Get a Demo
Menu

Step 1 of 5: Scoping

Identify all assets across cloud, SaaS, on-prem, and third-party environments to establish total attack surface awareness.

Try the working example Download the PDF
The 5 steps as a cycle, with step 1, Scoping, marked. Each step links to its page.

Goal

Gain visibility

The challenge

How do you measure the business value of your assets?

What makes it hard
  • Dealing with incomplete and inaccurate asset inventory data
  • Working with unclear mappings between assets and workloads
  • Knowing where to apply value measures in prioritization models

How Axonius helps

By finding every asset that touches your data and processes, through adapters and continuous discovery.

How does Axonius find assets?

Through adapters: to identify assets, Axonius integrates with your IT, Security, and business solutions using pre-built integrations known as adapters.

Orange panel "Adapters Page" with a screenshot of the Axonius Adapters page: a grid of configured adapter tiles (vendor logos with names such as Amazon Web Services (AWS), Atlassian Jira Assets Platform, CrowdStrike Falcon, CSV, Microsoft Azure, Microsoft Active Directory (Azure AD), Okta, Tenable.io) with asset-type chips under each, and a second section of further adapters below.
The Adapters page, with each configured adapter as a tile.
Read the full section

Axonius supports scoping by identifying all assets interfacing with your data and processes, through adapters, discovery logic, and continuous discovery.

As of June 2025, Axonius supports over 1,200 native adapters capable of identifying over 40 asset types regardless of where they are hosted.

Adapters are integrated using native and open APIs, eliminating the need for agents or network tapping that introduces deployment friction, maintenance burden, and limitations in identifying shadow IT or assets outside your network.

What does the discovery logic do?

It turns raw adapter data into one accurate inventory: after collecting asset information, Axonius initiates its mapping phase (aggregation, correlation, deduplication, normalization and enrichment).

Dark panel with six steps in a row, left to right: Aggregate (System and asset data via Adapter integrations), Correlate (Assets and direct associations by type), Normalize (asset profiles via deduplication and logic), Enrich (Profiles with added real-time intel and external sources), Model (Asset relationships across the total attack surface), Assess (Built-in risk, performance, and cost measures).
The six stages of the discovery logic, from aggregate to assess.

For example, correlate five tools’ lists of the same three laptops:

Siloed: five tools, five lists

CMDB

  • laptop-0142
  • laptop-0417
  • laptop-0630

Endpoint management

  • laptop-0142
  • laptop-0417
  • laptop-0630

VPN client

  • laptop-0142
  • laptop-0417
  • laptop-0630

Meeting client

  • laptop-0142
  • laptop-0417
  • laptop-0630

Endpoint protection (EPP)

  • laptop-0142
  • laptop-0630

Every list looks complete. Nothing says one laptop is missing from the EPP list.

Correlated: one row per asset

AssetCMDBEndpoint managementVPN clientMeeting clientEndpoint protection (EPP)
laptop-0142 ReportedReportedReportedReportedReported
laptop-0417 ReportedReportedReportedReportedMissing
laptop-0630 ReportedReportedReportedReportedReported

By identifying a laptop under management accessing your internal applications, but missing your endpoint protection (EPP), you identify a blind spot in coverage.

Five siloed lists against one correlated view. Hostnames are sample data.
Read the full section

That ensures your asset scoping is both complete and accurate, with assets uniquely identified, enriched, and free from inconsistencies. The logic also sets the foundation for future steps in the CTEM process, like discovery.

How does Axonius keep the scope current?

With a recurring schedule and real-time adapters that capture changes in your assets regularly and automatically.

Orange panel: "Through continuous discovery and snapshots, you can see the scope at any date". Screenshot of the Axonius Users asset view with a date picker open on 2025-03-03 (calendar for Mar 2025, a Today link). Left tree under Identity: Users 1,858, Groups 46, Roles 488, Organizational Units 61, Accounts/Tenants 84. Total 1,858. Columns: Adapter Connections, User Department (Sales, Sales, Sales, Customer Success).
Snapshots let you see the scope at any date.
Read the full section

CTEM is a continuous process. As such, it requires the scoping of assets to be run continuously across your environments. Axonius also provides historical snapshots of your attack surface, giving you the ability to track changes in the attack surface over time and uncover gaps like assets missing in action.

From pages 8 to 10 of the PDF. Download the PDF