Assets¶
An asset is anything that can carry a weakness. Everything else in NxSAM hangs off the asset inventory: audits are run against assets, findings belong to assets, and reporting is grouped by them. If the inventory is wrong, everything built on it is wrong too.
The six kinds of asset¶
| Type | What it covers |
|---|---|
| Web Applications | Websites and web-based systems, identified by URL |
| Mobile Applications | iOS and Android apps, identified by package or bundle |
| Thick Clients | Installed desktop software |
| API Assets | Service endpoints assessed separately from the applications using them |
| Network Assets | Hosts, servers and network devices, identified by IP or hostname |
| Container Assets | Container images, identified by repository and tag |
The type determines which security module assesses it and which scanners can contribute findings. It is set when the asset is created and is not something to change casually — existing findings are attached to the asset as it was classified.
What an asset record carries¶
1 module and screen · 2 filters · 3 inventory columns
Beyond its name and identifier:
- Ownership — who is responsible for fixing things found on it. This drives who sees the asset and who is chased when findings age.
- Business context — organisation, business unit, project. Used for grouping and reporting rather than access.
- Environment — production, UAT, staging, development.
- Criticality — how much the business depends on it.
Criticality is not severity
Criticality describes the asset: how much damage its compromise would cause. Severity describes a finding: how serious that particular weakness is.
A Low severity finding on a Critical asset and a Critical finding on a Low asset are very different situations, which is why both are recorded.
Ownership determines visibility¶
NxSAM shows people the assets they are responsible for. An asset owner sees their own applications and the findings on them; a security analyst sees the estate.
This has a practical consequence worth knowing before raising a ticket: if a colleague cannot see an asset you can, that is ownership and permissions working as designed. The remedy is an ownership or role change, not a data fix.
Keeping the inventory current¶
Assets reach NxSAM three ways:
- Created directly, one at a time.
- Imported in bulk, from a spreadsheet.
- Synchronised from a source of truth such as a CMDB, where configured.
Where synchronisation is in place, treat the source system as authoritative and make changes there — a local edit will be overwritten on the next sync.
Decommissioning¶
Assets that no longer exist should be decommissioned rather than deleted. Decommissioning removes the asset from active tracking while preserving its history, so past findings and reports remain intelligible.
Deleting is a soft operation too — the record is hidden, not destroyed — which is why a deleted asset's name can still appear on historical findings and older reports.