--- title: secnostic inventory canonical: https://www.secnostic.com/en/products/inventory language: en dateModified: 2026-08-12 alternate-de: https://www.secnostic.com/de/products/inventory --- # secnostic inventory - URL: https://www.secnostic.com/en/products/inventory - Positioning: Central asset and evidence baseline secnostic inventory turns IT, OT, and infrastructure assets into a shared source of truth for security, operations, compliance, and modernization. The inventory links technical systems, sites, networks, software, ownership, dependencies, vulnerabilities, lifecycles, and audit evidence in one model. **You pay for what you cannot see** Assets sprawl across teams, sites, and the cloud. As long as no one can say what you own, what it costs, and what an audit will find, you pay twice: for systems no one uses, and for every risk that stays hidden. **Capabilities** - Manage assets, sites, networks, and ownership as a connected model - Bring IT and OT together in one language for management and operations - Assess vulnerabilities, criticality, and dependencies in business context - Structure compliance requirements, evidence, history, and audit packages **Outcomes** - Full visibility across IT and OT. - Every asset has a clear owner. - Audit evidence ready on demand. **Modules of secnostic inventory** - **Dashboard** - Overview: Assets, vulnerabilities, compliance, and data quality at a glance. - **Asset table** - Inventory: Every asset, searchable and filterable, for everyday work. - **Graph view** - Model (core module): The heart of it: assets and their relationships as one connected model, not a flat table. Dependencies and impact become visible. - **Vulnerabilities** - Risk: Known vulnerabilities linked to the assets they affect, with status and impact. - **Criticality** - Impact: Finds critical assets, single points of failure, and the shortest attack paths through the relationship model. - **Compliance** - Standards: Map requirements from ISO 27001, IEC 62443, or NIS2 to assets and prove them audit-ready. - **Zones & conduits** - Segments: Group IT and OT into security zones, model the paths between them, and set protection targets. - **Enterprise architecture** - Architecture: Link business capabilities to applications, technology and assets, and see what a change affects. - **Network & sites** - Network: IP, subnets and VLANs for IT and OT, across many sites, in one model. - **Import, export & API** - Data: Connect files, scanners and existing tools, sync on a schedule, and wire anything over an API. - **Lifecycle & evidence** - Lifecycle: Track every asset from purchase to retirement, and keep a tamper-proof history. **What blind spots really cost** Unseen assets cost money, carry risk, and fail audits. - **Expenses nobody tracks**: Devices and services you pay for but never track are a quiet drain on the budget. - **Licenses out of control**: You over-buy seats no one uses, then fail the audit on the ones you do. - **Audits eat weeks**: Every review starts with painstaking manual work across tools and spreadsheets. - **Systems IT never sees**: Machines and building systems run on your networks, off every IT tool's radar. **One asset, its full context** An asset is never just a name. The secnostic inventory links it to where it lives, what it runs, who owns it, and what it puts at risk. A flat list becomes a living picture where impact is clear. Each asset is connected to its full context: Sites, Networks & zones, Software, Owners, Vulnerabilities, Evidence. **How your model comes together** Four steps from scattered data to one connected model that makes impact, risk, and evidence visible. 1. **Connect** Where does the data come from? Existing scanners, address management and files, plus the secnostic sensor and agents, deliver the evidence. Nothing is replaced; everything flows together. 2. **Model** Does the model fit your world? There is no fixed schema. You define your own asset types and relationships, and shape zones, sites and applications the way your organization works. 3. **Relate** How does it all connect? Every asset links to its site, software, owner, lifecycle and dependencies, becoming a dependable model instead of a flat list. 4. **Assess and act** What does it mean? The connected model surfaces criticality, vulnerabilities, attack paths, and audit-ready evidence, so you make decisions instead of maintaining data. **What improves in practice** From critical infrastructure to central IT: the same foundation, visible value. - **Critical infrastructure**: Observe: Sensors, imports and existing tools deliver controlled observations across IT, OT, remote access, and networks.; Map: Assets are mapped to services, sites, zones, operator responsibility, and maintenance windows.; Assess: Vulnerabilities, lifecycle and exposure are prioritized in the context of critical services.; Respond: Relevant events reach the right people, with acknowledgment, escalation, and the affected dependencies. - **Manufacturing**: Observe: Sensors capture network traffic passively and gently, while existing sources add context.; Map: Assets are mapped to lines, cells, sites, zones, and owners.; Prioritize: Vulnerabilities, firmware and end-of-life meet production impact and maintenance windows.; Respond: Relevant events are handed over so containment and maintenance stay coordinated and traceable. - **Central IT**: Connect: Identity, Active Directory, EDR, MDM, cloud and ITSM deliver signals, not new silos.; Reconcile: Several records merge into one asset with source, owner, and lifecycle.; Find gaps: The sensor fills the networks where classic management misses devices and paths.; Prioritize: Vulnerabilities, end-of-life and missing owners are sorted by criticality and use. - **Managed service provider**: Set up tenant: A separate tenant per customer, with its own data, roles, and reports.; Onboard: Connect sources and build each customer's inventory fast, with no cross-mixing.; Standardize: Apply the same modules and checks across every tenant.; Prove: Service and audit evidence per customer on demand, from one platform. **FAQ** - Q: Is this just another CMDB? A: No. A CMDB lists rows. The secnostic inventory holds assets and how they connect, so it can answer what really breaks or is exposed when one part fails. - Q: Do we have to replace our existing tools? A: No. The secnostic inventory brings your scanners, address management, and data sources together into one picture, and keeps them. - Q: Does it really cover OT, not just IT? A: Yes. Machines, control systems, and network zones are modeled from the start, and secnostic sensor discovers them safely, without disrupting production. - Q: How does it help with NIS2, KRITIS, and IEC 62443? A: It keeps evidence current and produces a signed audit package on demand, so proving compliance takes days, not weeks. - Q: Where does the data come from, and how does it stay current? A: From your existing scanners, address management and files, plus the secnostic sensor and agents that discover automatically. Scheduled syncs keep the picture current, with no manual spreadsheet upkeep. - Q: Multiple sites, and who sees what? A: Many sites live in one model. Sign-in, roles and tenant separation run on the secnostic platform, so each area sees exactly what it should. **Getting started.** We start with one site, one license review, or one audit, and make the value visible fast.