Coverage Gaps: When Every Dashboard Is Green and You're Still Exposed

Your EDR console is green. Every endpoint it manages is healthy, updated, reporting in. Your vulnerability scanner shows scans completing on schedule. Your dashboards say you’re covered.

Then an incident starts on a server none of those tools was ever installed on.

That’s a coverage gap. And the reason it’s dangerous is exactly the reason it’s hard to find: it doesn’t set off an alarm. It produces silence, and silence reads like safety right up until it doesn’t.

What a coverage gap actually is

A coverage gap is not a misconfiguration or a failed check. Those generate alerts — a tool sees a problem and tells you. A coverage gap is an absence: an asset that should have a security control and simply doesn’t have it. No EDR agent. No credentialed vuln scan. No log forwarding to the SIEM. The control was never applied, so the tool responsible for it has no idea the asset exists — and can’t warn you about what it can’t see.

Your security tools are very good at reporting on the assets they manage. They are structurally blind to the ones they don’t.

Why the gaps hide between your tools

Every tool reports against its own install base. Your EDR tells you it’s healthy across the 12,000 endpoints it knows about — and says nothing about the ones it was never deployed to. Your scanner reports on the hosts it can reach. Each console shows near-100% on its own denominator, and each denominator is different.

That’s the “three tools, three answers” problem in its rawest form:

Your EDR vendor says you have 12,000 endpoints. Your CMDB says 18,000. Your vuln scanner sees 9,400.

Those aren’t just reconciliation headaches. Every asset that appears in one system and not another is a candidate coverage gap — a machine that’s real, but unprotected by at least one control you assume is universal. The gap doesn’t live inside any one tool’s view. It lives in the space between them, which is precisely why no single dashboard shows it.

Why you can’t just query for them

The instinct is to write a report: list every asset without EDR. But to run that query you’d need one system that already knows two things at once — the complete, true universe of your assets, and each control’s coverage across it. No single tool has both. Your EDR doesn’t know about the assets it never saw. Your CMDB doesn’t know which of its records have an agent. The answer requires joining sources that were never designed to be joined, and doing it continuously as the environment changes.

Why the gap is the whole risk

Attackers don’t breach the 12,000 monitored laptops. They find the one unmonitored server, the forgotten domain controller, the lab box with a public IP and no agent — and they start there, precisely because nothing is watching. A single uncovered, business-critical asset outweighs thousands of well-covered ones. Which is why finding coverage gaps isn’t a hygiene exercise. It’s finding the exact places an incident is most likely to begin, before it does.

Where KeyCaliber fits

KeyCaliber is built to find the silence. It connects by API to the tools you already run — EDR, vulnerability scanners, SIEM, identity, CMDB, cloud — and correlates what each one sees into a single validated inventory of every asset, managed and unmanaged. Then it overlays each control’s coverage across that full inventory and computes the gaps automatically. Not a query you have to write — an answer that’s already there.

• It shows which assets are missing EDR, missing vuln scans, or missing other controls you assumed were everywhere.
• It ranks those gaps by computed business impact, so the uncovered domain controller rises above the uncovered lab VM and your team fixes what matters first.
• And because it tracks coverage continuously, you can watch the gaps close over time — and prove it.

A green dashboard only tells you that the assets your tools can see are fine. The question that decides your exposure is the one no console asks: what about the assets they can’t? Coverage-gap detection is how you finally answer it.