Why discovery comes first
Every inventory, license count, and security policy assumes a complete list of what exists. That list is never complete by default. Employees plug in personal peripherals. Contractors bring their own laptops. Departments install software without a purchase order. Old equipment sits in a storeroom after its user has left. A spreadsheet updated by hand, whenever someone remembers, falls behind almost at once.
Discovery closes that gap by finding assets on its own initiative, instead of waiting to be told about them. A device that joins the network, or an agent that reports new hardware or an unfamiliar application, becomes visible the moment it appears. The inventory then reflects what is actually connected, not what was declared last. Unapproved tools that slip in this way are the everyday form of Shadow IT.
How discovery works
Discovery methods overlap, and most organizations combine more than one.
| Method | What it does |
|---|---|
| Agent-based | Endpoint software reports hardware, devices, and apps. The most detailed method. |
| Network scanning | Probes IP ranges. Finds devices with no agent, with less detail. |
| Directory and management queries | Pulls records from Active Directory, DHCP, or existing tools. |
| Passive listening | Watches network traffic for device fingerprints. No active probing, but slower. |
What discovery finds
A mature discovery process covers more than desktop computers:
- Computers: desktops, laptops, and servers, with their operating system and basic configuration.
- Peripheral devices: monitors, network adapters, disk drives, portable storage, and other components attached to a managed machine.
- Installed software: applications, their publisher, and their version, discovered per machine instead of assumed from a license record.
- Rogue and unauthorized devices: hardware connected to the network or to a managed computer that appears in no approved configuration. On managed computers, this is the case that hardware change detection is built for.
What it looks like in Anexet
In Anexet Inventory, each workstation card lists the hardware and applications the agent found. Hardware that is not on the list gets a warning icon, so it can be reviewed before anyone accepts it.
1 / 2
From discovery to a usable inventory
Discovery only produces candidates: raw sightings that still need to become inventory records. This happens in three steps. Those records usually live in a configuration management database.
Skipping reconciliation is a common failure. A discovery feed that is never imported only piles up unreviewed sightings, and the inventory drifts back toward the gaps discovery was meant to close.
- 1
Discover
Discovery finds an object on the network or endpoint.
- 2
Identify
Identification gives it a durable key, such as a serial number, MAC address, or hostname.
- 3
Reconcile
The import step merges the sighting into a known asset, adds it as new, or flags a likely duplicate for review.
Where discovery falls short
No single method sees everything. Agent-based discovery misses machines without an agent. Network scanning misses devices that are powered off, on another segment, or set to ignore probes. Passive listening can take a long time to build a full picture. Virtual machines and containers can appear and disappear within minutes, faster than a daily scan.
That is why discovery works best as a continuous process, not a one-time project. Each new scan or agent report catches what the last one missed. The gaps narrow as more methods are combined. That is also why IT asset management programs treat discovery as a routine task.
| Blind spot | Typical cause | Coverage |
|---|---|---|
| Machines without an agent | No agent installed | Partial |
| Devices powered off | Missed by a network scan | Next scan |
| Short-lived VMs and containers | Gone before a daily scan | Continuous |
Where to start
Start with the sources you already have: the agent feed, the directory records, and the last network scan. Reconcile them once, so every sighting is either matched, added or marked as a duplicate.
For a ready setup, see IT asset inventory and discovery software.
Further reading: Information Security of Databases.
A discovery feed nobody reviews is only a longer list of guesses.
Anexet TeamHow Anexet handles this
In Anexet, discovery runs continuously through the endpoint agents in the Inventory module: as soon as an agent observes a computer, a connected device, or an installed application, it reports back to the console, and hardware that has not yet been added to inventory is flagged separately so nothing found gets lost before it is reviewed.
The on-premise architecture keeps every discovered asset record inside the organization's own infrastructure, with no data passing through the vendor.
New computers found
the Hardware and Software dashboard surfaces a running count of computers agents have found but that are not yet in inventory, so nothing sits unreviewed indefinitely.
Import from agent schema
an import wizard reads what agents discovered, matches it against existing records by computer, device, or serial number, and lets an operator replace a record, add it as new, or skip it. That reconciliation step is what discovery depends on.
Device and software discovery together
the same agent reports hardware components (monitors, disks, network devices, and more, across roughly twenty device types) and installed applications with their publisher, version, and install date, so hardware and software discovery stay in one workflow.
Deviation from configuration
once discovered devices are attached to a computer's configuration baseline, anything that shows up outside it, or any baseline device that stops responding, raises an immediate alert rather than waiting for the next manual audit.
Office map placement
discovered computers and devices are placed on a visual office map, giving physical location alongside the technical record.
Exportable results
the resulting computer list, device list, and office map export to xlsx or pdf for audits and reporting.
Anexet Inventory
Learn more