← All posts

IT Asset Discovery Methods: Which to Use for an SME in Ireland

You cannot answer a customer questionnaire, prepare for an audit or report to your board on devices, software and cloud services you do not know you have. For a business of 10 to 250 people, the practical answer is a layered one: scan your network, pull data from your cloud and identity accounts, put agents on laptops that leave the office, and close the gaps with a short manual check of purchasing and subscriptions. No single method finds everything.

This guide explains each method in plain terms, what it finds and misses, and how to combine them with the effort a small team can sustain. It is written for IT managers, operations directors and compliance leads, and for the MSPs and accountants who advise them.

Key Takeaways

  • Asset discovery means finding and listing the hardware, software, cloud services and data your business relies on. It is the starting point for almost every security and compliance task.
  • The main methods are agent-based, agentless, active scanning, passive monitoring, cloud API discovery and manual entry. Each sees something the others miss.
  • Most SMEs get good coverage from three layers: network scanning, cloud and identity data, and a quarterly manual check of purchases and subscriptions.
  • Under NIS2, the Irish NCSC guidance expects an inventory that is complete, accurate, current and traceable, so keep dated records of changes.
  • A first inventory takes days, not months. Keeping it current is the real work, so decide who owns it.

Table of Contents

What asset discovery is, and which job it serves

Asset discovery is the process of identifying everything your business uses to run its services: laptops, servers, network equipment, phones, software, cloud accounts, SaaS subscriptions and the data held in them. The result is an inventory, often called an asset register.

Most readers arrive here because something prompted it. Map the prompt to the job:

  • Passing an audit. Standards such as ISO 27001 expect you to know your assets before you assess risk. Our ISO 27001 asset inventory playbook covers what an auditor looks for.
  • Answering a customer questionnaire. Questions such as "do you maintain an inventory of devices and software?" are standard. A vague "yes" tends to draw follow-up questions.
  • Reporting to the board. Directors cannot judge cyber risk without knowing what is exposed. An inventory gives them a number and a list.
  • Handling an incident inside the regulator's clock. If something goes wrong, the first question is which systems are affected. NIS2 sets a 24-hour window for an early warning, as set out in our NIS2 incident reporting guide. You cannot answer in 24 hours from a spreadsheet nobody has opened for a year.

The SANS Institute makes the broader point that accurate asset inventories are a prerequisite for later practices such as failure analysis and faster recovery.

The six discovery methods

1. Active network scanning

A scanner sends probes across your IP ranges and records what answers: address, device type, open ports, sometimes operating system and software versions. It is the quickest way to find out what is on your office network today.

It finds servers, printers, switches, cameras and forgotten devices plugged into a spare port. It misses devices that are switched off, on a different network segment, or working from home. It can also upset fragile equipment. Older operational technology, such as controllers in a factory, can react badly to probing, so scan those segments carefully or not at all.

Time to run a first scan: an afternoon to configure, then minutes to hours to run, depending on size.

2. Passive network monitoring

Instead of probing, a passive tool listens to traffic and notes which devices are talking. It is gentler on fragile systems, which is why it suits legacy and industrial equipment. It also catches devices that appear only occasionally.

The weakness is the mirror image of active scanning: a device that is quiet, switched off or on a segment you are not monitoring does not appear. Passive monitoring needs a placement on the network that sees the traffic, which usually means some input from whoever manages your switches or your managed service provider.

3. Agent-based discovery

A small piece of software is installed on each laptop, desktop or server and reports back: hardware, operating system, installed applications, patch level. Because the agent travels with the device, it keeps reporting when the laptop is at a client site or someone's kitchen table.

This gives the deepest detail and is the best answer for a hybrid workforce. The cost is deployment and upkeep. Someone has to install agents, notice when one stops reporting and handle devices that never got one. It also cannot see anything you cannot install software on, such as printers, network gear or a contractor's personal machine.

If you already use a device management tool for laptops and phones, its enrolment list is effectively an agent-based source. Start there.

4. Agentless discovery

Agentless discovery queries devices remotely using standard management protocols, such as SNMP for network equipment, WMI for Windows and SSH for Linux. Nothing is installed on each device. It suits servers and network devices that you manage centrally.

It depends on valid credentials and open firewall rules. Where credentials are missing or a rule blocks the query, the device shows as unknown. Treat every "unknown" as a finding, not a failure.

5. Cloud and API discovery

For cloud platforms, the most reliable method is to ask the provider. Your Microsoft 365 or Google Workspace tenant, your AWS or Azure accounts and your identity provider all hold lists of users, devices, instances, applications and permissions that you can export or read through an API (the interface that lets one system query another).

Network scanning cannot see a SaaS subscription or a storage bucket, so this method covers a large share of a modern SME's real estate. Pay particular attention to the list of applications users have authorised to access company accounts. It often reveals tools nobody told IT about.

6. Manual entry and procurement checks

Some assets will never be found by a tool: a niche device, a specialist application on one person's machine, a subscription paid on a personal card and expensed. Manual methods catch these. Useful sources are:

  • expense claims and card statements, scanned for software and subscription names
  • accounts payable and purchase orders
  • a short survey of department heads, once a quarter
  • DNS and firewall logs, reviewed for unfamiliar services

The UK NCSC notes that asset management is not only a technology issue and needs input from functions such as procurement. In practice, that means finance is one of your best discovery tools.

Comparing the methods

Method Best at finding Typical blind spot Effort for an SME
Active scanning Everything answering on the office network Off-network, switched-off devices; risk to fragile kit Low to medium
Passive monitoring Quiet or sensitive devices, rogue connections Silent or offline devices; needs good placement Medium
Agent-based Laptops, servers, installed software, remote devices Anything without an agent Medium, then ongoing
Agentless Servers and network equipment Devices without credentials or open rules Medium
Cloud and API SaaS, cloud instances, users, authorised apps Systems outside the tenants you connect Low
Manual and procurement Shadow IT, unusual devices, paid subscriptions Slow, depends on people Low per pass, recurring

Automated asset discovery: what it does and what it cannot

Automated discovery combines several of the methods above, runs on a schedule and merges the results into one list. The value is repetition. A single scan is a snapshot. A scheduled scan shows you what appeared and disappeared since last time, and that is what you need for audits and incidents.

Two cautions apply.

First, merging is harder than it sounds. The same laptop may appear as an IP address from the scanner, a hostname from the agent and a user's name from the identity provider. Matching these into one record, and tidying software names that appear in dozens of variants, is often the most time-consuming part of building an inventory. Budget for it.

Steps from discovery data to owned inventory

Second, automation produces data, not an inventory you can defend. Someone still has to assign an owner to each asset, decide how important it is and note what happens when it fails.

What regulators expect from your inventory

If your business falls under NIS2, the inventory is not optional. The NCSC in Ireland's draft NIS 2 risk management measures guidance says essential and important entities should maintain asset management for the network and information systems that support their services. It expects the inventory to be complete, accurate and current, with changes documented in a traceable way. It also covers hardware, software, cloud, third-party and data assets, not just computers.

Two practical consequences follow:

  1. Keep dated records. A register that is overwritten each month shows what you have, not what changed. Keep a history, even if it is only dated exports.
  2. Include more than devices. Software, cloud services, suppliers and the data they hold all count.

The guidance also says entities could classify their systems by cybersecurity and business risk, including confidentiality, integrity, authenticity and availability. A simple three-level rating (critical, important, routine) is enough to start. ENISA's interoperable EU risk management framework draws a useful line between primary assets, such as data and business functions, and the supporting hardware, software and infrastructure they depend on. Listing both lets you say not just "we have this server" but "this server supports payroll".

Whether NIS2 applies to you depends on your sector and size. Our NIS2 scope guide explains the two categories, and if the answer depends on legal interpretation, take legal advice. Even outside scope, customers and insurers in scope will push the same expectations down to you through the supply chain, as our NIS2 supply chain guide explains.

For financial services firms under DORA, and for suppliers to banks, the same principle applies: you need to know which systems support which services before you can describe them to a customer or the Central Bank of Ireland.

Building the inventory in six steps

These steps assume a company of around 50 people with no security team. Time estimates are for a first pass.

  1. Define what counts (30 minutes). Agree categories: devices, servers, network equipment, software, cloud services, data stores, suppliers. Write them down.
  2. Name an owner (15 minutes). One person is accountable for the inventory, even if several contribute. Without this, the register decays.
  3. Export from systems you already have (half a day). Device management, Microsoft 365 or Google Workspace, your identity provider, cloud consoles and your finance system. This usually yields 70 to 80 per cent of the picture at no extra cost.
  4. Scan the network (half a day). Run an active scan of office ranges. Use passive monitoring or skip scanning for any industrial or legacy segment. Compare results with step 3 and note every device that appears in only one list.
  5. Run the manual check (half a day). Review card statements and purchase orders for software and subscriptions, and ask each department head what they use that IT did not set up.
  6. Classify and assign (one to two days). Give each asset an owner and a criticality rating. Mark anything holding personal data, since your GDPR records depend on it.

Then set the rhythm: scheduled scans weekly or monthly, a manual check quarterly, and a review of unknown devices every time a scan runs. Record each review with a date.

Where discovery goes wrong

Scanning once and stopping. An inventory is out of date the day after it is built. The cadence matters more than the tool.

Treating the inventory as an IT list. Finance, HR and operations all buy and use technology. Include them.

Ignoring fragile equipment. In manufacturing and healthcare, operational and medical devices may not tolerate active scanning. For many established sites, an inventory can start from existing records such as drawings, manuals, purchase information and maintenance systems, as guidance on operational technology inventories describes.

Leaving out the people. Contractors, interns and shared accounts all create assets and access. Make sure leavers and joiners feed the register.

Where discovery goes wrong

Counting without prioritising. A list of 900 items helps nobody. Flag the 20 that matter most to the business first.

What to do this week

  1. Write down who owns the inventory.
  2. Export device and user lists from your device management tool, your email and identity platform, and your main cloud accounts.
  3. Ask finance for the last three months of card statements and look for software and subscriptions IT has not heard of.
  4. Run one network scan of the office and compare it with the exports.
  5. Mark the 10 to 20 assets your business could not operate without, and note who owns each.
  6. Save everything with today's date. That is the first entry in your audit trail.

If a customer questionnaire or insurer prompted this, you can now answer the inventory question truthfully, and say when it was last reviewed.

How ShieldIQ helps with the inventory

ShieldIQ is an AI-powered governance, risk and compliance platform built in Ireland for teams without a dedicated security team. It includes network scanning and an asset register alongside risk, vendor and evidence management, so the list you build sits next to the controls and documents an auditor will ask about. It helps you assess, prioritise, document and evidence compliance; certification itself comes from an accredited body, not from us. Customer data is hosted in the EU (Ireland) on AWS, and AI analysis is processed by Anthropic (Claude), which does not train on customer data.

The Starter plan is free with no card, and NIST CSF 2.0 is free to assess. A first baseline assessment takes about 15 minutes. The other frameworks, including NIS2, GDPR, ISO 27001 and DORA, are on paid plans; see the plans and pricing for the current amounts. Our NIST CSF page shows where asset identification fits in that framework.

ShieldIQ

If you would like a person alongside the software to scope the work or prepare for an audit, our consulting services include a virtual CISO and audit preparation.

Our perspective

We have sat in the CISO chair, and the pattern is consistent: companies do not fail inventory questions because they lack a scanner. They fail because nobody owns the list, and because the list lives in one person's spreadsheet.

Our view is that a small business should aim for a register it can keep alive in an hour a week, not a perfect one it updates twice a year. Layer a few sources, record what changed and when, and attach each asset to the service it supports. That is what lets you answer a customer in a day, an auditor in an hour and a regulator inside its clock.

This is why ShieldIQ puts the asset register, risk register, vendors and evidence in one place. The inventory should feed the risk work and the audit evidence directly, so you enter it once.

Matthew Lemon

FAQ

What is the difference between agent-based and agentless discovery?

Agent-based discovery installs a small program on each device, which reports detailed information even when the device is off your network. Agentless discovery queries devices remotely using management protocols and credentials, so nothing is installed. Most SMEs use agents on laptops and agentless queries for servers and network equipment.

How often should we run asset discovery?

Scheduled network and cloud discovery weekly or monthly suits most SMEs, with a manual check of purchases and subscriptions each quarter. NCSC Ireland's draft NIS 2 guidance expects the inventory to stay current and changes to be traceable, so keep a dated record of each review.

Can we do asset discovery without a security team?

Yes. The first pass uses exports from tools you already have, one network scan and a review of finance records. It takes a few days. The harder part is naming an owner and keeping to a schedule, and a platform or an external virtual CISO can carry some of that.

What should we do about devices that scans cannot see?

Record them manually. Operational equipment, personal devices used for work and subscriptions paid on a card all fall into this group. Use purchase records, maintenance files and a short survey of department heads, and give each item an owner and a review date.

Sources

Recommended