A university security team inventories laptop software by logging in remotely and looking around the host. Laptops that stay off campus for weeks never appear in those results. What deployment gap explains the missing laptops?

This inventory authenticates to a live host and enumerates software only while that session lasts. Laptops that remain off campus for weeks are powered down or off the network, so the session never starts and the weekly results omit them. The deployment gap is: Agentless collection misses laptops that are offline or unreachable from the remote login scan. The design that would have kept a local record is the opposite of the gap. An on-host agent keeps recording local activity on the laptop during weeks spent off campus, then can forward that buffer when the machine returns, so it describes the control that closes the hole rather than the hole the team has now. Alert volume is a different problem. A noisy SIEM correlation rule floods the queue with extra alerts from laptops that are healthy, which assumes those laptops already delivered telemetry to correlate. A certificate failure is a different outage. An expired VPN certificate blocks every remote student sign-in at the campus concentrator, but the scenario is an inventory that cannot log in to hosts it cannot reach, not a concentrator rejecting students who are trying to connect. Exam caveat: agentless versus a resident agent is about where collection runs and whether the host must be reachable, not about how chatty a rule is. Operational check: compare successful scan logins with the laptop inventory and confirm the missing rows have no recent check-in before you place a resident agent on the long-absent machines.