Cyber asset inventory

What it is

A continuously updated list of every device, server, cloud resource, application and account, built by combining network discovery with data from the tools you already run. It shows what exists, who owns it and which security controls cover it, so gaps such as a server without EDR or a forgotten test system stand out.

How to value it

Many incidents start on something nobody was watching: a forgotten VPN appliance, an old test server, a contractor laptop, an unmanaged cloud account. Every other control, from patching to EDR to backup, depends on knowing what is there. A live inventory turns the question of whether you are exposed to a new vulnerability from a week of spreadsheets into a query, and it gives auditors and regulators the asset register they expect. Most of the cost is connecting the tools you already own.

Questions to ask a vendor

1. 1How does it find assets: active scanning, passive network monitoring, connections to our existing tools, or a combination?
2. 2Can it show which assets lack a required control, for example no EDR agent, no backup or missing patches?
3. 3How does it handle duplicates and conflicting data from different sources, and how fresh is the data?
4. 4Does it cover cloud resources, SaaS applications and OT or IoT devices, not only laptops and servers?

Risk

Unknown or unmanaged assets that are never patched, monitored or backed up.

Control

An automatically maintained inventory of hardware, software, cloud resources and accounts, reconciled against security tooling.

Owner

IT operations lead.

Measure

Share of assets with a named owner and full control coverage.

A starting point: set the owner and measure to fit your organisation.