In an embodiment, an asset may utilize one or more scanning techniques to detect a first set of software components that is not being natively tracked by an operating system of the asset, the one or more scanning techniques comprising one or more of an evaluation of metadata associated with one or more running processes of the asset, and an evaluation of file system information that characterizes the first set of software components. The asset may further store an indication of the first set of software components detected in accordance with the one or more scanning techniques, and may optionally report the indication to an external entity (e.g., a vulnerability management system).