Topic starter
24/10/2026 8:49 pm
TL;DR: Gartner says 80% of CMDB projects add no business value, with Ordr arguing that unmanaged and agentless devices leave records stale. Continuous discovery and reconciliation become essential when device identity and context drift outside the CMDB.
Editorial analysis by NHI Mgmt Group, based on content published by Ordr: “How to Use AI to Feed & Maintain Your CMDB”.
By the numbers:
- Gartner found that 80% of CMDB projects add no business value.
- According to ORDR's 2024 Rise of the Machines report, 42% of enterprise devices are unmanaged and agentless.
- Those unmanaged and agentless devices carry 64% of mid-to-high level risks.
Key questions
Q: Why do unmanaged devices create a governance gap for IAM and compliance teams?
A: Unmanaged devices break the assumption that identity alone is enough to establish trust.
Q: How do teams know if CMDB reconciliation is actually working?
A: Reconciliation is working when duplicate configuration items fall, missing assets are discovered quickly, and downstream systems receive the same verified inventory without manual correction.
Q: What breaks when a CMDB is treated as a single source of truth but the data is stale?
A: A stale CMDB creates false confidence.
Practitioner guidance
- Implement passive device discovery Use network-observed discovery to cover unmanaged IoT, OT, and medical devices that agents cannot reach, then compare coverage against the current CMDB.
- Automate CMDB reconciliation Connect discovery outputs to a reconciliation process that creates, updates, and deduplicates configuration items before downstream tools consume them.
- Add behaviour-based asset context Enrich each record with firmware, OS, function, exposure, and dependency information so risk scoring and response workflows use real context.
Bottom line: Stale CMDB records create a governance gap because policy enforcement depends on accurate device identity and current asset context.
Glossary terms: Configuration Item, Passive discovery, Device Context, Reconciliation Engine
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:13 am
CMDB accuracy has become an access-control dependency, not just an IT hygiene issue. When the inventory is wrong, Zero Trust policy, vulnerability prioritisation, and incident handling all inherit the same error. The governance lesson is that device context now sits upstream of multiple control families, so accuracy needs to be treated as a security control in its own right.
A question worth separating out:
Q: What should security teams do when device context is too shallow for Zero Trust?
A: They should move from static asset records to verified device identity, behavioural baselines, and dependency data before tightening segmentation rules. Zero Trust fails when policy assumes the inventory is complete but the CMDB still lacks unmanaged devices or current exposure context.
👉 Read our full editorial: AI-driven CMDB accuracy exposes the cost of stale device data
This post was modified 6 days ago by NHI Mgmt Group