Asset Inventory: The Unglamorous Base of Vulnerability Management
Every vulnerability metric you report is really a statement about the assets you happen to be scanning. If the inventory is wrong, the numbers are wrong in a direction that flatters you. CISA thought this important enough to mandate it: Binding Operational Directive 23-01, issued in October 2022, requires federal agencies to discover assets every seven days and enumerate vulnerabilities on them every fourteen.
Build it from sources you already have
Nobody maintains an accurate inventory by asking people what they own. Pull from systems that already know: DHCP leases, DNS records, cloud provider APIs, your endpoint detection platform, mobile device management, switch address tables and the identity directory. Each source has a blind spot and the overlap is where the truth sits. A device in your endpoint platform but not in the directory is probably unmanaged. A cloud instance in the provider API but not in your scanner is unscanned. The reconciliation between sources is the work, and it is worth automating.
The fields that actually get used
Keep the record small enough that people maintain it. An identifier, an owner, a business service, an environment, an operating system and a date last seen will support almost every decision you need to make. Owner is the field that turns a finding into remediation, because a vulnerability with no owner sits in a queue forever. Business service is what lets you prioritise sensibly when an advisory lands, since knowing that eleven servers are affected is far less useful than knowing that two of them run the customer portal. Anything beyond those fields tends to rot quietly.
“Ask for the number of assets from three different teams and you will get three different answers, usually differing by twenty per cent. That gap is not an administrative annoyance. It is the set of machines nobody patches, nobody monitors and nobody would notice being attacked, and it is where every incident I investigate seems to begin.”
William Fieldhouse, Director, Aardwolf Security Ltd
Cloud and the end of the annual audit
In a cloud estate, assets are created by a pipeline and destroyed hours later, so a quarterly inventory describes a world that no longer exists. Query the provider APIs continuously instead, tag resources at creation with an owner and an environment, and enforce tagging through policy so untagged resources are either blocked or flagged. Treat anything untagged as suspicious rather than as an administrative oversight that somebody will tidy up later, because that is where forgotten infrastructure accumulates and where an attacker’s own resources would sit.
Turning coverage into a metric
Report scanned assets against known assets every month, and treat the gap as the headline. It is a more honest measure of security posture than a count of open findings, which can fall simply because coverage fell. Feed the inventory into a vulnerability management programme so new assets are scanned automatically rather than when somebody remembers, and use external network penetration testing services to check the outside view, since the assets you do not know about are precisely the ones an attacker will find first.
Frequently asked questions about asset inventory
These questions come up whenever a security team tries to fix its data.
Is a configuration management database enough?
Only if it is fed automatically and reconciled against discovery. A database maintained by hand drifts within weeks and gives false confidence, which is worse than knowing your list is incomplete.
How do you handle personal devices?
Record them as a category with the controls that apply, even where you do not manage them individually. What matters is knowing what can reach your data, not owning the hardware.
