Yes. Before you shortlist anything, list every security tool you already pay for or run, who owns it, what it covers and where it overlaps. The inventory often shows that you need fewer new tools than you thought, or that the real gap is configuration and ownership, not a missing product.
What to capture
| Column | Question it answers |
|---|---|
| Tool and version | What is it, exactly? |
| Owner | Who is accountable for it by name? |
| Purpose | Which risk was it bought to address? |
| Coverage | Which repos, clouds, teams and ecosystems does it reach today? |
| Output | Where do findings go, and who triages? |
| Renewal date | When can we change course without penalty? |
| Usage | Do people open it weekly, monthly, never? |
| Overlap | Which other tool reports the same thing? |
Add a column for "would we buy it again?" It is subjective, and it is worth asking.
Five steps
- Collect from three sources. Procurement records, cloud and identity admin consoles, and a short survey to engineering leads. Each source finds tools the others miss.
- Fill the columns. Leave blanks visible. A blank owner is an important result.
- Map to your requirements. Put your must-have list across the top and mark which current tool, if any, meets each one.
- Mark overlap and gaps. Overlap means two tools doing the same job. A gap means a requirement nobody covers.
- Sort into four actions. Keep, fix configuration, replace, retire.
What the inventory usually reveals
- Shelfware. Licensed tools that nobody opens.
- Partial rollout. A scanner that covers half the repos because onboarding stalled.
- Alerts without owners. Findings that flow into an inbox nobody reads.
- Overlap in noisy areas. Two tools reporting the same vulnerable library with different severities.
None of these is fixed by buying a third tool. Some are fixed by turning on what you already own.
How it shapes the shortlist
- If the gap is coverage of an ecosystem, your knockout question is about that ecosystem.
- If the problem is noise, your requirements focus on prioritization and evidence.
- If the problem is ownership, no vendor will solve it, and your RFP should say so honestly.
You also learn your renewal dates, which tell you how fast a switch can happen.
A worked example: a twelve row inventory
A company of about 150 engineers fills the inventory and finds this:
| Tool | Owner | Coverage | Usage | Overlap | Action |
|---|---|---|---|---|---|
| Dependency scanner A | Platform | 60 percent of repos | Weekly | Overlaps with built-in alerts in source control | Fix rollout |
| Source control alerts | None named | All repos | Rarely opened | Overlaps with scanner A | Assign owner |
| Container scanner | Platform | Production images only | Weekly | None | Keep |
| Static analysis | Security | Two languages | Monthly | None | Review fit |
| Pre-commit hook checker | Security | Some teams | Unknown | None | Review adoption |
| Vendor questionnaire spreadsheet | Compliance | All vendors | Quarterly | None | Replace |
| Cloud posture dashboard | Cloud team | All accounts | Daily | None | Keep |
| Logging platform | Ops | All services | Daily | None | Keep |
| Awareness training | HR | All staff | Annual | None | Keep |
| Policy documents folder | Compliance | Partial | Annual | None | Refresh |
| Old scanner B | Nobody | Unknown | Never | Overlaps with A | Retire |
| Ticket queue for findings | Engineering | Partial | Daily | None | Keep |
The result is not "buy a new scanner." It is "finish the rollout of scanner A, assign an owner to source control alerts and retire scanner B," plus a possible gap in evidence and questionnaire handling. A shortlist built from this inventory targets the real gaps.
Questions that sharpen the inventory
- If this tool disappeared tomorrow, who would notice, and when?
- When did a finding from this tool last change someone's work?
- What would break in an audit if we lost its records?
- Who pays the renewal and who uses it? Are they the same people?
Answers that begin with "I think" are signals that ownership is weak.
Turn gaps into requirements
For each gap, write a requirement in the language of the earlier posts in this series:
- Gap: only 60 percent of repos covered. Requirement: discovers repositories automatically and reports coverage as a number.
- Gap: alerts with no owner. Requirement: routes findings to owners from existing ownership data, and shows unowned findings.
- Gap: manual questionnaires. Requirement: stores reusable evidence and answers.
These requirements come from your reality, so vendors respond to the problem you actually have.
Refresh yearly
Put the inventory on a calendar for review before each renewal cycle. It takes a few hours and often pays for itself by avoiding an unneeded renewal.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how findings are grouped and owned, then ask whether your current tools give you the same clarity about who handles what.
Quick check
Who should own the inventory?
Security usually coordinates, but each tool owner fills in their own row so the data is accurate.
How long does it take?
A few days for a mid-sized company, mostly waiting for replies from owners.
What if we discover a tool nobody owns?
Assign an owner within a week or schedule it for retirement. An unowned security tool generates findings no one reads and sometimes holds credentials no one reviews.
Once your gaps are clear, you can test candidates against them. Safeguard's GA capabilities include dependency scanning, SBOMs, asset discovery and reachability analysis, and the free scan at https://gold.safeguard.sh/scan lets you check one repo before committing time.
Last reviewed: 19 October 2026.
