Let’s talk about CMDB inaccuracies. My family reads like a cross-section of the professions that keep complex systems alive, including:
- Physicians, physician assistants, and nurses who diagnose and treat the human body
- Software, mechanical, and chemical engineers who build and maintain the systems the modern world runs on
- Scientists, researchers, and university professors who study why systems succeed or fail.
Sitting at this table for most of my life, I absorbed a habit of mind common to all three groups:
- Look past the visible symptom
- Find the underlying mechanism
- Treat the root cause instead of the flare-up.
A configuration management database (CMDB) demands that same discipline, and most organizations skip it.
The CMDB and the Human Body
The human body relies on two organs to keep its blood clean:
- The liver transforms what enters the body, converting food, drugs, and toxins into forms the body can use or safely discard. When it fails beyond recovery, the only lasting remedy is a transplant.
- The kidneys filter the blood, removing waste and excess fluid so every organ gets a clean, balanced supply. When they fail, dialysis takes over the filtering from outside the body.
Few IT leaders describe their CMDB in such visceral, biological terms, though I believe the comparison holds up under scrutiny.
The CMDB performs the work of both organs for the IT ecosystem. It carries out the liver’s work when it converts raw discovery data into consistent, usable configuration records, and the kidney’s work when it removes the duplicate, stale, and orphaned records that would otherwise circulate to every dependent process, including IT service management (ITSM), enterprise service management (ESM), IT asset management (ITAM), IT operations management (ITOM), security operations, and observability.
When either function breaks down, everything downstream begins to suffer. In large enterprises, Fortune 50 organizations in particular, the volume of that pollution is substantial.
The Scale of this Challenge
Large, hybrid, multi-cloud enterprises manage CMDBs with hundreds of thousands to tens of millions of configuration items (CIs) once you include relationships, software instances, interfaces, and cloud resources. Publicly discussed ServiceNow deployments , cited as the largest ITSM platform provider, range from tens of thousands of CIs to many millions at the largest scale.
My analysis uses a conservative working assumption of about 5,000,000 CIs in scope for a Fortune 50-scale enterprise, spanning infrastructure, applications, services, and relationships. Some global conglomerates run higher and others lower. However, this order of magnitude sits well within the documented range for enterprise CMDBs at scale.
Recent conversations with technology leaders across a number of Fortune 100 companies reveal a wider, more extreme range on the ground than published benchmarks suggest. Several CIOs describe environments with more than 50 million CIs in the CMDB, of which about 375,000 bear any relevance to running the business, a signal-to-noise ratio that drains the term “system of record” of its meaning.
Others describe environments past 100 million CIs and still growing, a scale at which tuning or cleaning the CMDB from within stops being realistic. For these CIOs, the conversation shifts to greenfield replacement, retiring the existing CMDB and starting over, because the accumulated toxin load has outpaced any practical filtration. The clinical parallel is a liver transplant, in which surgeons remove the failed organ and a healthy donor organ takes its place, a far more invasive and expensive path than any treatment that preserves the original.
How Many of Those CIs Are Correct
The numbers turn uncomfortable once accuracy enters the analysis. Industry research widely attributed to Gartner places average CMDB data accuracy at roughly 60%, and Gartner finds that only about 25% of organizations extract meaningful value from their configuration management database investment.
ServiceNow’s CMDB Health framework tracks the same toxins this article describes in biological terms, and the platform measures duplicate CIs, orphaned CIs with no valid relationships, and stale CIs left unchanged beyond a defined window as native correctness KPIs.
Applying a 60% accuracy rate to the 5 million CI baseline yields:
- 3,000,000 correct CIs
- 2,000,000 that are duplicate, orphaned, stale, or otherwise incorrect.
Those 2 million toxic CIs are the waste circulating in the IT bloodstream. In a healthy body, the kidneys would have removed them long before they reached any organ.
The Direct Financial Hit of CMDB Inaccuracy
Enterprise ITSM, ITOM, ITAM, and monitoring platforms are priced and metered by CI or managed node. ServiceNow ITOM Visibility, for example, is commonly priced at $10 to $15 per node per month, and CMDB growth beyond a contracted allotment can trigger overage charges at renewal.
Rolling per node fees, discovery, monitoring, and asset tooling overhead into a single blended figure produces an effective cost of $8 per CI per year across the full ITSM, ITOM, ITAM, and monitoring stack, a reasonable working assumption for a Fortune 50 environment and a modest one against the $120 to $180 per year that per node ITOM pricing alone can imply. At $8 per CI, the 2,000,000 incorrect CIs generate an annual licensing and tooling overrun of $16,000,000, spent counting and charging for records that are duplicated, stale, or absent from the environment as recorded.
The Hidden Operational Time Cost of CMDB Inaccuracy
Licensing and capacity costs account for half the story, since every incorrect CI also consumes human time as engineers, SREs, security analysts, and asset owners chase down owners, reconcile records that contradict reality, and untangle incidents that point to a misclassified or non-existent CI.
A modest assumption holds that each incorrect CI drives 0.1 hours, or six minutes, of human effort per year spread across reviews, audits, and incident triage.
“Doing the math” using fully loaded US IT labor rates, which in 2026 commonly run at $85 to $150 per hour once benefits, overhead, and taxes are included. A blended mid-level rate is near $100 per hour. So, two million incorrect CIs at 0.1 hours each produce 200,000 wasted hours, and at $100 per hour the annual operational time cost reaches $20,000,000.
Combined, these two figures amount to $36 million per year in direct, measurable cost drag from incorrect or unnecessary CIs in a Fortune 50 environment. And this is before counting the downstream impact of outages and security incidents.
This order of magnitude aligns with broader data quality research:
- Gartner estimates that poor data quality costs organizations at least $12.9 million a year on average
- IBM has estimated the annual cost of poor data quality to the US economy at $3.1 trillion
- Thomas Redman, writing in MIT Sloan Management Review, places the cost of bad data at 15% to 25% of revenue for most companies.
The Risk Multiplier
Bad CIs cost more than wasted money because they raise risk. A CMDB that misrepresents the environment produces misleading service maps and flawed impact analysis, and incident response slows as war rooms lose time reconciling what the CMDB reports against what monitoring systems show:
- ITIC’s 2025 research found that a single hour of downtime costs 93% of mid-sized and large enterprises $300,000 or more, with 51% placing the figure at $1 million or more.
- Research by Enterprise Management Associates, commissioned by BigPanda, places the average cost of unplanned IT downtime at $14,056 per minute in 2024, rising to $23,750 per minute for large enterprises.
In a Fortune 50 enterprise, where each additional minute of a major outage can mean hundreds of thousands to millions in lost revenue, a handful of extra major incidents per year, or 30 to 60 added minutes on each one because the CMDB pointed responders in the wrong direction, stacks into eight-figure risk.
Incorrect and duplicate CIs also open blind spots for security and compliance, including shadow systems that appear monitored while sitting stale, assets missing from vulnerability scan scopes because their relationships are wrong, and software and hardware that should have been retired still presenting as active.
Gartner reports that only 17% of organizations can clearly identify and inventory 95% or more of their assets, a governance gap with direct security and audit consequences.
Why This CMDB Issue Keeps Happening
Most CMDB programs were never designed for the dynamism, scale, and complexity of modern hybrid and multi-cloud environments.
Common failure patterns include:
- Raw ingestion without filtration, where discovery tools push everything inward without a pre-processing stage
- Multiple conflicting sources of truth across business units and infrequent or manual data certification.
The result is a CMDB that starts clean and degrades until it becomes too inaccurate to trust, too disordered to repair by hand, and too embedded in adjacent systems to switch off. Many organizations reach that point and abandon the CMDB as a system of record while they continue paying for every toxic CI inside it.
The Fix: Dialysis for Your CMDB
When the kidneys can no longer keep up, dialysis filters the blood outside the body so the remaining organs can keep working.
A CMDB needs the same intervention upstream: a pre-processor that filters, cleanses, and normalizes data before it reaches the CMDB. The first three functions below perform kidney work, removing waste before it enters circulation, and the last three perform liver work, converting what remains into records the enterprise can trust.
A capable CMDB pre-processor will:
- Deduplicate CIs based on rules and patterns, preventing multiple records for the same asset
- Prevent system components and other undeserving objects from ever becoming standalone CIs
- Identify stale or orphaned CIs and flag or suppress them before they pollute the main repository
- Validate against authoritative sources such as HR systems, procurement, and cloud APIs to confirm that assets exist and hold the expected state
- Normalize naming conventions and attributes for consistent labels across environments and domains
- Correct and align relationships so service maps and dependency views remain accurate and actionable.
In the Fortune 50 model, a pre-processor that eliminates or corrects half of the 2,000,000 incorrect CIs, or 1,000,000 records, recovers:
- $8,000,000 per year in licensing and tooling overrun
- $10,000,000 per year in operational time.
Nearly $18 million per year in reclaimed value before accounting for fewer outages, faster triage, and reduced security exposure.
The Bottom Line with CMDB Inaccuracy
A polluted CMDB becomes an expensive liability that taxes the budget and raises the risk profile. A clean, accurate, and continuously maintained CMDB becomes a value engine in which:
- ITSM processes run on reliable context
- ITOM and AIOps tools draw trustworthy inferences
- ITAM and software asset management (SAM) teams defend license positions with confidence
- Security and compliance teams gain an authoritative view of the environment.
A healthy CMDB keeps spending aligned with the environment, with:
- No licenses or support for ghost assets
- No double counting from duplicates
- No oversized monitoring tiers built on inflated CI counts.
In doing so, it becomes a foundation for efficiency and resilience.
No one waits for organ failure to start caring about kidney and liver health. Physicians:
- Adjust the inputs
- Filter the toxins
- Turn to dialysis when the kidneys can no longer keep up
- Reserve transplant for a liver beyond recovery.
A CMDB deserves the same attention, and early dialysis is less disruptive and less costly than a transplant.
For large enterprises, a few million CIs and a 40% error rate can cost an organization tens of millions of dollars a year in direct and indirect costs. Healthy data sustains a healthy CMDB; a healthy CMDB sustains healthy IT; and the result is a spend profile that reflects the environment as it exists, which is the purpose of CMDB dialysis.
CMDB Accuracy FAQs
Industry research attributed to Gartner puts average CMDB data accuracy at roughly 60%. Applied to a Fortune 50 baseline of 5 million CIs, that means about 3 million correct records and 2 million duplicate, orphaned, stale, or otherwise incorrect ones.
Because enterprise ITSM, ITOM, ITAM, and monitoring platforms are priced and metered by CI or managed node. At an effective blended cost of $8 per CI per year across that stack, 2 million incorrect CIs generate an estimated $16 million in annual licensing and tooling overrun.
At an assumed 0.1 hours (six minutes) of review, audit, and triage time per incorrect CI per year, and a blended fully loaded IT labor rate near $100 an hour, 2 million incorrect CIs translate to 200,000 wasted hours and roughly $20 million in operational time cost, on top of the licensing figure.
It produces misleading service maps and flawed impact analysis, which slows incident response as teams reconcile what the CMDB reports against what monitoring actually shows. It also creates blind spots for security and compliance: shadow systems that look monitored but sit stale, assets missing from vulnerability scans because relationships are wrong, and retired hardware or software still showing as active.
It’s a filtering and normalization layer that sits upstream of the CMDB, handling six functions: deduplicating CIs, preventing system components from becoming standalone CIs, flagging or suppressing stale and orphaned CIs, validating records against authoritative sources like HR and cloud APIs, normalizing naming conventions, and correcting relationships so service maps stay accurate.
When the CI volume and error rate outpace any practical filtration, some CIOs describe environments past 100 million CIs where tuning from within stops being realistic. At this point, the parallel drawn is a liver transplant: retiring the existing CMDB and starting over, rather than continuing to filter a system that’s already failed.
Salil Kulkarni
Salil Kulkarni is Chief Strategy and Information Officer at Virima. He has previously served as EVP and CIO at Caesars Entertainment, CIO at Las Vegas Sands, and in C-Level roles at Equifax and John Harland, and other publicly and privately traded companies. He serves as a Board member and advisor to a number of AI-focused technology companies.
