Most security programmes start with tools: a scanner, a SIEM, an endpoint agent. Each one is only as good as the list of things it is pointed at. If an asset is missing from that list, it is not scanned, not patched, not monitored and not covered by the audit. That is why asset visibility sits underneath every other control.
The register is usually wrong
In large organisations the asset register is a snapshot that drifts from the truth the day after it is compiled. New cloud accounts appear, branch and field devices are replaced, contractors connect their own equipment, and acquired companies bring whole networks with them. Each source of data, such as the CMDB, the vulnerability scanner, the identity provider and the cloud console, holds part of the picture and disagrees with the others.
Why it matters more in some sectors
- Financial institutions run a long chain of systems between a customer and the ledger. A forgotten server in that chain is still in scope for the regulator and still a path for an attacker.
- Oil and gas and other energy operators mix office IT with operational technology in remote sites. Devices there live for years, are patched rarely, and often sit outside the normal inventory.
- Organisations that grow by acquisition inherit assets nobody on the new team has seen.
What good looks like
- Combine sources, do not replace them. Pull from the tools you already have and reconcile them, so the gaps between sources become visible. A device seen by the network but absent from the CMDB is exactly what you are looking for.
- Ask questions of the data. Which internet-facing systems have no owner? Which machines lack an endpoint agent? Which accounts belong to people who have left?
- Assign an owner to every asset. An asset without an owner never gets fixed.
- Keep it current. Treat it as a continuous process with a review cadence, not a yearly project.
Where to start
Pick one question you cannot answer today, such as "which of our systems are reachable from the internet?", and answer it from at least two independent sources. The differences between those answers are your first findings.
If you want help doing this across your estate, get in touch.