Asset Inventory

This is the help text the console shows in the help panel on this page.

The central registry for every system, application, or resource whose access you monitor or certify. Assets are grouped into tabs based on their origin — COTS, In-House, SaaS, OSS, Hardware Device and Domain Name (plus All Assets) — so you can apply appropriate governance policies to each class.

Quick-Filter Cards

Five preset cards at the top of each tab give an instant health snapshot:

• Assets — full count for the active tab.
• Critical — assets flagged as highest business impact.
• High Risk — assets rated HIGH criticality.
• Missing Owner — assets with no assigned owner; these create compliance blind spots.
• Service Accounts — non-human identities (bots, automation, API keys) tracked separately.

Click any card to filter the table to that subset.

Adding Assets

Three methods are available:

• Add manually — opens a side drawer to fill in all details by hand.
• Add single (AI) — launches the Asset Wizard; enter a website URL or the name of a service (the catalog suggests known ones) and AI pre-fills the form.
• Import list (AI Discovery) — upload a PNG, JPG, PDF, or CSV (up to 5 MB) from any SaaS tool or spreadsheet; AI extracts and creates multiple assets in one pass.

On the Hardware Device tab, Import Hardware List uploads a device list (CSV, PDF, image or plain text, up to 10 MB) and lets you map its columns to asset fields before importing.

Table Actions

• Search — filters by asset name across the active tab.
• Tags — click any tag in the table to narrow the view to assets with that tag.
• Hardware Filters — when the Hardware Device tab is active, additional filters for Location and Operating System become available.
• CSV / PDF — downloads the current filtered view as a CSV file or a PDF report.
• Refresh — re-fetches assets and employees without a full page reload.
• Owner link — click an owner’s name to open their Employee Profile in a drawer.

Asset Details

Click a row to open the details drawer. Its tabs are General (owner, supplier, criticality, tags, website, version, data classification, description), Identity (human or service account), Hardware (hardware devices only: make, model, hostname, serial number, OS, location, assigned employee, device status and security posture), Domain (domains only: registrar, expiration date, auto-renew) and Audit History (saved assets).

AutoCISO sends a notification when a domain asset expires within 45 days, unless Auto-renew enabled is switched on.

Asset Tabs

Why This Matters

A complete, correctly classified inventory is a prerequisite for every access review cycle. Missing assets create blind spots where unauthorized access can persist undetected. Assigning the right criticality ensures high-risk systems get prioritized during certification campaigns.

Fields

Asset Kind

Classifies how the asset is delivered or sourced:

• COTS — Commercial Off-The-Shelf software installed on-premises or self-hosted.
• In-House — Applications built and maintained by your own engineering team.
• SaaS — Cloud-based services delivered via subscription or API (e.g., Okta, Salesforce, GitHub).
• OSS — Open-source libraries or frameworks used as a component or dependency.
• Hardware — Physical devices, servers, workstations, and networking equipment.
• Domain — Registered internet domain names (e.g., example.com).

The selected kind determines which inventory tab the asset appears in.

Asset Name

The display name shown in the inventory table and in access review campaigns. Use the name that reviewers will immediately recognize.

Examples: AWS Production, Corporate Gmail, GitHub, Jira, Salesforce.

Website

The primary URL for the asset — typically the login or admin portal. Shown as a clickable link in the inventory table.

Format: full URL including the scheme, e.g. https://app.example.com.

Identity Type

Specifies the kind of identities this asset manages:

• Human — standard workforce accounts (employees, contractors, service users).
• Service Account — non-human identities: bots, automation pipelines, API integrations, and scheduled jobs.

Choosing Service Account reveals two additional fields: Credential Type and Privileged Access.

Credential Type

(Service Accounts only) The authentication mechanism used by this service account.

Common values: API Key, OAuth 2.0, SAML, Personal Access Token, Username/Password, SSH Key, X.509 Certificate.

Start typing to see suggestions, or enter a custom value.

Privileged Access

(Service Accounts only) Check this if the account holds administrative, elevated, or broad-scope permissions.

Privileged service accounts are flagged separately in reports and may trigger stricter review policies or shorter rotation windows.

Tags

Free-form tags that classify the asset for reporting and policy targeting. You can apply multiple tags to a single asset.

Common tags: Production, Engineering, Finance, Personal Data, PCI, SOX, Critical, Legacy.

Type a value and press Enter or comma to add it. Click a tag in the inventory table to filter by that tag.

Asset Owner

The employee accountable for access decisions on this asset — typically the system owner, IT manager, or app lead.

Type at least one character to search the employee directory. The owner is linked to their full Employee Profile, which is accessible by clicking their name in the inventory table.

Assets with no owner appear in the Missing Owner filter.

Criticality

Rates the business impact if this asset is compromised or access is misused:

• CRITICAL — major legal, financial, or operational impact; data breach risk; core infrastructure.
• HIGH — significant operational risk; sensitive data; key business systems.
• MEDIUM — moderate sensitivity; disruption would be contained.
• LOW — minimal impact; non-sensitive, easily recoverable.

Criticality drives prioritization in access review campaigns and is used in risk dashboards.

Description

A short summary of the asset’s purpose, the type of data it holds, and who relies on it. Helps reviewers make informed access decisions without needing external context.

Example: Customer CRM containing contact details and purchase history. Managed by the Sales Operations team.

Serial Number

(Hardware only) The unique identifier assigned by the manufacturer. Helps track physical inventory and warranty status.

Physical Location

(Hardware only) Where the device is physically located (e.g., ‘NYC Office - 4th Floor’, ‘Data Center A’, ‘Remote - Employee Home’).

Operating System

(Hardware only) The operating system running on the device, entered as OS Name and OS Version (for example Windows 11, macOS, Ubuntu 22.04). The Operating System filter on the Hardware Device tab uses this value.

Assigned Employee

(Hardware only) The person currently in possession of or responsible for the device. Useful for offboarding and hardware recovery.

Data Classification

The sensitivity label of the data this asset holds, as free text (for example Confidential or Public). Helps reviewers judge how much a given access matters.