--- title: "What percentage of hardware/software connected to network is inventoried?" url: https://insuranceposture.com/questions/network-and-logging/percentage-hardware-software-connected-network-inventoried category: "Network, logging and monitoring" canonical_key: q_aud_008 evidence_state: partial updated: 2026-08-24 --- # What percentage of hardware/software connected to network is inventoried? URL: https://insuranceposture.com/questions/network-and-logging/percentage-hardware-software-connected-network-inventoried Section: Network, logging and monitoring Evidence state: Partly verifiable from your tenant Every coverage percentage elsewhere on this application is calculated against an inventory. This question asks whether that inventory is real. ## What the carrier is actually asking The carrier is asking what proportion of connected hardware and installed software is tracked in an inventory. It is the foundational control, because patching, endpoint coverage, and vulnerability management all measure themselves against it. ## Why it is underwritten Unknown assets are unpatched, unmonitored, and uncovered by every control you reported. They are also disproportionately where intrusions begin, because nobody is looking at them. An inventory that misses ten percent of the estate makes every other coverage figure ten percent optimistic. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Several independent sources can be reconciled to produce a real denominator, which is what distinguishes an inventory from a list. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Entra ID | Registered and joined device inventory | The identity-side view of devices, which usually differs from the endpoint console | | Microsoft 365 | Intune enrolled devices and discovered applications | Managed device population and the software inventory it reports | | Azure | Resource inventory across subscriptions | Cloud assets including those in subscriptions outside the main management group | | Endpoint console | Unmanaged device discovery on the network | Devices seen without an agent, which is the most direct measure of inventory gaps. Attested | | Reconciliation | Differences between sources | A reconciled figure with a stated method, since the union of the sources is the real denominator | **Cloud subscriptions are the modern shadow estate** Physical shadow IT has largely been replaced by cloud subscriptions and software-as-a-service accounts opened with a corporate card. They hold data, they have administrators, and they appear in no inventory. Reviewing your cloud tenant for subscriptions and consented applications finds them. ## What a defensible yes requires - The inventory is built by reconciling multiple discovery sources. - It covers cloud resources and software-as-a-service accounts, not only hardware. - Discovery runs continuously rather than as a periodic project. - Unmanaged discoveries are triaged and either enrolled or removed. - The stated percentage names its denominator. ## How this answer goes wrong The inventory is the endpoint console export, which by construction contains only devices with an agent, so the reported coverage approaches a hundred percent. It is the same circular figure that inflates the endpoint coverage answer, and both derive from the same missing denominator. ## If this answer turns out to be wrong Remote access exposure and log retention are what a forensic report describes first, which makes them the answers most often revisited after a loss. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### What percentage should we report? Whatever your reconciliation supports, with the method stated. An honest ninety with a described method is stronger than an unexplained hundred. ### Does software inventory matter as much as hardware? Increasingly more. Unsupported and vulnerable software is what gets exploited, and you cannot manage what you have not inventoried. ### How do we find unknown assets? Network discovery, cloud resource enumeration, financial records for cloud spend, and identity logs showing applications in use. Each finds things the others miss. ### How often should this be refreshed? Continuously where possible. Estates change weekly, and an annual inventory is stale before it is finished. ## Related questions - [What percentage of endpoints have EDR deployed?](https://insuranceposture.com/questions/endpoint-and-patching/percentage-endpoints-edr-deployed) - [Does the Applicant use any operating system, hardware or software that is no longer supported / End-of-Life?](https://insuranceposture.com/questions/endpoint-and-patching/applicant-operating-system-hardware-software-no-longer-supported-end) - [Does the Applicant conduct regular vulnerability scans?](https://insuranceposture.com/questions/network-and-logging/applicant-conduct-regular-vulnerability-scans) - [Does the Applicant review and audit information security/privacy controls of IT, cloud, and non-IT service providers?](https://insuranceposture.com/questions/third-parties/applicant-review-audit-information-security-privacy-controls-cloud-non) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.