Eight shifts reshaping ITAM through 2025 — from the gap between MDM and true lifecycle management, to multi-cloud visibility, compliance automation, security convergence and workflow orchestration. What each one means, and what to do about it.
We have passed the halfway mark of 2025, and IT Asset Management continues its rapid evolution — driven by AI advances, hybrid infrastructure, tighter compliance and growing environmental pressure. Below are the eight most consequential shifts changing how organisations track, optimise and secure everything they own.
Mobile Device Management tools such as Microsoft Intune keep expanding their coverage to end-user devices well beyond those running a mobile OS. Do not mistake them for full ITAM tools. The difference is that an ITAM tool drives security and cost optimisation across the full cradle-to-grave lifecycle, and it should tell you what you do not already know — not merely let you administer the devices that are live and actively enrolled.
That last point is the whole argument. An MDM console can only show you what has enrolled in it. Discovery has to work the other way round: CerteroX ITAM runs ten discovery methods — native agent, command-line inventory, agentless collection, standalone inventory for air-gapped systems, network scanning, Active Directory import, third-party ITAM import, cloud and SaaS connectors, browser monitoring and file metering — across six operating system families including AIX, HP-UX and Solaris. Network Discovery sweeps a class-C subnet in under five seconds over NetBIOS, SNMP and ICMP, then probes to work out where an agent could actually be deployed. You find the machines before you own the problem.
Key takeaway. ITAM is the core of visibility and observability in IT. Integrate tools like Intune into your ITAM platform to get the automation without giving up sight of the full hardware and software lifecycle.
Running workloads across more than one cloud provider is now normal rather than notable, and unified visibility across them remains the hard part. Wasted cloud spend runs at 29% — up for the first time in five years, which tells you the visibility problem is not solving itself.
Modern ITAM ingests cloud provider APIs for real-time usage, tags resource attributes automatically and reconciles costs across AWS, Azure, Google Cloud, private cloud and edge. CerteroX Cloud Management covers twelve cloud and data platforms with a Cost Explorer broken down by owner, pool, service, region, account and day, native support for FOCUS — the FinOps open cost and usage specification — and virtual tagging computed independently of cloud-native tags, so allocation does not fall over the moment someone forgets to tag a resource. Twenty-six named recommendation checks sit on top, each individually tunable with its own thresholds, pool exclusions and account skips.
Key takeaway. Implement a cloud-focused discovery layer inside your FinOps and ITAM practice to control sprawl, enforce tagging governance and pinpoint over-provisioned services.
Licensing models keep getting more complex — per-core metrics, subscriptions, containers, SaaS — and the combination of audit risk and quiet overspend gets worse with each addition. Automating true-up calculations and entitlement mapping is no longer an efficiency measure; it is how you keep a defensible position between audits.
The engine that makes it work is recognition. CerteroX SAM resolves installations against the Software Recognition Database, which holds more than 3.5 million normalised publisher, product and version titles, with release, end-of-support and extended-support dates attached. On top of that sit publisher-grade licence engines for Microsoft, Oracle, IBM, SAP, Adobe and Salesforce, and an effective licence position — purchased, used, available, required, variance, exposure — computed continuously rather than reconstructed the week the audit letter arrives.
Key takeaway. Use automated normalisation that ingests vendor contracts, maps installations and drives self-service compliance dashboards — both to avoid audit penalties and to reclaim entitlements nobody is using.
Unmanaged hardware and shadow-IT software create attack surface. Security-minded ITAM feeds CMDBs and vulnerability scanners so that every asset is accounted for and patched promptly. With the EU’s NIS2 and DORA regulations demanding asset-level traceability, linking ITAM to SecOps stopped being optional.
This is where compliance-as-code earns its keep. Governance Policies in CerteroX ITAM are built from a reusable filter builder and exported and imported as JSON, with worked examples such as BitLocker enabled, Defender running and Azure VM tag hygiene. Patch management is WSUS-integrated with downstream server support, and Zones plus Reporting Levels segment data by organisational unit or location so that a policy result is scoped to the people who own it.
Key takeaway. Build bi-directional integrations between your ITAM system and your vulnerability management tools to accelerate patch deployment and support audit-ready reporting.
Environmental responsibility is increasingly a board-level mandate. ITAM teams are folding energy-usage data, e-waste metrics and carbon-footprint calculations into procurement and retirement workflows. Extending asset lifecycles and optimising refresh schedules cuts cost and environmental impact together, which is a rare alignment worth exploiting.
Key takeaway. Introduce sustainability reporting that tracks energy consumption per asset and informs greener procurement — aligning ITAM with your organisation’s ESG goals.
Cross-functional work between ITAM and FinOps is driving tighter cost governance. Connecting asset records to financial systems lets teams trace total cost of ownership, depreciation schedules and unbudgeted spend in one place rather than three.
The plumbing matters here. CerteroX ITAM carries cost tabs with manual and automatic costing rules, and exposes a read-only API with a documented Power BI data source, so finance pulls the same numbers you see instead of asking for a spreadsheet. CerteroX Cloud Management adds cost pools typed as budget, business unit, team, project, CI/CD or asset, assignment rules with nine condition types for automatic ownership, and pool-based showback and chargeback with forecast-aware overspend states. It is a FinOps Certified Platform, and Certero is a FinOps Certified Service Provider.
Key takeaway. Establish shared dashboards that surface real-time spend against budget for hardware refresh, SaaS renewals and cloud commitments.
IoT sensors, edge gateways and remote-worker devices keep expanding the ITAM perimeter. Modern platforms support lightweight agents and API-driven telemetry to discover and monitor edge-deployed hardware as readily as datacentre servers.
Some of this is less exotic than it sounds. SNMP discovery already returns printer consumables and page counts, switch port tables and routing tables; standalone inventory covers air-gapped and offline systems; and non-persistent VDI is handled as a first-class case rather than an exception. The perimeter moved, but the discovery methods that reach it are the ones already in the platform.
Key takeaway. Extend your discovery framework to include IoT and edge endpoints, so lifecycle control does not stop at the corporate LAN.
From licence request to decommissioning, ITAM workflows are being automated through low-code orchestration and event-driven playbooks. Connecting ServiceNow, Jira and the ITAM console itself lets teams enforce policy-driven approvals, push cross-system updates instantly and notify the right people at every stage.
CerteroX SaaS Management runs this as a single canvas: eight triggers, eleven conditions and thirteen actions, covering provisioning and deprovisioning across Entra ID, Okta, Google Workspace, Microsoft 365 and more, with report delivery into Slack and Microsoft Teams. Deprovisioning respects each vendor’s reality rather than assuming a common API — HubSpot has no suspend endpoint, so there is a soft mode that strips roles and a hard mode that deletes; Box transfers file ownership before deactivating; ServiceNow locks the account and strips every role and group membership. On the device side, App-Centre provides self-service software request with manager approval chains, and software distribution handles MSI, EXE and Click-to-Run packages.
Key takeaway. Design end-to-end workflows that automatically trigger discovery scans, financial updates and security checks, reducing human error and shortening time to value.
Visibility and observability. Integrate tools like Intune into ITAM, but do not let them replace it, or you lose control of devices and software outside their enrolment.
Cloud and multi-cloud. Enforce unified tagging and cost-allocation policy across providers.
Compliance automation. Deploy licence-mapping engines with self-service audit readiness.
Security integration. Link ITAM to vulnerability scanners for real-time patch tracking.
Sustainability. Add energy and carbon metrics to procurement and retirement processes.
FinOps alignment. Create a shared TCO view with finance and procurement.
Edge and IoT. Onboard edge devices through API-enabled discovery.
Workflow orchestration. Automate the full asset lifecycle with low-code playbooks.
Other posts covering the same ground.
FinOps was built for the cloud and stops at the data centre door. ITAM knows the assets and licences underneath. Neither is complete alone — and hybrid cost control needs both working from the same data.
Audit frequency went up, not down, as software moved to subscription. Meanwhile a fixed share of cloud spend is wasted every month. Both are real, and only one of them is a certainty.
Why fragmented hardware and software tracking derails a cloud migration, and what has to be true of your asset data before you start retiring things.
Everything argued above is checkable. Name the publisher, the billing account or the platform you would argue with, and the session is built around it — the reasoning attached, not a summary slide.
No gated download at the end of it.