Features included from Professional: Asset management, compare packages
Asset management
Your asset inventory as the common basis for compliance and security: IT and OT on one central platform, captured by agentless collection, with SBOM, vendor advisories and relationships.
- Capture
- Understand
- SBOM
- Risks
- Relationships
- Contracts and licences
- Zones
- Identities
- Reports and exchange
- Permissions
- FAQ
You cannot protect plants you do not know, and the knowledge is often scattered across spreadsheets, tool exports and people’s heads.
Agentless capture
Collector scripts instead of an agent
Readable scripts for Windows (PowerShell, cmd for older systems) and Linux. They only read, install nothing and write one file per system.
Signed, encrypted, verified
Files from the PowerShell and Linux scripts are signed and encrypted. Complass rejects altered, foreign or duplicate files. Import happens in bulk with a preview, also as a ZIP.
Reuse what you have
Import from the Excel/CSV template, from Zeek and Nmap and from CSV exports of common OT monitoring tools. Network captures (PCAP, PCAPNG) are analysed in your browser; the file does not leave your computer.
No duplicates
All import paths match centrally: serial number with vendor, MAC address, system UUID, hostname with domain. Unclear cases appear as “possible duplicate: check” and are never created automatically.
Discovered devices and vendors
The systems’ neighbour tables provide further devices as candidates, never directly as assets. If the vendor is missing, Complass suggests it from the public IEEE registry, marked “guessed (MAC)”.
From your tools
Asset connectors read inventory from NetBox, Snipe-IT, Intune, Lansweeper and OT tools.
Rollout via group policy
Template for the Windows task scheduler, plus instructions for group policy, systemd timers and cron.
Legal and normative basis
- IEC 62443-3-2
- IEC 62443-2-1
- ISO/IEC 27001:2022, A.5.9
- ISO/IEC 27001:2022, A.8.9
- § 30 BSIG§ 30 BSIG Risikomanagementmaßnahmen besonders wichtiger Einrichtungen und wichtiger Einrichtungen(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sind verpflichtet, geeignete, verhältnismäßige und wirksame technische und organisatorische Maßnahmen, die in Absatz 2 konkretisiert werden, zu ergreifen, um Störungen der Verfügbarkeit, Integrität und Vertraulichkeit der informationstechnischen Systeme, Komponenten und Prozesse, die sie für die Erbringung ihrer Dienste nutzen, zu vermeiden und …Open original (gesetze-im-internet.de) ↗
- Anhang I Teil II CRAAnnex I Part II Cyber Resilience Act Vulnerability handling requirementsManufacturers of products with digital elements shall: (1) identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products; (2) in relation to the risks posed to products with digital elements, address and remediate …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
Three modes for the collector scripts
You decide in Complass how the file reaches you. The mode is fixed in the script and cannot be changed when it is run.
Local only
No network connection at all. The file stays on the system; you upload it yourself.
Push to share
Only a copy to a share in your network, without a token or address. You upload the files together as a ZIP.
Push to Complass
The file goes directly to Complass via HTTPS with a collection token. If the target is unreachable, it stays local.
Assets from a network capture
The short film shows the German user interface.
Understand what is running
The asset page bundles overview, technology, network, security, contracts, relationships, processes, evidence and history in tabs.
Technical details per asset
Hardware, BIOS/UEFI, CPU, RAM, drives, operating system with build, network adapters and installed software, optionally listening ports and services. The software becomes the SBOM.
Security state from the system
Antivirus, firewall and drive encryption (BitLocker) from the collection. Hints such as “firewall off” appear on the asset.
History with origin
Changes since the last collection appear in the history, with origin (manual, import, collector script), filterable and exportable as Excel/CSV.
Certificates and cryptography
Certificates with warnings 30, 14 and 7 days before expiry, import from PEM, nmap and testssl; a key inventory shows what has to move to post-quantum cryptography.
Bridges between zones
Complass detects systems in several networks and rates them: medium, high with IP forwarding, critical if they connect zones without a conduit. The zone overview shows them as a “bridge”.
SBOM for products and plants
The Cyber Resilience Act requires manufacturers to keep a software bill of materials for their products. Operators use it to find affected plants as soon as a new vulnerability becomes known.
SBOM per asset and product
Components with version, supplier, type, purl, CPE, licence, checksum and parent component. Open vulnerabilities appear right next to the component.
Template, import or collector script
Excel/CSV template, existing files in CycloneDX 1.4–1.6 and SPDX 2.2/2.3 or the software from the collector script, each with a preview.
Snapshots and comparison
“Save snapshot” freezes the SBOM, e.g. per firmware version. The comparison shows added, removed and changed components.
Export for customers and authorities
CycloneDX 1.6 (JSON, XML) and SPDX 2.3, checked against the mandatory fields before output, plus VEX with the status of known vulnerabilities.
Licence overview
Licences as permissive, weak or strong copyleft, proprietary or unknown. For your own products, hints such as “check obligations” or “clarify licence”; not legal advice.
Reports and exports: asset security report as PDF, Complass exchange format, CSV for CMDB and ticket systems, CycloneDX and Excel. Direct connections are on the page Integrations →
Spot risks and prioritise them with reasons
Priority with reasoning
If a service of the affected component is reachable on the network, the vulnerability’s priority rises; services reachable only locally drop. Firewall off, antivirus off and unencrypted drives are factored in, each with a reason.
End of vendor support
Complass shows per asset when the vendor stops delivering security updates for the operating system or software, with rule and source. Filter, count per zone and a dashboard tile.
Knowingly operated, compensated
For legacy OT systems you document segmentation, allowlisting or monitoring with a reason and review date. Vulnerability priority takes this into account.
Vendor advisories (CSAF)
Security advisories from official sources are matched against the vendor, model and firmware version of your assets. Signature and checksum are verified; if the check fails, the advisory is not used. Your administrators can switch sources off per company.
Risk or task with one click
From a hint on the asset you create a pre-filled risk or a task, for example for migration, replacement or a compensating measure.
Vendor advisories from official sources
Public CSAF feeds, fetched daily and switchable per company. You can also upload your own CSAF files, individually or as a ZIP.
- Siemens ProductCERT
- Schneider Electric
- Phoenix Contact
- CERT@VDE
- ABB PSIRT
- BSI (CERT-Bund)
- CISA (ICS advisories)
Relationships, contracts and zones
The relationships and responsibilities that compliance and business continuity need, without introducing a full ITIL CMDB.
Relationships with a map
“depends on”, “runs on”, “connected to”, “part of”, “backs up/monitors”. The reverse direction appears on the other asset; the map shows the surroundings up to the second level.
Business processes
Processes such as “Assembly line 2” with owner, criticality, RTO and RPO and the assets that support them, optionally across all dependencies.
Contracts and remote maintenance
Warranty, maintenance contract with SLA and costs, remote maintenance by vendor or service provider with access path and approval. Complass reminds the owners by email 90 and 30 days before expiry.
Tags, custom fields, location tree
Inventory number, coloured tags, custom fields (text, number, date, choice, yes/no) and site, building, hall, room – in list, filters, import and export.
Security status per asset
Hardening with reference, antivirus/EDR, patch level, backup and configuration backup with date, and the last review. Gaps show up as a number and a filter.
Contracts and licences
Your inventory also covers what you are allowed to use, how much of it you use, and until when. The register is included in the asset management module at no extra charge.
One register for licences and contracts
Software licences, cloud subscriptions, maintenance and service contracts with vendor, product, licence model, quantity, term and notice period, plus owner and deputy.
Deadlines with reminders
The notice date or contract end appears under Deadlines, in the calendar subscription and as a dashboard tile. Complass reminds you 90, 30 and 7 days before, without contract details in the email.
With assets and evidence
Link the assets a licence runs on and attach the contract, invoice or licence certificate. Import from a spreadsheet with a preview, audit evidence as PDF or Excel.
Licensed and used
Complass compares the licensed quantity with the quantity in use: from linked assets, installations according to the inventory, accounts of a system, a manual entry or from Microsoft 365. The status appears in the list, as a filter and on a tile. When a new shortfall arises, the responsible people get a notice at most once a week.
Software without a contract
A list shows applications and operating systems from the inventory that are not assigned to an active contract. With one click you create the contract or mark the software, with a reason, as “No contract needed”.
Deliberately lean
Complass does not store licence keys, only where they are kept. Costs are optional and visible only to administrators and people with a dedicated right. The reconciliation is a count and does not replace a licence audit under the vendor’s rules.
Microsoft 365: Through its own app registration with read-only permission, Complass reads the number of purchased and assigned licences per product, not the names of people. from Professional: Microsoft 365 licences, compare packages
Supports evidence for ISO/IEC 27001:2022 A.5.9 and A.5.32 and the information for the register of information under Art. 28 DORA, without an export in the reporting format.
Zones and conduits per IEC 62443-3-2
Zones and conduits
Zones and communication paths per IEC 62443-3-2 with a zone × zone overview and a plan.
Zone proposal from network data
Complass proposes zones from subnets, VLANs and observed connections and names the matching zone for collected systems. You decide what to adopt.
Open ports and bridges per zone
The zone overview shows open ports per zone, systems without vendor support and multi-homed systems.
Permissions and security: read and write per area, optionally own assets only; exports in the audit log; exports once subscribed. Details on the page Security and data protection →
Identities and access
The auditor asks not only which systems you have, but who signs in and how. Complass shows this per system in one place.
Sign-in per system
SSO, directory or local accounts, MFA in general and for privileged accounts, PAM and break-glass access.
Accounts directly or by import
Directly from Microsoft Entra ID or your GitHub organisation, regularly and read-only, or by import from Active Directory and CSV. Privileged, shared and service accounts are flagged.
Access reviews
Campaigns to recertify rights. If you wish, owners review their groups, you tick individual rights for removal, and the next reconciliation shows whether the removal has been carried out. A sealed record concludes the review. included from Professional: Access reviews, compare packages
Joiners and leavers
Checklists for joining, moving and leaving employees; on exit Complass shows the accounts that still exist.
Legal and normative basis
- ISO/IEC 27001:2022, A.5.15–A.5.18, A.8.2
- § 30 Abs. 2 Nr. 9 und 10 BSIG§ 30 BSIG Risikomanagementmaßnahmen besonders wichtiger Einrichtungen und wichtiger Einrichtungen(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sind verpflichtet, geeignete, verhältnismäßige und wirksame technische und organisatorische Maßnahmen, die in Absatz 2 konkretisiert werden, zu ergreifen, um Störungen der Verfügbarkeit, Integrität und Vertraulichkeit der informationstechnischen Systeme, Komponenten und Prozesse, die sie für die Erbringung ihrer Dienste nutzen, zu vermeiden und …Open original (gesetze-im-internet.de) ↗
Frequently asked questions
Is an agent required?
No. The collector scripts for Windows and Linux are readable, install nothing and only run when you or the task scheduler start them. Without a valid collection set up in Complass they do not start.
What happens in networks without internet access?
In “Push to share” mode the script only copies its file to a share in your network, without a token and without a connection to Complass. You then upload the files together as a ZIP.
Are controllers (PLCs) scanned?
No, Complass does not scan devices. For controllers you passively analyse a network capture (PCAP) or Zeek logs. You can import Nmap results; active scans of controllers should only run with the plant owner’s approval and outside production.
How are duplicates avoided?
All import paths use the same matching by serial number with vendor, MAC address, system UUID and hostname with domain; the IP address is only a hint. You decide unclear cases yourself.
Which formats are available for third-party systems?
JSON in the Complass exchange format, CSV with English columns, CSV for CMDB and ticketing systems such as ServiceNow or GLPI, CycloneDX 1.6 with VEX and CSAF 2.0 VEX. A field reference is available in the portal.
Does the network capture leave my computer?
No. The analysis runs in the browser; only the list of detected devices and connections, which you review before adopting, is sent to the portal.
Does Complass replace a software asset management tool?
No. The “Contracts and licences” register keeps licences, contracts, deadlines and evidence, and counts how many licences you have and how many are in use. It does not replace a licence balance under the vendors’ licence rules.
Does the “Contracts and licences” register cost extra?
No, it is included in the asset management module. With supplier management you also see the contracts on the supplier concerned.
Is asset management a separate module?
Yes, it can be booked as a module and is the basis for vulnerability, risk and incident management and the zone model.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.