SECURITY ATLAS / EVALUATION BRIEF runZero Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/runzero/ THE ATLAS TAKE runZero emphasizes asset discovery through network exploration, passive evidence, and integrations. It is useful when agent inventories and management systems describe only the equipment already under control. Current documentation also describes exposure checks and imported vulnerabilities, so scope should be established at the feature level rather than reduced to a network sweep. Atlas analysis: evaluate whether it discovers an unknown asset, identifies it credibly, and sends that evidence into ownership and remediation. Discovery breadth does not itself prove the depth of every vulnerability assessment. SCOPE The product still publishes as runZero. An 18 June 2026 agreement for Accenture to acquire runZero and NetRise is distinct from a majority investment in Dragos; completion was not established in reviewed sources. Safe operational-technology scanning remains an evaluation item. WORTH A LOOK WHEN Organizations seeking independent visibility into unmanaged, transient, or unusual network-connected assets. THINK TWICE WHEN The team assumes discovery fingerprints alone replace every credentialed scanner, endpoint agent, and operational owner. IMPLEMENTATION 1. Start with a known subnet Include a managed workstation, server, printer, and authorized unmanaged lab device. 2. Add source integrations Compare imported identifiers and timestamps with network observations before broad rollout. 3. Create an owner-resolution path Agree how unknown devices are classified, escalated, and rescanned after a change. OPERATING REALITY Explorers need placement, reachable network scope, update management, and carefully selected scan settings. Integrations run on their own schedules. Atlas analysis: network reachability is a coverage boundary; an absent device may be unreachable rather than nonexistent. Reconcile results with owners before initiating disruptive remediation. COMMERCIAL CONSIDERATIONS Confirm platform tier, counted asset population, integrations, and deployment options using the expected network estate. - Discovered asset population and platform tier - Explorer hosting and network access - Integration and operational rollout effort EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Find an authorized unknown Acceptance evidence: Place a lab device absent from management tools and retain its discovery and identification evidence. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Test a segmented network Acceptance evidence: Demonstrate reachability limits and the additional Explorer placement required for coverage. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Reconcile a changed device Acceptance evidence: Rename or readdress a test device and inspect whether identity and history remain understandable. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - What scan modes are safe on representative operational-technology devices, and who authorizes them? - How do query-based matches correlate with authenticated scanner evidence on the same host? - Which legal entity, brand, and support path are named in the contract for this deployment? EVIDENCE GAPS - No independent fingerprint accuracy or scan-impact benchmark was conducted. - Protocol depth and safe settings require validation for fragile or operational devices. SOURCES runZero getting started (Documentation) https://help.runzero.com/docs/getting-started/ Inbound integrations (Documentation) https://help.runzero.com/docs/integrations-inbound/ Exposure management methods (Documentation) https://help.runzero.com/docs/exposure-management/ Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.