Reconciling device records before prioritising vulnerabilities
Keep source evidence, confidence and unresolved conflicts visible.
The scanner reports one firmware version, the CMDB another. Before assigning a vulnerability to that device, the security team needs to establish which record is current and which asset it describes. Reconciliation links the available evidence and flags conflicts or missing information for investigation.
Device record reconciliation
SC-CY-03 · REV A · 2026.07
Collect
source and timestamp
Recheck
changes and exceptions
Validate
identity and uncertainty
Assess
advisory and context
Accuracy and operating benefits must be measured in the prospect’s evaluation.
Retain the original source records
Record where each observation came from and when it was collected. IP addresses can change, names can be reused and several records can belong to one physical device. Use appropriate identifiers and context to propose matches. Preserve the source information so an incorrect merge can be investigated and reversed.
Validate identity and version
Check vendor, model, hardware revision and firmware where relevant. Separate confirmed values from inferred or missing ones. A matching score needs a definition and a validation method; it is not automatically a probability that the record is correct. Measure false matches and missed matches on a sample that represents the organisation’s estate.
Connect findings to their evidence
For each vulnerability or lifecycle finding, retain the source advisory and affected-version logic. Check applicability to the actual configuration and network exposure. A public vulnerability entry, a manufacturer advisory and an intelligence service may each contribute useful information. Do not treat an unresolved model or firmware field as an exact risk assessment.
Assign owners for device records and corrections
Assign owners for conflicts, exceptions and rechecks after upgrades or equipment replacement. Feed approved records into the organisation’s ticketing and change process using integrations that have actually been tested. Define measures such as validated-match rate, unresolved records and time to investigate. Present proposed measures as evaluation criteria, not promised customer outcomes.
// Key Takeaways
What to remember
- Keep provenance and uncertainty with each reconciled record.
- Validate matching accuracy on representative assets.
- Use traceable findings to support an owned remediation process.
// FAQ
Frequently asked questions
Does a 98% confidence label establish 98% accuracy?
Not without a definition, validation sample and measured results. Review the meaning of the score and test incorrect and missed matches on the customer’s records.
What should remain visible after records are merged?
Source records, collection times, confirmed and inferred identity fields, uncertainty and a way to correct the merge. Those are needed to investigate a disputed finding.
Last updated:
Prepare a device inventory evaluation with Japanese prospects.
Show how your product matches device identifiers and records uncertainty. Our engineers can coordinate a trial against the prospect’s inventory, clarify unresolved matches with your team and agree the scope of local support.