Every device that connects to a managed switch announces itself, negotiates link parameters and broadcasts neighbor information. Port counters pile up as a side effect. The switch never has to copy traffic to learn any of this. CybrIQ reads what the switch already has.
What the switch records by default.
A modern managed switch keeps six kinds of signal as part of its own operation, and none of them was added for security. Link negotiation, meaning speed, duplex and the auto-negotiation outcome. Power draw and the power class the device declared, on ports that deliver power. The MAC OUI and the descriptors the device presents when it connects. LLDP and CDP announcements: every TLV the device sent at the management plane, kept by the switch as neighbor data. The port-stats footprint, covering counter rates, error rates, frame-size distributions and link-flap history. And VLAN and topology context, including spanning-tree role, neighbor port relationships and BPDU patterns. Packet contents play no part in any of the six.
What it costs the network.
Older approaches to Layer 1 visibility put something in line with traffic or hang a sensor off a SPAN port. Both work at small scale and both break at enterprise scale. SPAN is expensive in switch CPU. Mirror ports are a finite resource. Putting any in-line device into the production path is a change-management conversation nobody wants. Switch-derived collection skips all of that, because the signals are already there. Its CPU cost is the cost of read-only switch access, which the switch is engineered to absorb.
Why the answer comes out the same every time.
The switch-derived path is deterministic. Given the same signal set, identity resolution against the reference database returns the same identity every time. No model decides whether an observation looks like a device: the observation plus the database lookup is the identity. An auditor will accept "the signature is the SHA of the collected signals plus the database identity record." An auditor will not accept "the model thought it looked like a Crestron."
Determinism matters when something has to hold up under interview. A switch-derived identity resolves the same way today, tomorrow and during the post-incident reconstruction. A behavioral-inference identity might not.
What happens when it fails.
Read-only access leaves network state alone. The worst case for the integration is that it stops polling, and then you lose visibility until it resumes. Nothing goes down. An in-line sensor's worst case is dropped production traffic, so that integration conversation has to cover recovery, failover and bypass. A read-only, switch-derived integration only has to explain what happens when polling stops.
What the reference database adds.
The signal set tells you a device is on a port. The database tells you which device. The CybrIQ reference library carries more than 750 million device fingerprints, from workstations, conference-room codecs and biomedical equipment to retail kiosks, OT controllers and building systems, and it grows weekly. Matching against a million-device reference gets you the common gear. Matching against 750 million is what makes the long tail of odd devices in real environments resolvable.
The narrow constraint.
The tradeoff is that we see only what the switch sees. If a device is connected but the switch is misconfigured to ignore its port, we miss it. If it sits on an unmanaged switch downstream of a managed one, we identify the downstream segment as one entity and do not enumerate the devices behind it. Those limits are real. The rest of the design has to carry the identity work that makes the narrow path useful at scale: the structured signal set, the 750-million-device reference database and the change-event taxonomy.
How it works is the technical reference for the switch-derived approach. Trust and security covers the deployment posture, including what gets installed where and how access is provisioned, and integrations covers syslog and REST.