- Network scans are point-in-time: A network scan captures what was responding on the network when the scan ran. Devices that were offline, powered down, or connected via VPN from home are invisible. In a remote-first workforce, this is not an edge case — it is a significant fraction of the fleet.
- Agents are continuous: A lightweight software agent installed on an endpoint reports hardware specs, installed applications, configuration state, and health signals directly to the ITAM platform — continuously, regardless of whether the device is on the corporate network or connected from a coffee shop. The asset record is always current because the agent updates it in real time.
- What agents capture that network scans miss: Installed application inventory (not just what is network-visible), software version numbers for patch management, hardware health signals (battery, storage, CPU), last-login user, and configuration details relevant to security and compliance. None of this is available from a network scan.
- The hybrid approach is the standard: Agents for managed endpoints (laptops, workstations, servers) where deep telemetry and off-network visibility matter. Agentless discovery (network scanning + cloud API queries) for infrastructure, IoT, and devices that cannot support agent software. Both feeding the same asset graph.
- Deployment is not the blocker: The primary agent deployment concern — getting agents onto hundreds or thousands of devices — is solved by MDM and deployment management tools that can push agents to enrolled endpoints without individual device access. Most organizations with an MDM in place can deploy agents across the managed fleet in a day.
- WorkVerge Agent Discovery: Deploy on Mac, Linux, and Windows. Live health, app inventory, and hardware signals feed the WorkVerge ITAM layer and CMDB automatically — no manual audits, no quarterly scan cycles, no dark spots for off-network devices.
Introduction: The Network Scan Blind Spots
For most of IT's history, network scanning was the standard method for discovering what assets existed in the environment. An administrator ran a scan tool like nmap across network segments, catalogued responding devices, and produced an inventory. In an era of physical offices and devices that were always connected to the corporate network, this approach worked reasonably well. Devices were on the network when the scan ran. The inventory was largely accurate.
The remote-first workforce has destroyed this assumption. In a modern organization where a significant percentage of employees work from home, from client sites, or while traveling, a network scan run during business hours captures only the devices that happen to be connected to the corporate network at that moment. Laptops working from home through personal internet connections are invisible. Devices connected through VPN split tunneling may not respond to network scans depending on routing configuration. Devices that are powered down or in sleep mode during the scan window do not appear. The scan shows a partial inventory — and in distributed organizations, that partial inventory may miss 30–50% of the actual device fleet.
Agent-based endpoint discovery addresses this structurally. A software agent installed on a managed endpoint reports data directly to the ITAM platform regardless of network topology — the device does not need to be on the corporate network to report. This article explains what agents capture that network scans cannot, how the hybrid discovery approach works in practice, and what the agent data enables that periodic scans cannot support. For the broader discovery methodology that combines all three discovery methods, see How to Automate Asset Discovery: Save 20 Hours/Month.
Agent-Based vs Agentless: The Core Distinction
Discovers assets by scanning the network from a central point or querying APIs. No software installed on target devices. Fast to deploy, works for any network-visible device. Limitation: captures a point-in-time snapshot, misses offline devices, provides surface-level device data only (IP, hostname, open ports).
A small agent installed on the endpoint continuously collects and reports: hardware inventory, installed applications with versions, OS configuration, CPU/memory/storage health, and last-login user. Works regardless of network connectivity — the agent reports over any internet connection. Provides deep, current telemetry that network scanning cannot access.
According to Lansweeper's ITAM research, agent-based discovery helps ensure the asset inventory is up to date with minimal reliance on intermittent network scans — particularly valuable for endpoints that regularly operate off-network. The AdminRemix analysis of agent versus agentless approaches identifies network independence as one of the primary agent advantages: agents only require outbound communication to the central server, making them viable in environments where inbound traffic is restricted by security policy.
What Agent-Based Discovery Captures That Scans Cannot
The data difference between a network scan result and an agent telemetry report is significant — not just in completeness but in the operational decisions each supports.
Installed Application Inventory
A network scan identifies that a device exists and which ports are open. It cannot enumerate the installed applications on that device. An agent reads the device's installed application registry directly — producing a complete list of every application installed, its version number, and the installation date. For software asset management and license compliance, this is the data source that matters: not which devices are on the network, but which applications are installed on which devices. The complete installed application picture enables license utilization analysis — how many devices have Adobe Creative Cloud installed versus how many are actively using it — that network scanning cannot produce.
Hardware Health Signals
Agents continuously report hardware health metrics that are invisible to network-based discovery: battery health percentage for laptops, storage capacity and utilization, CPU performance characteristics, and memory configuration. These signals enable proactive lifecycle management — alerting before hardware failure rather than discovering it through an incident ticket. A laptop with battery health below 20% is a predictable device failure within weeks. An agent that reports this metric enables a replacement to be provisioned before the employee loses their device mid-project. Network scanning cannot see any of this; it can only see that the device is responding on the network.
Off-Network Visibility
This is the capability that most directly addresses the remote workforce gap. An agent on a laptop working from an employee's home connects back to the WorkVerge platform over the public internet — reporting current configuration, installed applications, and health data as if the device were on the corporate network. The IT team maintains complete visibility into the device's current state without any dependency on the device being connected to the corporate network. For security patching, this matters enormously: an unpatched vulnerability on a remote device that is never on the corporate network is invisible to network scanning and cannot be tracked, verified, or remediated without agent telemetry. For the security perimeter implications of remote device visibility, see Protecting Your Digital Perimeter: A Guide to Asset Visibility.
Configuration State and Compliance
Agents report configuration state in real time: is disk encryption enabled? Is the OS version current? Is the MDM enrollment active? Is the endpoint protection tool installed and running? These configuration attributes are what security and compliance teams need for endpoint compliance assessment — and they change continuously as software updates are applied, configurations drift, and users install or remove applications. Network scanning provides no insight into configuration state; it observes only the device's network presence. Agent telemetry enables continuous compliance monitoring — identifying devices out of policy before they generate a security incident or appear as a finding in an audit.
The Hybrid Approach: Agents and Agentless Together
Agent-based and agentless discovery are complementary, not competing. They cover different asset categories and provide different data depths — the complete picture requires both.
| Asset Category | Best Discovery Method | Why |
|---|---|---|
| Managed laptops and workstations | Agent-based | Deep telemetry, off-network visibility, installed app inventory, health signals |
| Managed servers (on-premises) | Agent-based | Continuous configuration monitoring, installed application inventory, process monitoring |
| Cloud infrastructure (AWS/Azure/GCP) | Cloud API (agentless) | API provides complete, real-time inventory; agents not typically deployed on cloud-managed infrastructure |
| SaaS applications | Identity provider sync (agentless) | SSO integration surfaces application usage; no agent deployment in SaaS possible |
| Network infrastructure (routers, switches) | Network scanning (agentless) | These devices cannot host agent software; SNMP-based network scanning is the appropriate method |
| Printers, IoT devices | Network scanning (agentless) | Limited or no agent support; network scanning identifies presence and type |
| Mobile devices | MDM integration (agentless) | MDM provides device inventory, compliance state, and app inventory without additional agent deployment |
The hybrid approach is the industry standard for comprehensive asset discovery in 2026. According to Virima's discovery analysis, most mature security programs use both — agentless for broad initial coverage and infrastructure, agents for depth on managed endpoints where off-network visibility and telemetry depth matter.
Deploying Agents at Scale
The primary concern IT teams raise about agent-based discovery is deployment overhead: how do you get a software agent installed on hundreds or thousands of endpoints without individually touching each device? In practice, this concern is resolved by the MDM infrastructure that most organizations already have in place.
Agent deployment requires knowing which devices to deploy to — but if the inventory is incomplete, some devices may not appear in the MDM-managed fleet. The practical resolution: run an agentless network scan first to identify all network-connected devices. Compare the scan results against the MDM-enrolled device list to identify devices that are on the network but not enrolled in MDM — these are also not in the approved device fleet and represent both a security gap and an inventory gap. Enroll missing devices in MDM. Then deploy agents via MDM across the confirmed fleet. The agentless scan serves as the bootstrap for agent deployment without requiring manual device-by-device investigation.
Organizations with Microsoft Intune or Jamf can deploy the WorkVerge agent to the entire managed fleet through a single MDM policy push — no manual installation on individual devices. The policy runs in the background, enrolling each device as it checks in with MDM. Most organizations with an active MDM deployment can have the agent running across the entire managed fleet within 24–48 hours of enabling the deployment policy.
For new devices, the agent deployment is part of the enrollment workflow — when a new device is provisioned through the onboarding workflow and enrolled in MDM, the agent is deployed automatically as part of the provisioning sequence. From that point forward, every device that enters the organization through standard provisioning is automatically enrolled in agent-based discovery without requiring any additional manual step.
What Agent-Based Discovery Enables Downstream
Patch Management Intelligence
Agent-reported software version data enables patch management programs to identify unpatched vulnerabilities across the fleet within hours of a CVE announcement — rather than waiting for the next network scan to confirm which devices are affected. In 2026, the window between vulnerability announcement and active exploitation is measured in days. Agent telemetry closes the identification gap that periodic scans leave open.
License Compliance at the Device Level
Agent-reported installed application inventory provides the data source for software license compliance that matters for audit: which applications are installed on which devices, not just which licenses have been purchased. The compliance picture — installed vs. licensed — requires device-level software data that only agents can provide continuously rather than periodically.
ITSM Ticket Context
When an incident is logged for a specific device, the agent's telemetry provides the current device configuration, health state, and installed application versions at the time of the incident — data that resolves most hardware and software incidents faster because the analyst does not need to investigate what was on the device before understanding what is wrong with it. The AI-assisted ticket context that WorkVie AI provides is directly dependent on the agent telemetry in the asset graph. For the full ticket context picture, see What is WorkVie AI? How AI-Native IT Operations Works.
WorkVerge Agent Discovery: How It Works
The WorkVerge agent is a lightweight software component deployed on Mac, Linux, and Windows endpoints. Once installed, it continuously reports to the WorkVerge platform, feeding the ITAM asset graph and CMDB with real-time device data.
- Auto-Enrollment: When the agent is installed, the device automatically enrolls in the WorkVerge asset inventory — creating or updating the asset record with the current device specifications, assigned user, and platform details. No manual record creation required.
- Live Device Health: The agent continuously reports battery health, storage utilization, CPU characteristics, and memory configuration. Health signals surface as ITAM alerts when thresholds are crossed — a device with battery health below a configured threshold triggers a replacement review workflow automatically.
- App Inventory: The agent reads the installed application registry on each device and reports to the WorkVerge ITAM layer — enabling installed-versus-licensed comparison, shadow IT application detection on managed endpoints, and version-specific vulnerability identification across the fleet.
- CMDB Integration: Agent data feeds the WorkVerge CMDB automatically — the configuration item for each managed endpoint reflects current hardware, software, and configuration state based on the most recent agent report. Change detection compares successive agent reports and flags configuration changes in the CMDB change log.
- MDM Deployment: WorkVerge agent deployment is supported via Intune and Jamf policies — enabling fleet-wide deployment without individual device access. New device enrollment in MDM triggers agent deployment automatically when the onboarding workflow is configured to include it.
For the complete hybrid discovery architecture that combines agent-based endpoint discovery with cloud API discovery and identity provider sync, see How to Automate Asset Discovery: Save 20 Hours/Month.
Conclusion: Agents Are the Foundation for Remote-First ITAM
In an office-first world, network scanning was an adequate foundation for asset discovery. In a remote-first world, it is not — the devices that matter most for security, compliance, and operational management are the ones least likely to be on the corporate network when a periodic scan runs. Agent-based discovery is not an enhancement to network scanning; it is the foundation that network scanning should complement for managed endpoint visibility.
The combination of agent-based discovery for managed endpoints, cloud API discovery for cloud infrastructure, and identity provider sync for SaaS applications produces the continuously current, comprehensive asset graph that both operational and compliance requirements demand. Each method covers the assets the others cannot reach. Together they eliminate the dark spots that periodic scanning leaves behind and enable the AI-assisted operational intelligence that relies on complete, current data to produce recommendations worth acting on.