Enterprises want absolute clarity on their IT footprint: they want to know exactly what software is running, where it’s running, and how those deployments align with subscription entitlements. For many organizations, Red Hat Hybrid Cloud Console and subscription watch provide that visibility. But what happens when your infrastructure can't (or shouldn't) phone home? Air-gapped networks, government systems, manufacturing floors, and sovereign clouds all require a completely disconnected approach.That is exactly why we built discovery, an open source, agentless scanning tool that is a component of Red Hat Lightspeed and is designed to run entirely within your infrastructure. It scans your network environments, including IP ranges, hostnames, vCenter connections, and Red Hat Satellite servers to identify exactly which Red Hat products are deployed, including Red Hat Enterprise Linux (RHEL), Red Hat OpenShift Container Platform, Red Hat Ansible Automation Platform, or JBoss. Discovery can also determine the version numbers and infrastructure footprint for all these products. It is entirely configurable by you.This blog post will look under the hood of discovery, covering what your security team needs to know, how a scan executes from start to finish, and how we are solving the hardest engineering problems in enterprise-scale agentless scanning.What your security team needs to know about discoveryAny tool that requires network access and credentials deserves rigorous scrutiny, and discovery is engineered to make that security review as straightforward as possible.Core security architectureCompletely agentless: Discovery leaves no footprint on your target systems. There are no persistent agents to maintain, no background daemons to patch, and no software left behind.Strictly read-only: Once connected, discovery only reads system metadata, configuration files, and package registries. It never modifies configurations, writes files, or changes system state. It cannot access passwords, application data, or user files.Local credential isolation: Credentials provided for your scan sources are stored locally on your own discovery instance. They are used strictly at scan time and are never transmitted externally. When a scan concludes, credential usage ends immediately.Total data autonomy: Your scan data is yours. Scan results live entirely on your discovery instance within your environment. There is zero telemetry, no automatic phone-home functionality, and no background sync to Red Hat.Network footprintDiscovery requires no inbound ports beyond what is already running in your environment. It connects outbound from your local discovery instance to the target infrastructure using standard, pre-existing management ports:SSH (Port 22): For RHEL and other Linux systems.WinRM (Ports 5985/5986): For Windows systems.HTTPS (Port 443): For VMware vCenter and Red Hat Satellite APIs.Note on elevated privileges: If your security parameters restrict sudo access, discovery is designed to degrade gracefully: It will still run with reduced privileges, allowing the scan to complete rather than fail, though it may return less complete metadata. As part of our commitment to transparency, we are actively documenting all commands that use elevated privileges, along with the reasons why those commands need those privileges.Anatomy of a discovery scan from start to finishTo understand how discovery protects your environment while gathering data, let’s walk through the end-to-end lifecycle of a single scan. We begin on the introduction screen of the discovery UI that you will see when discovery starts up, shown in Figure 1.