Quick Check: Who’s in the Room?

• To get started, who is the single person we should coordinate with day-to-day for this discovery (name, title, email)?
• Which roles will influence or approve the remediation and licensing decisions? Options: CIO, Director, IT Asset Management, VP Procurement, CISO, Head of Finance, Legal / Contracts, Line-of-Business Manager, Other
• How many people across IT/procurement/security do you expect to involve during the 90‑day audit response? Options: 1–2, 3–5, 6–10, 10+
• Have you been through a vendor audit (Microsoft/Oracle/SAP) in the last 24 months? Tell us briefly what happened. Options: Yes — material exposure, Yes — minor findings, No — first time, Prefer not to say
• When this audit landed on your desk, what was your immediate feeling—panic, confident, frustrated, resigned, or something else? Options: Panic, Confident, Frustrated, Resigned, Curious / Opportunistic, Other

The Audit Is a Ticking Clock — Are We Really Ready?

• You have 90 days—what makes you think current plans will (or won’t) get you to a defensible position in time?
• What is the official audit response deadline (date) and do you have any internal milestones we must align with?
• Who formally owns the 90‑day timeline and who is empowered to make schedule tradeoffs? Options: CIO, Director ITAM, VP Procurement, External Counsel, Other
• If we had to prioritize three things to get audit-ready in 90 days, which would they be? Options: Accurate deployed inventory, License entitlement reconciliation, Procurement record consolidation, Audit-ready reporting, Contract review, Other
• What would be the consequences—financial, operational, reputational—if we miss the deadline or provide weak evidence? Options: Seven-figure true-up, Operational disruption, Vendor penalties, Increased audit frequency, Loss of stakeholder trust, Other

Where Truth Lives — or Gets Lost

• You mentioned multiple inventory sources; which systems currently hold your canonical asset lists? Options: CMDB, Endpoint management (MDM/EDR), Procurement/P2P, Financial ledger, Cloud provider inventories, SaaS admin consoles, Spreadsheets, Other
• On a scale of 0–100%, roughly how confident are you that the combined inventory equals reality? If uncertain, say why.
• Which of those sources are actively maintained and assigned an owner today? Options: All have owners, Most have owners, Only a few, None — ad hoc
• When inventories disagree, what do you typically do—manual reconciliation, assume procurement is right, ignore small gaps, or something else? Options: Manual reconciliation, Trust procurement records, Trust discovery tool, Ignore until audit, Other
• Walk us through the last time you tried to reconcile two or more sources—what took the longest and why?

Are We Blind to the Things That Bite You Most?

• Given your current tools, which asset classes do you suspect are under-discovered or invisible today? Options: SaaS subscriptions (shadows), Contractor/contingent devices, Cloud-native instances, IoT/OT devices, Off-network laptops, Deprecated on-prem servers, Other
• How often have discovery shortfalls created surprise charges or audit findings in the last 3 years? Options: Multiple times, Once, Never, Unsure
• When you later discovered unmanaged assets, how were they typically found (user report, billing anomaly, SIEM log, vendor audit)? Options: User report, Billing anomaly, SIEM/logs, Vendor audit, Procurement mismatch, Other
• Estimate the percentage of your license/asset exposure you believe lives in that 'unseen' slice. Options: 0–5%, 6–15%, 16–30%, 31–50%, 50%+
• How comfortable are you with giving an agentless network scan and SaaS API read-only connections to find those missing items? Options: Very comfortable, Somewhat comfortable, Unsure — need security review, Not comfortable

If Success Had a Name, What Would It Be?

• What concrete signals would make you say, ‘We nailed the audit response’—not vague outcomes but specific, measurable indicators?
• What reconciliation tolerance do you consider acceptable for the evaluation sample (e.g., 0–1%, 2–5%, etc.)? Options: 0%, 0–1%, 1–3%, 3–5%, 5%+
• Which sample segment should we evaluate first to prove impact—location, business unit, vendor, SaaS-only, or a hybrid? Options: By geography, By business unit, By vendor/product, SaaS-only slice, Hybrid sample
• What hard deliverables do you expect at the end of the evaluation (e.g., audit-ready report, reconciliation workbook, remediation plan)? Options: Audit-ready report, Reconciliation workbook, Remediation prioritization, Procurement adjustments, Executive summary
• Who needs to sign off on the acceptance criteria once met? Options: Director ITAM, VP Procurement, CFO/Finance, CISO, Legal, Other

What Would It Take to Trust Automated Discovery?

• What worries you most about agentless scanning or SaaS API discovery revealing internal issues or sensitive data? Options: Security exposure, False positives, Operational disruption, Privacy/regulatory risk, Vendor access concerns, Other
• Which integrations are mandatory for a meaningful reconciliation in your environment? Options: Procurement/P2P, ERP/Finance, SaaS admin APIs (e.g., Okta, Azure AD), Cloud provider APIs (AWS/Azure/GCP), Endpoint/EDR, CMDB, Other
• Do you already have service accounts or API credentials we can use for read-only access? If no, what’s the expected approval lead time? Options: Yes — available now, Yes — with some approvals, No — will take 1–2 weeks, No — will take 2–4 weeks, Unknown
• How do you prefer reconciliation rules to be applied—conservative (favor deployed telemetry), procurement-first, or hybrid? Why? Options: Conservative (telemetry), Procurement-first, Hybrid rules, Undecided
• Which stakeholders must be involved when we surface unused licenses or unmanaged devices (to validate and remediate)? Options: Application owners, Procurement, IT operations, Security, Business unit leads, Other

Let’s Map the First 30 Days — Who Does What?

• If we started tomorrow, what would be the single biggest internal blocker in the first 30 days? Options: Security review, Lack of credentials, Network segmentation, Stakeholder availability, Policy approvals, Other
• Which of these pre-deployment items can you confirm immediately: network access, API credentials, sample targets, data normalization owners? Options: Network access, API credentials, Sample targets, Normalization owners, None are ready
• Who will run/coordinate the scans and who will validate the initial findings on your side? Options: Internal IT ops, ITAM team, Security team, Procurement, Third-party integrator, Other
• What normalization rules or taxonomy do you insist we follow so assets from multiple systems align cleanly? Options: Vendor/product normalization, Location/department mapping, User/owner mapping, Custom taxonomy (we'll provide), No preference
• How would you like escalation to happen if we hit a data-access or high-risk finding—daily brief, immediate alert, weekly sync, or something else? Options: Immediate alert, Daily brief, Weekly sync, Escalate to executive only, Other

Commitments, Risks & Next Steps — Are We Ready to Move?

• What commercial or contractual constraints would prevent you from granting read-only access to discovery tools for this evaluation? Options: Procurement restrictions, Legal privacy concerns, Budget limitations, None, Other
• What minimum assurances do you need in the contract around data handling, retention, and breach notification? Options: SOC2/ISO certifications, Data minimization clause, Breach notification timeline, On-shore data handling, Other
• If the evaluation surfaces material unused licenses, how should we prioritize remediation options (reclaim, redeploy, renegotiate, do nothing)? Options: Reclaim, Redeploy, Renegotiate, Do nothing, Discuss per-case
• Who needs to be copied into commercial or access approvals so we can move without repeated email loops? Options: Director ITAM, VP Procurement, CISO, Legal, Finance, Other
• What would make you comfortable pausing here and saying, ‘Yes — proceed with the 30‑day evaluation’? Options: Clear timeline, Signed NDA/contract, Security review passed, Assigned internal champion, Other

Quick Snapshot: Who's In The Room?

• Who will be our primary contact and the person who ultimately signs off on the audit response? Options: Director, IT Asset Management, VP, IT Procurement, CIO, Head of Security/Compliance, Other
• Which teams currently hold parts of your inventory and procurement records? Options: ITAM/Asset team, Procurement, Security/IR, CloudOps/Cloud Center of Excellence, Service Desk/IT Ops, Business Units/Line of Business, Contractors/Third parties, Other
• Approximately how many unique assets (endpoints, VMs, SaaS subscriptions, databases, network devices) do you estimate are in scope for the audit? Options: < 5,000, 5k–20k, 20k–100k, 100k–500k, > 500k, Unsure / need to estimate
• Which vendor issued the audit notification that started this effort? Options: Microsoft, Oracle, SAP, Other, Multiple vendors
• What is the 90-day deadline (date) for your audit response?
• On a scale from 'I’d confidently publish this today' to 'This would fail inspection', how would you rate the current accuracy of your license position? Options: Publish confidently, Likely okay with small gaps, Large gaps but salvageable, Insufficient—would fail inspection, Don't know

If Your Inventory Could Speak, What Problems Would It Confess?

• What’s one surprising truth your inventory would admit if it could—something no dashboard shows but you suspect exists?
• How often do the five different inventory tools in your estate report conflicting information about the same asset? Options: Almost always, Frequently, Occasionally, Rarely, Never / tools are consistent
• Which discovery gaps worry you most right now (pick up to three)? Options: Unmanaged endpoints/contractor laptops, SaaS subscriptions purchased outside procurement, Cloud tenant orphan resources, Offline or segmented network devices, Procurement records not matched to deployments, Other
• Tell us about a recent time where a tool missed something important—what happened and what was the impact?
• When you think about these blind spots, what emotion best describes your response? Options: Urgent / panicked, Frustrated, Curious but hopeful, Overwhelmed, Neutral
• How long have these inventory inconsistencies been tolerated before becoming a material risk? Options: < 6 months, 6–12 months, 1–3 years, 3+ years, Not sure

Where Data Falls Through the Cracks

• Which systems, teams, or environments routinely escape your inventory process—intentionally or not? Options: Contractor devices, Shadow IT SaaS, Isolated network segments, Legacy datacenters, Subsidiaries / acquired companies, Cloud tenants not centrally managed, Other
• List the primary inventory sources or tools you currently rely on (agent tools, CMDBs, spreadsheets, cloud consoles, procurement systems).
• Which procurement or contract systems do we need to reconcile against (ERP, Coupa, Ariba, ServiceNow, custom DBs)? Options: SAP/ERP, Coupa, Ariba, ServiceNow, Oracle Procurement, Custom/Excel spreadsheets, Other
• What discovery tools are in active use and what percent of your estate do you estimate they cover? Options: Coverage < 25%, 25–50%, 50–75%, 75–95%, >95%, Unknown
• Do you have network segmentation, air-gapped environments, or branch offices that will require special discovery approaches? Options: Yes—multiple segmented environments, Yes—couple of segments, No—mostly flat network, Unsure
• If segments are isolated, who are the owners and how quickly can we get approvals to scan or access APIs?
• Are there known audit artifacts (previous license reconciliations, discovery exports, vendor reports) you can share to accelerate baseline mapping? Options: License reconciliations, Discovery exports (CSV/JSON), Vendor audit letters, Procurement contract bundles, None available / not sure

When the Audit Clock Ticks, What Keeps You Up at Night?

• If a vendor walked into a board meeting with a seven-figure true-up, what part of your asset story would you be most afraid they could prove? Options: Undiscovered SaaS costs, Unreconciled Oracle licenses, Untracked cloud VMs, Contract/entitlement mismatches, Shadow purchases by business units, Other
• What financial tolerance do you have for reconciliation variance before a result is unacceptable? Options: 0–2% variance, 2–5% variance, 5–10% variance, >10% variance, No formal tolerance / need to define
• Which sample segment would you prefer we evaluate first to demonstrate value (e.g., specific business unit, cloud tenant, region, or application family)?
• Who are the decision-makers for escalation if we surface material non-compliance during the sample evaluation? Options: CIO/CISO, Head of Procurement, Legal, Finance, ITAM Leader, Other
• How will an audit-ready report need to be structured to satisfy internal stakeholders and the vendor (format, level of detail, sign-offs)? Options: Detailed line-item reconciliation, Executive summary + appendix, Vendor-specific format, Custom internal template, Unsure—need guidance
• When you imagine the worst-case discovery outcome, what organizational consequence concerns you most (financial hit, reputational damage, operational interruption)? Options: Financial hit, Reputational damage, Operational disruption, Leadership exposure, Regulatory action, Other

Imagine a Clean License Position — What Would That Actually Feel Like?

• What are the clear success signals that would convince you this evaluation delivered defensible results? Options: Complete asset reconciliation, Matched procurement records to deployments, Identified unused licenses, Audit-ready report accepted by vendor, Board-level sign-off, Other
• What reconciliation tolerance would you accept for this evaluation to be considered successful? Options: 0–1% variance, 1–3% variance, 3–5% variance, 5–10% variance, No set tolerance—open to recommendation
• Who needs to sign off on acceptance criteria and final deliverables for the evaluation? Options: ITAM Lead, Procurement Head, CIO, Legal, Finance, Vendor Relations, Other
• What operational handover would you expect after success (runbooks, ongoing integration, SLA for updates)? Options: Daily syncs & dashboards, Weekly executive update, Automated monthly reconciliations, Operational runbooks + training, No ongoing handover—ad hoc support, Other
• If we resolved the audit and surfaced $X in recoverable savings, how would that change the team's priorities or budget next quarter?

Can We Actually Find Your Missing Stuff?

• Where do you expect agentless network scans and SaaS API integrations to surprise you most—and why do you think that is?
• Have you historically found material assets via agentless techniques or API pulls that agent-based tools missed? Options: Yes—frequently, Occasionally, Rarely, Never tried agentless/API methods, Unsure
• Roughly what percent of endpoints currently have a management agent installed? Options: <25%, 25–50%, 50–75%, 75–95%, >95%, Unknown
• Do you have cloud accounts or SaaS admin consoles where we will need read-only API access? If so, which platforms? Options: Azure, AWS, GCP, Okta, Google Workspace, Microsoft 365, Salesforce, Other
• Have previous scans ever uncovered unexpected subscriptions or orphaned resources? Please share one short example.
• What level of false positives are you willing to tolerate during discovery to ensure we don’t miss unmanaged assets? Options: Very low—prefer precision, Moderate—accept manual review, High—prioritize recall, Unsure—need recommendation

What Would Allow Us To Run an Effective Test?

• What approvals or credentials can you commit to providing in the first two weeks to enable discovery and procurement reconciliation? Options: API keys/roles, Network scan approvals, Procurement exports, CMDB extracts, None available in that timeframe, Other
• Which network segments or locations should be prioritized for the initial sample scan? Options: Headquarters LAN, Remote offices, Production datacenter, Dev/Test environments, Cloud tenants, Business-critical application segment, Other
• Who will own granting access and responding to data requests during the evaluation (name/role)?
• Do you have sanitized or redacted artifacts we can use in place of sensitive exports for testing if needed? Options: Yes—sanitized artifacts available, We can produce exports on request, No, full access required, Unsure
• What timeline constraints exist for performing network scans (maintenance windows, change freeze, region-specific restrictions)?
• If we encounter resistance from a business unit to share records, who should we engage next and what approach has worked previously?

Decision Points and How We'll Know We’re Done

• What would make you say, unambiguously, 'this evaluation settled the audit'? Options: Vendor accepts our report, Internal sign-off by IT and Procurement, Board-level acknowledgement, Quantified remediation plan in place, Reduction in estimated true-up to acceptable level, Other
• What formal acceptance criteria should be included in the evaluation scope (e.g., reconciliation threshold, sample coverage, artifact types)?
• Who will be the final approver for commercial commitments if remediation work or extended service is required after the evaluation? Options: CIO, VP Procurement, Finance Director, Legal, ITAM Lead, Other
• How quickly do you expect remediation plans to be actionable after the evaluation (time to first remediation sprint)? Options: Immediate (within 2 weeks), Short (2–6 weeks), Quarterly plan (6–12 weeks), Longer than a quarter, Unsure
• What cadence for status updates and escalation would make you feel secure during the 90-day audit period? Options: Daily standup during intense phase, 2–3x weekly, Weekly, Bi-weekly, Ad hoc as major issues arise
• What internal risks (political, budgetary, resource) could prevent final acceptance even if the technical work is successful? Options: Budget reallocation, Leadership change, Competing priorities, Procurement resistance, Legal concerns, Other
• If this evaluation surfaces recoverable savings, how should those savings be tracked and reported back to stakeholders? Options: Monthly savings report, Quarterly executive summary, Line-item financial reconciliation, Added to IT budget forecast, Other

Start: What Brought You to This Audit Moment?

• Tell us briefly: which vendor issued the audit notice and what is the official response deadline? Options: Microsoft, Oracle, SAP, Other
• Who on your team owns this response? (pick the primary role and add names in the next question) Options: CIO, Director IT Asset Management, VP Procurement, IT Security Lead, Other
• Please list the names, titles, and email addresses of the people we should include in discovery and deployment coordination.
• How do you feel about the timeline right now? Options: Confident we’ll meet it, Concerned but hopeful, Very worried, Not sure yet
• What would be an acceptable outcome for the next 30 days to feel we are on track?

Are We Really Seeing Everything We Think We Are?

• When you say your inventory is 'scattered', what do you think is missing most often—cloud subscriptions, contractor devices, on-prem servers, or SaaS accounts? Options: Cloud subscriptions, Contractor / temp devices, On-prem servers, SaaS accounts, Network devices, Other
• How many inventory sources are actively used today (CMDB, endpoint tool, cloud billing, procurement, spreadsheets, etc.)? Options: 1, 2, 3, 4, 5+, Unsure
• Which specific discovery or inventory tools are currently in use? (select all that apply) Options: Endpoint agent (e.g., SCCM), Network scanner, Cloud console/billing, SaaS admin consoles, CMDB, Procurement system, Manual spreadsheets, Other
• On a scale of 0–100, how confident are you that your current inventory reflects reality? Explain what drives that score. Options: 0-20, 21-40, 41-60, 61-80, 81-100
• Give a recent example where an inventory source surprised you (a missing asset, an unexpected subscription, or a reconciliation mismatch). What happened?

What’s Costing You — Quietly and in Plain Sight?

• If 30–40% of waste typically hides in unmanaged assets, how much annual spend would that represent for you today? Options: <$50k, $50k–$250k, $250k–$1M, $1M–$5M, >$5M, Unsure
• Have you recently discovered unlicensed or unused entitlements during internal checks? If so, what was the scale and outcome? Options: Yes — small, Yes — moderate, Yes — large, No, We haven't checked
• Where does the tension show up most—finance pressure, audit risk, procurement backlog, or operational friction? Options: Finance pressure, Audit risk, Procurement backlog, Operational friction, All of the above, Other
• When these issues surface, who typically escalates and how long does it take to get executive attention? Options: IT Asset Management escalates, Procurement escalates, Finance escalates, CIO/VP-level immediate, Rarely escalates, Other
• Describe the most stressful moment you've had during a past audit or procurement reconciliation. What made it so stressful?

Why Haven’t Past Fixes Stuck?

• What usually blocks a discovery effort from giving you a clear picture—segmented networks, credential gaps, offline assets, or data normalization challenges? Options: Segmented networks, Credential gaps, Offline / air-gapped assets, Inconsistent naming / normalization, Integration limits with procurement, Organizational resistance
• How widely deployed are your agent-based tools? (this often explains blind spots) Options: Nearly 100%, 75–99%, 50–74%, 25–49%, <25%, We don't use agents
• Have you tried agentless scanning or SaaS API integrations before? What worked and what didn't? Options: Yes — worked well, Yes — limited results, Tried, failed due to access, Never tried, Other
• When reconciliation was attempted, how long did normalization and matching take (days, weeks, months) and who owned that effort? Options: Days, Weeks, Months, Ongoing/never finished, Unsure
• Who resists centralized visibility into SaaS buys or procurement data and why (finance, business units, security, others)? Options: Finance, Business units, Security, Procurement, IT operations, No resistance, Other

If This Were Solved, What Would Change for You?

• Imagine you hand the auditor a single, defensible license position—what would that shift enable for your team and organization?
• Which of these would signal success to you in the short term (pick top two)? Options: Accurate 90-day audit report, Reduced license spend, Operational handoff to ITSM, Ongoing automated reconciliation, Executive sign-off on position
• What acceptance criteria must be met for you to sign off on an evaluation (sample coverage, reconciliation accuracy, report format, stakeholder approval)? Options: Sample coverage %, Reconciliation threshold, Audit-ready report, Stakeholder approvals, Remediation list
• Who must be convinced internally (roles or committees) before you can move from evaluation to full deployment?
• How would you want findings presented to non-technical stakeholders to reduce fear and drive decisions? Options: Executive summary + financial impact, Visual dashboards, Raw data with annotations, Workshop walkthrough, Other

What Would a Pilot Need to Prove — Fast?

• If we ran discovery against a sample segment, what size and type of segment would you trust as representative (by department, region, or workload)? Options: Single department (50–200 devices), Multiple departments (200–1,000 devices), Critical workloads only, Cloud-only sample, SaaS-heavy segment, Other
• What minimum reconciliation accuracy would you accept from a pilot before granting broader access? Options: >95%, 90–95%, 80–90%, <80%, Unsure
• Which deliverables would make a pilot feel valuable: raw findings, reconciliation report, unused license list, remediation roadmap, or executive summary? Options: Raw findings, Reconciliation report, Unused license list, Remediation roadmap, Executive summary
• Who needs to approve the pilot scope, data access, and timeline?
• What timeline feels realistic for a sample-based evaluation from kickoff to an audit-ready pilot report? Options: <2 weeks, 2–4 weeks, 4–8 weeks, 8+ weeks, Unsure

What’s Standing Between Us and Access?

• If access were the only constraint, what would block us most: legal/data concerns, credential procurement, firewall rules, or stakeholder sign-off? Options: Legal / data concerns, Credential procurement, Firewall / network access, Lack of API privileges, Stakeholder sign-off delay, Other
• Do you have API/admin credentials available for cloud consoles, major SaaS vendors, and procurement systems today? Options: All available, Some available, None available, Unsure
• Who is authorized to grant the credentials and how long does that approval typically take?
• Are there segmented networks, air-gapped environments, or third-party-managed assets that will require special handling? Options: Yes — segmented networks, Yes — air-gapped, Yes — third-party managed, No special handling, Unsure
• What normalization rules (naming conventions, ownership fields, contract linkages) do you currently use that we should preserve or map to?

Who Owns the Decisions and the Risks?

• If we identify a seven-figure exposure, who signs the remediation plan and who communicates the risk to executives?
• What level of financial or compliance risk requires immediate executive escalation in your organization? Options: $0–$50k, $50k–$250k, $250k–$1M, $1M–$5M, >$5M, Compliance-only threshold
• How frequently do you want status updates during discovery (daily, twice-weekly, weekly, on milestones)? Options: Daily, Twice-weekly, Weekly, On milestones only, As-needed
• Who should be on the escalation path (names and roles) if we hit a blocker that threatens the audit timeline?
• What confidentiality or data handling constraints do we need to agree to before accessing any systems? Options: Standard NDA, Data processing agreement, Encrypted transfer only, No external access allowed, Other

Commitments, Next Steps, and the Small Wins That Keep Momentum

• Given everything above, what is the single most important thing we must deliver in the first two weeks to keep stakeholders calm?
• Which quick wins would you prefer first: a prioritized unused-license list, a risky asset inventory, or an executive-ready position summary? Options: Unused-license list, Risky asset inventory, Executive position summary, All of the above
• Who will give final approval to move from evaluation to full deployment and how will they measure readiness?
• How soon can we schedule the kickoff and confirm credential handoffs? Options: Immediately, Within 48 hours, Within 1 week, Within 2 weeks, Longer
• Finally, what doubts or fears do you still have about letting an external team discover and reconcile your assets? Tell us what would make you feel safe.

When the Audit Alarm Rang — Tell Us the Short Version

• Which vendor initiated the audit notice and what was the deadline you were given? Options: Microsoft, Oracle, SAP, Another vendor, Not yet specified
• Who first saw the notice and where did it land (CIO, ITAM, Procurement, Legal, other)? Options: CIO, Director of ITAM, VP Procurement, Legal, Security, Other
• How confident were you in your ability to produce an accurate license position when the notice arrived? Options: Completely confident, Mostly confident, Somewhat worried, Not confident at all
• In one sentence, what felt like the single biggest immediate problem?
• Roughly how many days do you have left on the audit timeline? Options: Less than 7 days, 7–14 days, 15–30 days, 31–60 days, 61–90 days, More than 90 days

How Much of Your Inventory Is Real — and How Much Is Hope?

• If you had to bet, what percent of your actual estate do you think your current inventory captures? Options: Under 50%, 50–70%, 71–85%, 86–95%, Over 95%
• Which systems feed your canonical inventory today (pick all that apply)? Options: CMDB, Procurement/ERP, Endpoint agents, Network discovery tool, SaaS management tool, Spreadsheets, Other
• Where do your various inventories most commonly disagree — asset counts, ownership, installed software, or entitlements? Options: Asset counts, Owner/department, Installed software versions, License entitlements, Contract/PO mapping, Other
• Tell a story: what's the last time an inventory discrepancy led to an unpleasant surprise (audit ask, surprise spend, or outage)?
• How often do you reconcile procurement records to deployments today? Options: Continuously (automated), Monthly, Quarterly, Ad hoc/manual, Never

What’s Slipping Through the Cracks and Why It Matters

• How many of these asset classes do you suspect are under‑discovered in your estate? Options: SaaS subscriptions, Cloud instances, Contractor/consultant devices, Lab/dev/test VMs, Offline or air‑gapped devices
• Which of those under‑discovered classes worries you most from a compliance or cost perspective, and why? Options: SaaS subscriptions, Cloud instances, Contractor devices, Offline devices, Other
• Have you found unexpected assets or licenses in the past that changed your audit position? If yes, describe one example and its impact.
• Which discovery methods are currently missing or impossible in parts of your environment (agentless network scanning, API access to SaaS, procurement API, privileged credentials)? Options: Agentless network scanning, SaaS/cloud APIs, Procurement/ERP integration, Endpoint agents, None of the above (full coverage)
• How does it feel internally when teams keep buying outside procurement—frustrating, unresolved, ignored, or something else? Options: Frustrating, Ignored by leadership, Creates conflict, Accepted reality, Other

Why 'Close Enough' Keeps Costing You — Let's Get Specific

• What level of reconciliation tolerance would you accept for an audit‑ready position (i.e., allowed variance before escalation)? Options: 0% (exact), ≤1%, ≤5%, ≤10%, Unsure / Need guidance
• For evaluation, what sample size feels meaningful to you (by percentage of estate or by functional segment)? Options: 5%–10%, 11%–25%, 26%–50%, A specific business unit only, Other (describe)
• Which success signals would make you declare the trial a win (pick up to three)? Options: Found >10% more assets, Identified unused licenses worth $X, Reconciled procurement to deployment, Produced audit‑grade report, Reduced variance to ≤5%
• Tell us the worst-case consequence if the audit finds significant underreporting (true-up cost, legal exposure, leadership escalation)—be candid.
• What internal metric (dollars saved, % variance reduced, number of orphaned assets closed) will you use to judge success? Options: Dollars saved, % variance reduction, Number of orphaned assets remediated, Process adoption rate, Other

Where Your Discovery Pipeline Breaks — Network, People, or Permissions?

• Which of these are the most common blockers when you try to run discovery in a segment? Options: Network segmentation/ACLs, Missing credentials, No API access to SaaS, Endpoint agents blocked, Policy restrictions, Other
• Do you have organizational pockets (labs, M&A carve-outs, contractors) that are intentionally isolated from central tooling? If yes, how many and where?
• How quickly can teams provide API credentials or service accounts when asked (immediately, days, weeks, never)? Options: Immediately, Within 1–3 days, Within 1–2 weeks, More than 2 weeks, Not available
• When credentials or access are delayed, what typically happens—workarounds, partial scans, or pauses in the project? Options: Workarounds used, Partial/limited scans, Project paused, Escalation to leadership, Other
• If we needed to prioritize three connectivity tasks to reduce blind spots, which should we do first? Options: Network scanning access, SaaS/API credentials, Procurement/ERP integration, Endpoint agent rollout, Owner mapping

Who Signs Off, Who Delays, and Who Moves Mountains?

• Who are the must‑have approvers for data access and discovery (roles, not names)? Options: CIO, IT Security, VP Procurement, Director ITAM, Legal/Compliance, Business Unit Heads, Other
• Who in your organization typically stalls access requests—and what are their top concerns? Options: Security team, Network team, Legal, Business units, No one stalls, Other
• What escalation path do you prefer if we hit a roadblock (weekly sponsor meeting, direct exec email, dedicated Slack/Teams channel)? Options: Weekly sponsor meeting, Direct exec email, Dedicated Slack/Teams channel, Phone escalation, Other
• Which owners will be responsible for validating the reconciled results (name the roles and their acceptance responsibilities)?
• How do you want us to present findings to stakeholders—raw data + narrative, executive summary only, or a combined package with remediation tasks? Options: Raw data + narrative, Executive summary only, Combined package with remediation tasks, Custom format (describe)

What 'Audit‑Ready' Actually Looks Like for You

• Which deliverables make an audit response defensible in your view (pick all that apply)? Options: Itemized license position, Reconciliation workbook, Source-of-truth mapping, Audit‑grade reports with timestamps, Signed owner attestations, Other
• What output format do your auditors or internal reviewers prefer (CSV, Excel reconciliation, PDF report, API feed)? Options: CSV, Excel workbook, PDF report, API/data feed, Other
• What level of evidence is required to accept a reconciliation line item (deployment snapshot, invoice/PO link, owner confirmation, or combination)? Options: Deployment snapshot, Invoice/PO, Owner confirmation, Combination of above, Unsure — need guidance
• Are there particular compliance or accounting controls we should mirror in the reports (SOX, internal audit templates, vendor‑specific reporting)? Options: SOX, Internal audit templates, Vendor‑specific formats, None specific, Other
• What acceptance criteria will make you sign off on the evaluation (variance threshold, remediation plan, stakeholder approval)?

The Smallest Move That Proves the Biggest Thing — Planning the First Win

• If we had to choose one segment to run a fast proof—what would you pick (by business unit, geography, asset type)? Options: Finance, Engineering/DevOps, Sales/Marketing, APAC region, US region, Cloud subscriptions only, Other
• What is an acceptable timeline for a 2–4 week evaluation that produces actionable results? Options: 7–10 days, 2 weeks, 3 weeks, 4 weeks, Longer than 4 weeks
• Which approvals or commercial steps must be in place before we start (NDA, SOW, PO, data access form)? Options: NDA, SOW, PO, Data access form, None required
• What would make you feel comfortable sharing credentials or API access during the trial (temporary accounts, read‑only roles, timebound tokens)? Options: Temporary accounts, Read‑only roles, Timebound tokens, Credential vaulting by us, Other
• What would you like our first status update to include (early findings, blocker list, throughput metrics, raw evidence)? Options: Early findings, Blocker list, Throughput metrics, Raw evidence, Executive summary