# How to Identify Devices Running Vulnerable or Outdated Applications Arjun Saiju 23 Oct 2026 **Summary** An explainer on building a reliable application inventory, matching it to known vulnerabilities, and finding the devices that need attention first. You cannot patch what you cannot see. Most IT teams know that, and yet a laptop running a four-year-old PDF reader still slips through. It was offline during the last scan. Or the application showed up under a name the vulnerability database does not recognise. Or nobody knew it was installed at all. That gap matters because attackers use it. [Mandiant's M-Trends 2026 report](https://cloud.google.com/security/resources/m-trends-executive-edition) found that exploits were the most common initial infection vector for the sixth year running, at 32% of intrusions. Finding the exposed devices comes down to a repeatable sequence: build an accurate application inventory, match it to known vulnerabilities, flag what has gone out of support, and rank the results by real risk. The six steps below follow that order. ## Six steps to find vulnerable and outdated applications across your devices ### 01. Start with an application inventory you can trust Everything else depends on this. For every device, you need the application name, version, and publisher, across Windows, macOS, and Linux, including per-user installs and portable apps that a basic scan can miss. #### Why one application shows up under five names From what we observe, the first obstacle is rarely the scan. It is naming. The same product appears as Adobe Acrobat on one device, Acrobat Reader DC on another, and Adobe Reader 2020 on a third, and a vulnerability feed will not match all three. We suggest normalising names and versions into a single catalogue before you match anything, so that one application is one record. A capable solution with [automated software inventory](https://www.manageengine.com/products/desktop-central/software-inventory.html) that records name, version, and manufacturer across all three platforms, and alerts on new installs, gives that catalogue a continuous feed instead of a quarterly export. ### 02. Make sure every device is actually reporting An inventory only describes devices that check in. The laptop in a drawer, the remote machine that stays off the VPN, and the device that was never enrolled will all look fine, or look like nothing at all. #### The devices that quietly drop off The devices that cause the most surprise are the ones last seen weeks ago. Their data looks healthy because it is old. Organisations should: - **Track the last scan time:** Track the last scan time for every device and flag anything older than seven days. - **Compare inventory with discovery:** Compare the inventory against your directory and run agentless network discovery to find devices with no agent, but do not rely on discovery alone for application detail, because it sees far less than an installed agent does. - **Separate roaming and remote devices:** Treat roaming and remote devices as their own group, since they miss scheduled scans most often. ### 03. Match installed versions against known vulnerabilities Once names and versions are clean, match them against the [National Vulnerability Database](https://nvd.nist.gov/) and vendor advisories. Cross-check the results with the [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) to see which findings are currently being exploited. However, doing this manually across a large fleet is often a slow and time-consuming process. Investing in a [capable solution](https://www.manageengine.com/products/desktop-central/vulnerability-management.html) allows you to identify vulnerabilities automatically based on the devices and software actually present in your network, removing the manual task of cross-checking each version against advisories. #### A match is a lead, not a verdict Version matching produces false positives, because vendors sometimes backport fixes without changing the version number, especially in Linux packages. We suggest checking the vendor advisory for any finding that looks surprising before it reaches an engineer's queue. A wrong ticket costs more trust than a late one. ### 04. Flag software that has gone out of support Out-of-support applications carry a different kind of risk, because no fix will ever arrive. [CISA's 2026 directive on end-of-support edge devices](https://www.cisa.gov/news-events/directives/bod-26-02-mitigating-risk-end-support-edge-devices) starts with an inventory that identifies what is no longer supported, and CISA, the FBI, and the UK's NCSC encourage all organisations to take the same approach. At Endpoint Central, we use the [end-of-life software](https://www.manageengine.com/products/desktop-central/help/vulnerability-management/audit-and-eliminate-high-risk-software.html) tab under the vulnerability management module to identify EOL software, then apply the relevant patches where they are available or uninstall the software. #### Why a clean scan can still mislead A product past its support date may show few new vulnerabilities simply because nobody is publishing advisories for it. Try tagging every application in the catalogue with its end-of-support date, and treat anything past that date as a finding in its own right, whatever the scanner says. ### 05. Rank findings by risk, not by raw count A fleet can throw up thousands of findings in one scan, and working down a severity list wastes the first week. We suggest ranking in this order: 1. **Known exploitation:** Findings on the CISA Known Exploited Vulnerabilities list, since exploitation is already happening. 2. **External content exposure:** Applications that handle content from outside the organisation, such as browsers, PDF readers, and collaboration clients. 3. **Affected device count:** Findings that appear on many devices at once, because one fix clears the most exposure. #### Where to look first In most environments we look at, browsers and document readers sit near the top of the list. Teams that rank by exploitation status and affected device count tend to spend their first week on the findings that matter. A capable solution that audits end-of-life software and scores vulnerabilities by [exploitability, age, and fix availability](https://www.manageengine.com/vulnerability-management/vulnerability-assessment.html) makes that ranking automatic rather than a spreadsheet exercise. ### 06. Verify the fix, then keep the loop running Identification is not finished until you have confirmed the fix. Rescan after remediation and flag any device still on the vulnerable version. #### Yesterday's clean device is today's finding New CVEs are published daily, so a device that was clean last month can become a finding without any change on the device. Re-match the stored inventory against new advisories as they arrive, rather than waiting for the next full scan. [The Forrester Total Economic Impact](https://www.manageengine.com/products/desktop-central/forrester-total-economic-impact-uems.html) study commissioned by ManageEngine, Endpoint Central found that customers automated up to 95% of patching effort. That is a composite model, not a guarantee, but it shows where the time goes once identification and remediation stop being manual. ## What a reliable answer looks like When someone asks which devices are running vulnerable or outdated applications, you should be able to answer in minutes, with a list rather than an estimate. That depends on a clean inventory, devices that report, and findings ranked by risk. Get those three right and the question stops being a fire drill. ## Read more - [How to Conduct a Vulnerability Risk Assessment](https://www.manageengine.com/products/desktop-central/endpoint-security/vulnerability-risk-assessment.html) - [Endpoint Automation for Enterprises: Mundane IT Tasks to Automate in 2026](https://www.manageengine.com/products/desktop-central/enterprise/endpoint-automation-for-enterprises.html) - [How a Strong Endpoint Security Posture Can Reduce Cyber Insurance Premiums](https://www.manageengine.com/products/desktop-central/endpoint-security/reduce-cyber-insurance.html)