The Problem
Software inventory is fragmented — package data says one thing, CPE fingerprints say another, and neither tells the whole story. Teams can't see version sprawl, can't spot end-of-life exposure before it becomes unpatchable, and can't answer the simplest board question: "which product is dragging the most risk?"
What It Does
Mimir merges the software and CPE inventories into one unified product map — with a source delta metric showing what each source missed — then enriches it with endoflife.date lifecycle data, flags crown-jewel software, builds a "behind latest" worklist, and ranks a risk leaderboard by KEV and critical exposure.
Key Capabilities
- Merged product map with source badges — reconciles the software and CPE inventories into one product list, each row badged with which source saw it, plus a delta metric quantifying what either source alone missed.
- Version-sprawl, most-deployed, and single-install views — spot the product running fourteen versions, the package on half the estate, and the one-off install nobody owns.
- EOL detection + tags — endoflife.date lifecycle status lands directly on your inventory, before end-of-life becomes an audit finding.
- Crown-jewel software flags — role-based ACR suggestions raise the criticality of assets running the software the business depends on.
- Risk leaderboard — products ranked by the KEV and critical exposure they drag into the estate.
- Gated tags + CSV export — every finding becomes a proposed, human-approved tag or an exportable worklist.
How It Works
Mimir runs against the local navi.db built from your Tenable data: the software and cpes tables reconciled into one map, enriched by a cached endoflife.date lifecycle feed, with the vulns table supplying risk. All writes are proposed, human-approved, and logged.
Who It's For
Vulnerability management teams who need risk-ranked patching; IT asset managers reconciling inventories; patch teams that want one worklist instead of three exports.
Proof Points
In a reference environment of 268 assets, Mimir reconciled ~28,700 software rows and ~43,700 CPE rows into a single unified product map — with source badges showing exactly which inventory contributed each product. Inventory depth depends on scan coverage; blind or uncredentialed hosts are called out, not hidden.
Works Better With
Mimir feeds Charon (EOL tagging from lifecycle data), Anubis (crown-jewel software → ACR calibration), Pythia (AI apps surfaced in CPEs), and Fenrir (exploitable software as attack-path evidence).