Software categorization intelligence for endpoints
How do you maintain such chaos? You don’t. You focus on critical vulns and the obvious unapproved software, and hope for the best.
Assayer Works reads the software on an endpoint and reports what each item is, who made it, and how certain that is.
One endpoint, fully categorized
410 distinct software items, installed programs, standalone executables, editor extensions, and bundled runtimes.
410 categorized168 with no catalog entry23 invisible to current controls
Of the 23 invisible, 19 also have no catalog entry. Enumeration and catalog coverage are separate failures; an item can fail either or both.
The 23 items invisible to current controlsThe full register, all 410 items
Invisible to current controls
Every one of these was sitting on the machine. None of them showed up in an inventory of it, because nothing that inventories software is built to answer what is this. That’s the gap.
for instance
| Marked | fineness | item | vendor | category | what it means |
|---|---|---|---|---|---|
| Pinokio%LOCALAPPDATA%\Programs\pinokio\Pinokio.exe | Pinokio Computer | ai tooling | Installs and runs arbitrary AI environments. User-level; no elevation requested. | ||
| rust-analyzer.exe%USERPROFILE%\.vscode\extensions\rust-lang.rust-analyzer-0.4.2270\server\rust-analyzer.exe | The Rust Programming Language | development | Language server shipped inside a VS Code extension. Not an installed program; never enumerated. |
User-level installs11 itemsNo elevation, no installer, no record
Nothing requested elevation and nothing registered as an installed program, so whatever enumerates installed software has nothing to enumerate. Note that this class is not only AI tooling, RustDesk is unattended remote access with no installer at all.
| Marked | fineness | item | vendor | category | what it means |
|---|---|---|---|---|---|
| Pinokio%LOCALAPPDATA%\Programs\pinokio\Pinokio.exe | Pinokio Computer | ai tooling | Installs and runs arbitrary AI environments. User-level; no elevation requested. | ||
| Ollama%LOCALAPPDATA%\Programs\Ollama\ollama app.exe | Ollama Inc. | ai tooling | Local model server listening on 127.0.0.1:11434. No installer prompt. | ||
| LM Studio%LOCALAPPDATA%\Programs\lm-studio\LM Studio.exe | Element Labs | ai tooling | Downloads and executes third-party model weights. | ||
| Windsurf%LOCALAPPDATA%\Programs\Windsurf\Windsurf.exe | Codeium | ai tooling | Agentic editor with shell execution. No catalog entry at this version. | ||
| RustDesk%USERPROFILE%\Downloads\rustdesk-1.3.7-x86_64.exe | Purslane Ltd. | remote access | Unattended remote access. Portable: no installer, no elevation, nothing for PAM to gate. | ||
| ngrok%USERPROFILE%\Downloads\ngrok.exe | ngrok LLC | remote access | Reverse tunnel to a public endpoint. Single unsigned binary; vendor from build metadata. | ||
| cloudflared%USERPROFILE%\Downloads\cloudflared.exe | Cloudflare, Inc. | remote access | Ingress tunnel. Bypasses perimeter egress inspection entirely. | ||
| Cursor%LOCALAPPDATA%\Programs\cursor\Cursor.exe | Anysphere Inc. | development | User-level editor install. Catalogued, but never enumerated at this scope. | ||
| Discord%LOCALAPPDATA%\Discord\app-1.0.9186\Discord.exe | Discord Inc. | communication | The original user-level install pattern. Self-updating outside any package manager. | ||
| Parsec%LOCALAPPDATA%\Parsec\parsecd.exe | Unity Technologies | remote access | Low-latency remote desktop. Installs and updates without elevation. | ||
| GitHub Desktop%LOCALAPPDATA%\GitHubDesktop\GitHubDesktop.exe | GitHub Inc. | development | Squirrel-based user-level installer; version churns weekly. |
Editor extension binaries7 itemsNobody owns these
Executables on disk that no inventory tool enumerates, because they are not installed programs. An extension that ships its own compiler front end or language server is invisible by construction.
| Marked | fineness | item | vendor | category | what it means |
|---|---|---|---|---|---|
| rust-analyzer.exe%USERPROFILE%\.vscode\extensions\rust-lang.rust-analyzer-0.4.2270\server\rust-analyzer.exe | The Rust Programming Language | development | Language server shipped inside a VS Code extension. Not an installed program; never enumerated. | ||
| gopls.exe%USERPROFILE%\.vscode\extensions\golang.go-0.46.1\bin\gopls.exe | Go Team at Google | development | Extension-bundled language server. No uninstall entry, no package identity. | ||
| clangd.exe%USERPROFILE%\.vscode\extensions\ms-vscode.cpptools-1.23.5\bin\clangd.exe | LLVM Project | development | Extension-bundled compiler front end with full filesystem access. | ||
| terraform-ls.exe%USERPROFILE%\.vscode\extensions\hashicorp.terraform-2.34.3\bin\terraform-ls.exe | HashiCorp | development | Extension-bundled binary. Reads credentials from the Terraform config chain. | ||
| node.exe%USERPROFILE%\.vscode\extensions\continue.continue-0.9.264\out\node.exe | OpenJS Foundation | development | A full Node runtime shipped inside an AI extension. Executes arbitrary JavaScript. | ||
| sonarlint-ls.jar%USERPROFILE%\.vscode\extensions\sonarsource.sonarlint-vscode-4.15.0\server\sonarlint-ls.jar | SonarSource | security | Extension-bundled Java service; spawns its own JVM. | ||
| esbuild.exe%USERPROFILE%\.vscode\extensions\astro-build.astro-vscode-2.15.4\node_modules\@esbuild\win32-x64\esbuild.exe | Evan Wallace | development | Native build binary inside an extension dependency tree. Three levels below any inventory. |
Internal and contractor binaries5 itemsNot in any catalog
Where catalog-based categorization structurally fails and content-derived attribution does not. This is also where confidence is honestly graded rather than asserted.
| Marked | fineness | item | vendor | category | what it means |
|---|---|---|---|---|---|
| Fabrikam Log CollectorC:\Program Files (x86)\Fabrikam\LogCollector\fabcollect.exe | Fabrikam, Inc. | utilities | Contractor-supplied. Unsigned; vendor read from the PE version resource. | ||
| Fabrikam Deployment UtilityC:\Program Files (x86)\Fabrikam\Deploy\fabdeploy.exe | Fabrikam, Inc. | utilities | Best-guess attribution. Version resource, strings, and compiler artifacts all point to Fabrikam; no signature to confirm it. | ||
| Contoso Timesheet ClientC:\ContosoApps\ts\TSClient.exe | Contoso Ltd. | unknown-but-attributed | Renamed portable build. The filename does not match the binary; identity is content-derived. | ||
| tsclient-legacyC:\ContosoApps\ts\legacy\tsc32.exe | not established | productivity | Stripped and packed. Category derived from content; no vendor established. The strike that was not made. | ||
| buildstampC:\ContosoApps\ci\artifacts\buildstamp.exe | not established | development | CI build artifact. No version resource, no signature, no imports of note. Categorised anyway. |
Nothing on the machine knows what the software is
Every tool that decides anything about software decides without that fact. So each one substitutes something adjacent and correlated.
An inventory lists names. A patch tool tracks versions. A policy matches paths and publishers. A detection product watches behaviour once something runs. Each answers its own question well, and not one of them answers what is this file, who made it, what category does it belong to.
That is not a feature gap in any of them. It is a layer that does not exist underneath all of them, which is why the answer is the same whether you run six security products or none.
Which of these is closer to your situation?
The problem is the same. What it costs you, and what you have already tried, is not.
The controls are there. The fact underneath them is not.
Endpoint detection, privilege management, a broker, a catalog. Each decides about software without knowing what the software is. We supply the fact they are all missing.
The controls are not there, or not everywhere.
Some coverage with holes in it, or almost none. The agent can enforce where your tools do not reach, and it ships switched off.
More of this
New posts on what a file tells you before you run it: headers, signatures, manifests, overlays, the fields most inventory never reads. Only when there is something worth the write-up.
We intend to offer a tool that does this across every file on an endpoint. You get one message when you can use it.