IT Hygiene and Endpoint Visibility: What to Inventory and How Often

Endpoint visibility means knowing, at any hour, which devices exist, what runs on them, who signs in to them and whether each one still reports in. IT hygiene is the routine that keeps that picture accurate. This guide covers the four inventories worth keeping, how often CIS Controls v8.1 and CISA say to check each one, and where an EDR sensor such as CrowdStrike Falcon and an RMM agent each fit.

• Four inventories. Devices, software, accounts and endpoint telemetry, each with its own source of truth.
• Cadence. CIS Controls v8.1 asks for daily active discovery, weekly handling of unauthorized devices, monthly review of unauthorized software and quarterly account validation.
• Stale devices. A device that has not checked in for 30 to 90 days is the usual flag, and Microsoft advises disabling it before deleting it.
• CrowdStrike's framing. Falcon Discover is the module CrowdStrike calls its IT hygiene solution, and Falcon for IT adds live endpoint state on the same sensor.
• RMM overlap. An RMM agent already holds hardware, software and check-in data, while an EDR sensor adds account activity and process-level telemetry.

What IT Hygiene and Endpoint Visibility Mean

Endpoint visibility is a question with a timestamp on it: which devices are on the network now, and what is each one doing. IT hygiene, also called security hygiene, is the recurring work that keeps the answer correct. That means finding devices nobody enrolled, removing software nobody approved, disabling accounts nobody uses and retiring records for machines that have left the building. The two terms travel together because neither works alone. A complete inventory that nobody reviews drifts within a quarter, and a review routine fed by poor data reviews the wrong list.

Endpoint telemetry is the raw material underneath both. It is the stream of events an agent reports from each device: processes starting, network connections, files written, sign-ins and configuration changes. An RMM agent reports a slice of that stream, mostly hardware, installed software and health. An EDR sensor reports much more of it, continuously, because detection needs the full sequence of events, which our guide to EDR vs XDR explains. For hygiene, the same stream answers plainer questions, such as which laptops still run a browser version that is out of support.

CrowdStrike uses the hygiene vocabulary directly across the Falcon platform. Its data sheet calls Falcon Discover "CrowdStrike's IT hygiene solution" and organises it around three entity types: assets, applications and accounts. That three-part list is a sound template for any team, whichever tools it runs, with one addition covered in the next section.

The Four Inventories to Keep

Each inventory answers a different question and usually lives in a different system. The table lists what to record and where the record normally comes from.

The fields in the first three rows come from the CIS Controls v8.1. Safeguard 1.1 asks the device inventory to record network address, hardware address, machine name, owner and department, and to include devices that connect to the network even when the organisation does not control them. Safeguard 2.1 asks the software inventory for title, publisher, initial install date and business purpose. Safeguard 5.1 asks the account inventory for name, username, start and stop dates and department.

The fourth inventory is the one CIS spreads across several controls, from secure configuration to vulnerability management, and it is the one an EDR sensor fills best. Disk encryption status, a stopped firewall service or an agent that has quietly stopped reporting are configuration facts, not asset facts, and they change daily. Our Falcon sensor guide covers what that agent collects on Windows, macOS and Linux.

How Often to Check Each Inventory

The CIS Controls put a minimum cadence on most hygiene tasks, and they are a widely cited public benchmark for small and mid-sized teams. The table collects the safeguards that set a schedule, read from the v8.1 text in November 2026.

US federal civilian agencies work to a tighter clock. CISA's Binding Operational Directive 23-01 requires automated asset discovery every 7 days across the agency's whole IPv4 space, and vulnerability enumeration every 14 days across every discovered asset, roaming laptops included. It does not bind private companies, but it is a useful ceiling when a client in a regulated sector asks what "regular" means.

Both sets of numbers were written with periodic scanners in mind. An agent-based inventory updates itself continuously, so the cadence shifts from collecting data to deciding what to do with it. What stays on the calendar is the human step: someone approves the new device, removes the unapproved tool and disables the account of the person who left in September. Our CTEM explainer applies the same continuous approach to vulnerabilities.

Finding Stale and Unmanaged Devices

A stale device is a record for a machine that no longer checks in. Microsoft gives two reference points. Intune's device cleanup rules hide any device that has not checked in for a number of days you choose between 30 and 270. Entra ID's guidance on stale devices uses 90 days in its example script, and notes that the activity timestamp only updates when it is more than 14 days old, plus or minus five days, so it is an approximation rather than a live value.

The same guidance sets three safe-handling rules worth copying into any process. Disable a stale device for a grace period before deleting it, because a deletion cannot be undone when the device turns out to be in a drawer. Check that BitLocker recovery keys are backed up or no longer needed before deletion. Leave system-managed devices such as Autopilot records alone, since deleting them stops the device being provisioned again.

The same tension shows up with laptops that never come back. In an October 2026 r/sysadmin thread with 34 comments, an admin holding hundreds of locked, unreturned devices that still count against licences asked how long to keep the records, and suggested a year.

Unmanaged devices are the opposite problem: machines on the network that no tool knows about. The reliable way to find both kinds is to compare three lists that should match and never quite do. The directory knows every device that has joined. The management agent, an RMM or MDM, knows every device it patches. The security agent knows every device it protects. Each mismatch has a meaning.

Shelved devices are the gentler version of the same problem. An r/msp thread from August 2025, with 38 comments, asks how to park laptops that sit in storage between users: stop paying for antivirus and RMM licences while they wait, without losing track of them when they come back into service.

How CrowdStrike Approaches IT Hygiene

CrowdStrike sells hygiene as two modules on the Falcon sensor. Falcon Discover is the older one. Its data sheet lists what it tracks under three headings: assets added to or removed from the environment, drive encryption status and resource usage; accounts in use, domain or local credential access and password changes; and installed applications with how they are used. It also flags assets that are not running a Falcon sensor, so the module doubles as a list of where to install it next. The data sheet notes that Discover requires Falcon Insight, CrowdStrike's EDR module.

Discover now sits inside Falcon Exposure Management, which adds active asset discovery through non-intrusive network scans, network vulnerability assessment and attack path analysis. Our post on CrowdStrike vulnerability management maps the old module names to the current ones.

Falcon for IT is the newer module, aimed at the operational side. CrowdStrike's product page describes it as showing the real-time state of every endpoint across applications, configurations, performance and risk, using the existing sensor with CrowdStrike-managed osquery and Python on Windows, macOS and Linux. Its listed use cases include software visibility, software bills of materials, AI tool discovery and Windows Secure Boot readiness, and CrowdStrike positions it as a complement to UEM and MDM tools rather than a replacement.

For the security team, that means hygiene queries run on the agent it already manages. For IT, it means a second console holding data the RMM also holds. Our Falcon for IT review covers where that overlap helps and where it duplicates work.

Neither module comes in the self-serve bundles. On 9 November 2026 CrowdStrike's pricing page listed IT Hygiene as a feature line on the Falcon Go, Pro and Enterprise cards, at $59.99, $99.99 and $184.99 per device a year, but marked it as included in none of them. It is quoted as an add-on, as are Exposure Management and Falcon for IT, either per endpoint or inside a Falcon Flex commitment.

The practical effect is that a Falcon Enterprise customer already has the sensor data hygiene needs, while the dashboards and queries that organise it are a separate line on the quote. Our CrowdStrike pricing guide breaks down what each bundle contains.

CrowdStrike's own three-minute walkthrough of the Discover dashboards for computers, applications and accounts dates from April 2021. The module has moved under Exposure Management since then, but the views it shows are the same three inventories this guide describes.

What an RMM Agent Already Covers

An RMM agent is an inventory tool by default, because it cannot patch or script a device without knowing what is on it. It records hardware details such as processor, memory, disk and serial number, the installed software list, operating system and patch level, and the time of its last check-in. Network discovery over SNMP, a common RMM feature, picks up the printers, switches and other devices no agent can run on. Our explainer on what an RMM is covers the rest of the toolset.

The EDR sensor and the RMM agent overlap on devices and software and differ on the rest. The sensor sees account activity and process-level events that an RMM does not collect. The RMM sees network gear, holds per-client records and runs the fix. Neither one is a full asset register with purchase dates and warranty terms, which is the job of the tools in our IT inventory management software guide.

For an MSP, the RMM is the natural system of record, because it is already organised by client and already does the remediation. OpenFrame, an open, AI-native platform with its own RMM, keeps device and software inventory, check-in history and scripted fixes per client at $1 per device a month with 10 million AI tokens included, per the OpenFrame pricing page. Flamingo builds OpenFrame, which competes with some of the tools covered here. Whichever RMM holds the record, the EDR console is the cross-check that catches what the RMM cannot see.

A Weekly Hygiene Routine That Fits in an Hour

A routine survives when it is short and attached to a fixed slot. This one covers the CIS minimums for a team of one or two.

1. Every Monday, compare the three device lists. Export the directory, the RMM or MDM and the EDR console, match on hostname or serial number, and work the mismatch table above.
2. Clear every unmanaged device the same week. Enrol it, block it or document why it stays, which is what CIS 1.2 asks for weekly.
3. Flag devices silent for 30 days. Confirm with the owner, disable the record, and delete only after the grace period.
4. First Monday of the month, review software. Pull the unauthorized and end-of-support titles, remove or document each one, and check patch compliance for the month.
5. First Monday of the quarter, review accounts. Validate every active account against HR's list and disable anything dormant for 45 days.
6. Every six months, sign off the full inventory. Send each owner the list of devices and software in their name and record the reply.

Who Needs What

For an in-house IT team on Falcon Enterprise. The sensor already supplies device, software and telemetry data, so the gap is usually account review and the remediation step. Falcon Discover or Falcon for IT makes sense when the security team owns hygiene and wants it in one console. When IT owns it, the RMM or MDM plus a weekly export from the Falcon console covers the same checks, and Falcon Firewall Management reports host firewall state from the same sensor.

For an MSP. Keep the inventory in the RMM, per client, and use each client's EDR console as the cross-check. The weekly three-list comparison is the step that turns two agents into one accurate picture.

For a small team without an EDR. Intune cleanup rules, an RMM software report and a quarterly account review cover the device, software and account inventories. Telemetry is the piece that stays thin until an EDR sensor is in place, and even the entry Falcon Go bundle adds prevention rather than EDR telemetry.

The short answer: keep four inventories, check them on the CIS schedule, and reconcile the directory, the management agent and the security agent every week. The tools differ in what they see, and the routine is what makes their records agree.

Keywords: endpoint visibility, it hygiene, security hygiene, endpoint telemetry, stale devices, unmanaged devices, it asset inventory cadence