CMDB accuracy and unmanaged devices: what changes for security teams?

TL;DR: CMDB accuracy breaks down when devices move, change firmware, or connect without logging, according to Ordr, and Gartner found 80% of CMDB projects add no business value while 42% of enterprise devices are unmanaged and agentless. The governance problem is not the CMDB platform itself but the absence of continuous device discovery, enrichment, and reconciliation.

Editorial analysis by NHI Mgmt Group, based on content published by Ordr: “How to Use AI to Feed & Maintain Your CMDB”.

By the numbers:

• Gartner found that 80% of CMDB projects add no business value.
• According to ORDR's 2024 Rise of the Machines report, 42% of enterprise devices are unmanaged and agentless.
• Those unmanaged and agentless devices carry 64% of mid-to-high level risks.

Key questions

Q: What breaks when a CMDB is treated as a single source of truth but the data is stale?

A: A stale CMDB creates false confidence.

Q: Why do unmanaged devices create a governance gap for IAM and compliance teams?

A: Unmanaged devices break the assumption that identity alone is enough to establish trust.

Q: How do teams know if CMDB reconciliation is actually working?

A: Reconciliation is working when duplicate configuration items fall, missing assets are discovered quickly, and downstream systems receive the same verified inventory without manual correction.

Practitioner guidance

• Implement passive device discovery Use network-observed discovery to cover unmanaged IoT, OT, and medical devices that agents cannot reach, then compare coverage against the current CMDB.
• Automate CMDB reconciliation Connect discovery outputs to a reconciliation process that creates, updates, and deduplicates configuration items before downstream tools consume them.
• Add behaviour-based asset context Enrich each record with firmware, OS, function, exposure, and dependency information so risk scoring and response workflows use real context.

Bottom line: Stale CMDB records create a governance gap because policy enforcement depends on accurate device identity and current asset context.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →