Skip to content
ENExplore Calculators

Scanner Coverage Calculator

Work out real scan coverage from inventory gaps, authenticated scan depth and scan freshness, and count the assets you never see.

About Scanner Coverage Calculator

Raw coverage flatters everyone, because it divides by the inventory that is itself incomplete. Dividing by the real estate fixes the denominator; the depth factor then discounts unauthenticated scanning, which typically detects a minority of the findings an agent sees; and the freshness factor discounts stale data. A programme reporting 84% raw coverage commonly has effective coverage nearer half that. You cannot patch what you never scanned, and every large breach post-mortem that blames an unpatched host is really a story about an asset that was not in the inventory.

Formulas

Scanner Coverage

Effective coverage = (scanned ÷ real estate) × (0.5 + 0.5 × authenticated share) × (target interval ÷ actual interval), where the real estate is the inventory plus the assets you know are missing from it.

real estate
Inventoried assets plus discovered-but-unmanaged assets
authenticated share
Credentialed or agent-based scans as a share of all scans
freshness
Target interval ÷ actual interval, capped at 100%

Depth discount

Depth factor = 0.5 + 0.5 × authenticated share, so an entirely unauthenticated programme is credited with half the coverage it claims.

Worked example

With the default values below, Scanner Coverage Calculator returns Effective Coverage of 32.46%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Assets in the inventoryaccepts 1–1,000,000 assets
320 assets
Estimated assets missing from the inventoryaccepts 0–1,000,000 assets
25 assets
Assets scanned in the last cycleaccepts 0–1,000,000 assets
268 assets
Of those, scanned with credentials or an agentaccepts 0–1,000,000 assets
180 assets
Actual scan intervalaccepts 1–365 days
14 days
Target scan intervalaccepts 1–365 days
7 days

Results

Effective Coverage
32.46%
Raw Coverage of Known Assets
83.75%
Coverage of the Real Estate
77.68%
Authenticated Scan Depth
67.16%
Scan Freshness
50.0%
Assets Never Scanned
77 assets
Weakest Link
Inventory — 25 assets are not in the CMDB, so they can never be scanned

Step by step

  1. 1Values used
  2. 2Scanner Coverage
  3. 3Depth discount
  4. 4Effective Coverage= 32.46
  5. 5Raw Coverage of Known Assets= 83.75
  6. 6Coverage of the Real Estate= 77.68
  7. 7Authenticated Scan Depth= 67.16
  8. 8Scan Freshness= 50.0
  9. 9Assets Never Scanned= 77 assets

Assumptions and limits

  • The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Scanner Coverage calculated?

Effective coverage = (scanned ÷ real estate) × (0.5 + 0.5 × authenticated share) × (target interval ÷ actual interval), where the real estate is the inventory plus the assets you know are missing from it. Raw coverage flatters everyone, because it divides by the inventory that is itself incomplete. Dividing by the real estate fixes the denominator; the depth factor then discounts unauthenticated scanning, which typically detects a minority of the findings an agent sees; and the freshness factor discounts stale data. A programme reporting 84% raw coverage commonly has effective coverage nearer half that.

Why does Scanner Coverage matter?

You cannot patch what you never scanned, and every large breach post-mortem that blames an unpatched host is really a story about an asset that was not in the inventory.

What values do I need to enter?

This calculator takes 6 inputs: Assets in the inventory, Estimated assets missing from the inventory, Assets scanned in the last cycle, Of those, scanned with credentials or an agent, Actual scan interval, Target scan interval. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

How do I estimate the assets missing from my inventory?

Reconcile independent sources: DHCP leases, DNS records, switch ARP tables, cloud provider APIs, EDR enrolment and the CMDB. Anything present in two of them and absent from the CMDB is a genuine gap, and the count is usually higher than anyone expects.

Is agent-based scanning always better?

For depth, yes — it sees installed packages, configuration and running processes. But agents miss appliances, printers and unmanaged devices entirely, so mature programmes run both and reconcile the two views rather than choosing one.

Related Calculators

Scanner Coverage Calculator – Calculate Effective Coverage