The Discovery Tool That Found Too Much
An insurance firm deploys an agentless discovery tool across 9,000 endpoints. The first inventory returns 4,200 distinct software titles, including 900 'unknown' entries, 1,300 version variants of the same three browsers, and 40 titles that appear only on a single device once. The reconciliation team is asked to produce a compliance position for a database product in 30 days. The tool cannot see three OT segments in the claims-processing centres, and the CMDB has not been updated in 14 months. The vendor's entitlement records are in three spreadsheets maintained by different people.
1. How should the team turn 4,200 titles into a usable inventory within the deadline?
Read the worked answer
The deadline forces normalisation and scoping, not exhaustive cleanup.
Normalise:
- Apply a software recognition catalogue to collapse version variants into product families. 1,300 browser entries should become three products with version distributions.
- Handle the 900 unknowns by sampling: identify the top 50 by device count, classify them, and treat the tail as a known gap rather than a blocker. Many will be components, drivers or internal builds.
- Park the 40 single-device titles as an exception list; they rarely affect a compliance position for a major product.
Scope to the question: the compliance position is about one database product, not all 4,200 titles. Filter the inventory to that product, then reconcile. Broad cleanup is a post-deadline activity.
Close the blind spots:
- The three OT segments must be addressed explicitly. If the database product cannot run there, document that and exclude them with reasoning. If it can, a manual or network-based sweep is required before the position is signed.
- The stale CMDB is a cross-check problem, not a source. Use discovery as primary and CMDB as a reconciliation reference, flagging where they disagree.
Judgement: a compliance position is a scoped, evidenced statement with declared limitations, not a claim of perfect data.
2. What should the final compliance position contain, and how should its limitations be communicated?
Read the worked answer
The position should be a short, auditable document with the reasoning visible.
Contents:
- Scope statement: which product, which versions, which estate, and what was excluded (OT segments) with the reason.
- Entitlement summary: the three spreadsheets consolidated into one figure, with the source and owner of each line. Conflicting entries must be resolved or shown as a range.
- Deployment summary: installations normalised to product and version, de-duplicated by device.
- Reconciliation: entitlement versus deployment, showing over- or under-licensing, with the calculation method.
- Assumptions and limitations: agentless coverage gaps, unknown titles not classified, CMDB staleness, and the confidence level of the number.
- Actions: what will close each gap and by when.
Communication: present a range where the data supports it, with the confident floor and the worst case, rather than a single false-precision number. State plainly which exclusions are evidenced and which are assumptions. Executives can act on a range with stated confidence; they cannot act on a number whose provenance is hidden.
Judgement being tested: the temptation is to present a clean number. The correct behaviour is to present a defensible one and make its limits explicit, so the organisation knows what it is and is not covered for.