Choosing collector placement
How many collectors a site needs, where to run them, and why one per routed security boundary is the default.
Overview
AssurIQ does not require an agent on every endpoint to begin discovery, scanning and evidence collection. A single collector, placed correctly, can see and assess an entire routed network segment. The question that matters is not "how many endpoints" but "how many distinct security boundaries."
The default rule
For a typical managed customer or internal site, install one collector per routed customer/site security boundary. If every VLAN at a site routes through the same core switch or firewall and the collector has SNMP/credentialed reach to each one, a single collector is sufficient.
| Scenario | Recommended collectors |
|---|---|
| Single office, flat or routed VLANs, one firewall | 1 |
| Single site, isolated OT/ICS network with no routing to IT VLANs | 2 (one per boundary) |
| Large site (thousands of hosts, multiple buildings on shared core) | 1, sized for concurrency, or 2 for headroom |
| Multiple disconnected branch sites (own internet circuit, no site-to-site VPN) | 1 per branch |
| Segmented environment with strict east-west firewalling between zones | 1 per zone that must be independently discoverable |
When to add more collectors
- A network segment is isolated by policy (e.g., a PCI cardholder-data environment) and must not be reachable from the general IT VLAN collector.
- A site is large enough that discovery, SNMP polling and scan concurrency for the whole estate would exceed a single collector's practical throughput.
- A segmented environment requires provably independent evidence per zone for audit purposes, rather than one collector asserting reach into all zones.
- A remote or disconnected network (no routing back to the primary site) needs its own outbound path to the AssurIQ control plane.
Choosing the host
Run the collector on an always-on machine close to the core of the segment it will assess: a server, a small always-on appliance, or a dedicated VM. Avoid laptops or workstations that sleep, roam between networks, or are reimaged on a schedule.
- Prefer wired connectivity over Wi-Fi for discovery accuracy (ARP/broadcast visibility).
- Place the host on a VLAN that has routed or bridged reach to the subnets in scope, or add static routes/SNMP reach explicitly.
- Ensure the host survives normal maintenance windows and patch reboots without losing its scheduled task/service.
Sizing for scale
A single collector can typically discover and poll several thousand hosts within a routed network without issue, since discovery and SNMP work are I/O-bound rather than CPU-bound. The practical limit is usually maximum concurrency settings and the length of a maintenance window for credentialed scans, not raw host count.
| Site size | Guidance |
|---|---|
| < 500 assets | Single collector, default concurrency |
| 500 - 5,000 assets | Single collector, raise max concurrency, confirm scan windows are wide enough |
| > 5,000 assets or multiple independent buildings | Consider a second collector for headroom and fault isolation |
Next steps
Once placement is decided, install the collector for the target OS and enroll it with a scoped token.
- Install the collector on Windows (x64)Unattended install of the Windows service build with an enrollment token and control plane URL.
- Install the collector on Linux (x64, systemd)Install the systemd-managed collector service and enroll it from the command line.
- Run the collector in DockerCompose or run the collector container with host networking and a secret-backed enrollment token.
- Discovery scope and safetyCIDRs, exclusions, blocked targets, concurrency and maintenance windows: how scan scope is defined and enforced server-side.