when there is evidence that protection is absent.
From identification to remediation
Each coverage gap generates an assigned action.
Identification
Correlation across sources runs continuously, with every synchronization.
Assignment
The gap is assigned to the owner recorded in the CMDB or, if there is none, to a triage queue.
Routing
A ticket can be opened in the responsible team's Jira or ServiceNow.
Confirmation
The gap is closed when the source confirms the protection, for example when the EDR agent is active.
Identify the uncovered assets in your organization.
During the demo, we connect your inventory sources and present the coverage gaps in your environment.