The Atlas take.
runZero emphasizes asset discovery through network exploration, passive evidence, and integrations. It is useful when agent inventories and management systems describe only the equipment already under control. Current documentation also describes exposure checks and imported vulnerabilities, so scope should be established at the feature level rather than reduced to a network sweep. Atlas analysis: evaluate whether it discovers an unknown asset, identifies it credibly, and sends that evidence into ownership and remediation. Discovery breadth does not itself prove the depth of every vulnerability assessment.
02 / DEFINE THE BOUNDARY
What you are actually evaluating.
The product still publishes as runZero. An 18 June 2026 agreement for Accenture to acquire runZero and NetRise is distinct from a majority investment in Dragos; completion was not established in reviewed sources. Safe operational-technology scanning remains an evaluation item.
Names you may encounter runZero Community Edition. Historical names do not establish current feature equivalence.
03 / THE CONTROL PATH
Where it sits. How it works.
Atlas interpretation: Explorers and integrations gather network and source-tool evidence; the console correlates assets and exposure observations for follow-up.
- 01
Explorers and passive evidence
Deployed engines scan reachable networks or collect supported passive observations.
- 02
Asset and exposure inventory
Fingerprints and imported records enrich the same investigation surface.
- 03
Operational follow-up
Owners confirm unknown equipment and route vulnerability or control-gap work.
04 / WHAT EARNS ITS PLACE
Strengths, with the evidence attached.
Atlas analysis of documented capabilities; availability and behavior depend on the edition and environment.
Discovery is independent of endpoint enrollment
Getting-started guidance deploys an Explorer and scans explicitly selected network ranges.
Different evidence sources can be combined
Inbound integrations enrich assets from endpoint, vulnerability, cloud, and other systems; exposure documentation distinguishes detection methods.
Inspect the documented capability notes
- Agentless active, passive, and integration inventory across information technology, operational technology, and Internet of Things assets.
- Hosted external discovery engines and query-based vulnerability matching on discovered services.
- Version 5.0 verified-remediation workflow, with a Community Edition available beside commercial deployment.
05 / KNOW THE COMPROMISES
The tradeoffs to take seriously.
Architectural implications and procurement questions from Atlas; these are not independently measured product failures.
Placement defines visibility
Atlas analysis: each segmented or remote environment needs an intentional reachability plan, with excluded ranges visible.
06 / FROM PURCHASE TO PRACTICE
Make it work in your environment.
A proposed implementation sequence. Confirm supported versions, permissions, and rollback with the current documentation.
- 01
Start with a known subnet
Include a managed workstation, server, printer, and authorized unmanaged lab device.
- 02
Add source integrations
Compare imported identifiers and timestamps with network observations before broad rollout.
- 03
Create an owner-resolution path
Agree how unknown devices are classified, escalated, and rescanned after a change.
07 / THE OPERATING COMMITMENT
The bill is only part of the cost.
Commercial shape
Confirm platform tier, counted asset population, integrations, and deployment options using the expected network estate.
- Discovered asset population and platform tier
- Explorer hosting and network access
- Integration and operational rollout effort
08 / COMPARE THE JOB
Put these beside it.
Alternatives worth examining for the same problem. Check each offering’s scope before treating it as a substitute.
Axonius Cyber Assets and Exposures
Compare when reconciling existing security and IT inventories is the dominant job rather than independent network discovery.
TenableTenable One
Compare when broader vulnerability assessment and exposure analytics should share a suite with asset discovery.
09 / MAKE THE DECISION OBSERVABLE
Earn confidence through a real evaluation.
Suggested by Atlas. Agree acceptance criteria, use synthetic fixtures in an authorized environment, and capture both useful work and failed controls.
- TEST 01
Find an authorized unknown
Acceptance evidence: Place a lab device absent from management tools and retain its discovery and identification evidence.
- TEST 02
Test a segmented network
Acceptance evidence: Demonstrate reachability limits and the additional Explorer placement required for coverage.
- TEST 03
Reconcile a changed device
Acceptance evidence: Rename or readdress a test device and inspect whether identity and history remain understandable.
START WITH ONE EXERCISE
On a lab segment you own, run authorized agentless discovery against planted IT hosts and a representative non-production operational-technology or Internet of Things device approved for testing.
Evidence to look for: Planted hosts appear in inventory, query-based findings are labeled distinctly from any credentialed scanner evidence, operational-technology collection stays inside the approved window, and documentation still names runZero as the publishing product.
Questions to bring to the vendor
- What scan modes are safe on representative operational-technology devices, and who authorizes them?
- How do query-based matches correlate with authenticated scanner evidence on the same host?
- Which legal entity, brand, and support path are named in the contract for this deployment?
10 / SHOW THE WORK
Evidence, and what is still unknown.
What this research cannot establish
- No independent fingerprint accuracy or scan-impact benchmark was conducted.
- Protocol depth and safe settings require validation for fragile or operational devices.
Dossier research reviewed October 18, 2026. Earlier profile references are retained for traceability; products and commercial terms change.
- runZero 5 announcement ↗Earlier profile reference
- Accenture, Dragos, and runZero agreement ↗Earlier profile reference
- runZero getting started ↗Documentation
- Inbound integrations ↗Documentation
- Exposure management methods ↗Documentation
KEEP BUILDING YOUR JUDGMENT