Scanner Coverage Calculator

Effective coverage = (scanned ÷ real estate) × (0.5 + 0.5 × authenticated share) × (target interval ÷ actual interval), where the real estate is the inventory plus the assets you know are missing from it. Raw coverage flatters everyone, because it divides by the inventory that is itself incomplete. Dividing by the real estate fixes the denominator; the depth factor then discounts unauthenticated scanning, which typically detects a minority of the findings an agent sees; and the freshness factor discounts stale data. A programme reporting 84% raw coverage commonly has effective coverage nearer half that.

You cannot patch what you never scanned, and every large breach post-mortem that blames an unpatched host is really a story about an asset that was not in the inventory.

This calculator takes 6 inputs: Assets in the inventory, Estimated assets missing from the inventory, Assets scanned in the last cycle, Of those, scanned with credentials or an agent, Actual scan interval, Target scan interval. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Reconcile independent sources: DHCP leases, DNS records, switch ARP tables, cloud provider APIs, EDR enrolment and the CMDB. Anything present in two of them and absent from the CMDB is a genuine gap, and the count is usually higher than anyone expects.

For depth, yes — it sees installed packages, configuration and running processes. But agents miss appliances, printers and unmanaged devices entirely, so mature programmes run both and reconcile the two views rather than choosing one.