🔵
Agent-based — software installed on endpoint, continuous monitoring, detailed visibility.
⚪
Agentless — network-based scanning, no software to install, lower overhead.
Agent-based provides richer data (running processes, file changes). Agentless is easier to deploy at scale. Many EDR and SIEM solutions support both modes.