Your EDR says 98%. Your CMDB says 84%. Your IAM says 91%. All three are technically correct, all pulled within the hour, and none of them is endpoint coverage — until you decide which definition you are willing to defend.
It is Wednesday afternoon, the board deck is due Friday, and the endpoint coverage slide has a blinking cursor where the number should be. Your EDR console says 98%. Your CMDB says 84%. Your IAM platform says 91%. All three are technically correct. All three were pulled in the last hour. And all three are about to be defended by you, in person, to people who will remember whatever you write down.
This is not a corner case. This is the everyday reality of security reporting, and it is the moment where most metrics programs quietly lose their credibility.
The instinct is to call it a data quality problem and assign someone to reconcile the lists. That instinct is wrong, or at least incomplete. The three numbers disagree because the three tools are answering three different questions.
The EDR sees the population of machines that have phoned home with a healthy agent in the last seven days. The CMDB sees the population of assets that someone, somewhere, remembered to register and tag as in-scope. The IAM platform sees the population of devices that have authenticated a human in the recent past. None of these is endpoint coverage. Each of them is a proxy for endpoint coverage, shaped by the operational reality of the tool that produced it. The denominator problem goes deeper than any single tool can see.
This is why reconciliation alone never closes the gap. You can chase the delta between EDR and CMDB for a quarter, find a thousand stale records, retire half of them, and still end up with three different numbers next month. The drift is structural.
New laptops ship from IT before they hit the CMDB. Contractors authenticate through IAM on machines that will never be enrolled. Servers get decommissioned in one system and linger in another for ninety days. Every tool is honest about what it sees, and what it sees is governed by a workflow that nobody designed to produce a coverage metric.
The board does not want to hear any of this. The board wants one number, presented with confidence, trending in a direction that matches the narrative. The conversation about reconciliation, definitions, and tool semantics is a conversation that loses you the room.
So the question is not which of the three numbers is right. The question is which definition of coverage you are willing to commit to, defend across quarters, and apply consistently when the underlying tools change, get replaced, or quietly start counting differently.
In our experience, the most defensible choice anchors coverage to a denominator that the security team controls — typically the authoritative inventory of in-scope assets — and a numerator that requires evidence from at least two independent telemetry sources. The exact rule matters less than the discipline of writing it down, governing it like a control, and refusing to let a tool migration or a vendor swap silently move the number.
A coverage figure that survives a CMDB replacement is a coverage figure the board can trust. A coverage figure that jumps eleven points the quarter you switch EDR vendors is not a metric — it is a marketing artifact. A measurement system preserves not just the number but the definition history that makes the trend defensible.
This is the layer we sit in at Metric Maestro. We pick the definition with you, encode it once, and apply it consistently across every tool that feeds the number. When EDR coverage spikes because an agent rollout completed, we show you the underlying movement instead of letting the headline drift. When the CMDB grows by four hundred assets overnight, we explain the denominator change before someone in the audit committee asks.
One definition, one number, one trend line that means the same thing in March as it did in January. If your next board slide has three candidate numbers and no clear way to choose, that is the problem we exist to solve.
Whitepapers
In-Depth Comparisons
Metric Maestro vs Archer GRC
Archer is built for enterprise risk management. Metric Maestro is built for security leaders who need to prove the value of their program to the board.
Metric Maestro vs DIY Security Reporting
Most security teams start with spreadsheets. At some point, the cost of that choice becomes impossible to ignore.