You Can't Protect What You Don't Know You Own

Ask security professionals where to start improving an organization's security, and many will give the same answer: find out what you have.

It sounds almost too basic. But you can't patch a laptop you don't know exists. You can't monitor a server nobody remembers setting up. You can't revoke access to an application nobody knew the company was using. Every security control, from patching and monitoring to backups and incident response, depends on knowing what's there.

As an IT Support Specialist at a manufacturing plant with more than 1,200 users, part of my job was managing inventory, suppliers and acquisitions so equipment and spare parts were always available. At the time, I thought of it as an operational task. Since studying cybersecurity, I've come to see it as one of the most important security functions in any organization.

Why asset inventory is a security control

Major security frameworks place asset management at the very beginning. The Center for Internet Security (CIS) Critical Security Controls list inventory and control of enterprise assets as Control 1 and inventory of software assets as Control 2. The NIST Cybersecurity Framework includes asset management as part of its Identify function. That ordering isn't an accident. Everything else builds on it.

Here's how inventory supports security in practice:

• Patching. When a critical vulnerability is announced, the first question is "Are we affected?" Without an inventory, answering takes days. With one, it takes minutes.
• Incident response. When an alert fires on a device, responders need to know what it is, who uses it, where it is and what it connects to.
• Detecting unauthorized devices. If you know what should be on the network, you can spot what shouldn't, such as a personal device plugged into a production network or a rogue wireless access point.
• Lifecycle management. Knowing which devices are approaching the end of vendor support lets you plan replacements before they become unpatchable.
• Recovery. After a failure or attack, inventory tells you what needs restoring and in what order.
• Data protection. Knowing where devices are, and who has them, matters when a laptop is lost or an employee leaves.

What a useful inventory contains

An inventory doesn't need to be complicated, but it does need the right information. For each hardware asset, I'd record:

• Identity: asset tag, hostname, make, model and serial number.
• Location: site, building, department or user.
• Owner: the person or team responsible.
• Purpose: what it's used for, and how critical it is to the business.
• Network details: IP address or range, MAC address and network segment.
• Software and version: operating system and version, plus key installed software.
• Lifecycle: purchase date, warranty expiry and end-of-support date.
• Supplier and support: vendor, contract reference and support contact.
• Status: in use, in stock, under repair, retired or disposed of.

For software and cloud services, record the application, version, owner, licence details, where it runs and what data it handles.

Lessons from managing inventory on a factory floor

Inventory changes every day. New machines arrive, devices move between departments, equipment goes out for repair and comes back, and old devices are retired. An inventory that's updated once a year is out of date the day after. Updates need to be part of everyday work: every new device, move, repair and disposal gets recorded at the time it happens.

Spares are assets too. Spare laptops, switches and parts in a storeroom still need tracking. They may hold old data, need updates before deployment or quietly go missing.

Repairs are a weak point. When equipment went out for vendor repair, recording serial numbers out and back in made sure we knew what had left the building, what returned and whether a replacement had been swapped in. It also prompted the question of what data was on the device before it left.

Non-computer devices matter. In a manufacturing environment, label printers, barcode scanners, production equipment, cameras and other connected devices are all on the network. They're often the least visible and least managed devices, and they deserve a place in the inventory just as much as laptops do.

Disposal must be documented. Retired devices need data wiped or drives destroyed according to policy, with a record of what was done and when. An inventory that ends at "retired" without a disposal record leaves a gap.

Finding what you don't know about

Even good inventories miss things. A few techniques help close the gaps:

• Network discovery. Scanning your own networks, with authorization, reveals devices that are connected but not recorded.
• DHCP and switch data. DHCP leases and switch port information show what's been connecting and where.
• Endpoint management tools. Devices enrolled in management or security tools report back automatically.
• Purchase records. Comparing what was bought against what's in the inventory highlights missing items.
• Cloud and expense reviews. Reviewing software subscriptions and expense claims often uncovers cloud services that departments signed up for without IT's knowledge, often called shadow IT.

Each source catches things the others miss. Reconciling them regularly keeps the inventory honest.

Start simple

Many organizations put off asset management because they imagine a large, expensive project. It doesn't have to start that way.

1. Start with a spreadsheet if that's all you have. A simple, accurate list is far more useful than a sophisticated tool that nobody updates.
2. Focus on critical assets first: servers, network devices, internet-facing systems and devices handling sensitive data.
3. Assign ownership for keeping the inventory current.
4. Build updates into existing processes: onboarding, purchasing, repairs and offboarding.
5. Reconcile monthly against at least one discovery source.
6. Move to a dedicated tool once the process works, so you're automating good habits rather than bad ones.

When inventory pays off: a typical scenario

Imagine a vendor announces a serious vulnerability in a particular model of network switch, with attacks already being reported.

Without an inventory, the response is slow and uncertain. Someone has to walk the building, log in to devices one by one or search old purchase emails to find out whether the organization owns that model, how many, where they are and which firmware they run. Days pass while the vulnerability stays open.

With an inventory, the response takes minutes. Filter by make and model: four switches, two in the main building and two at the warehouse. Firmware versions are recorded, so it's clear three are affected. Owners and locations are listed, and support contracts are current, so updated firmware can be downloaded straight away. The team schedules updates that evening and records the change.

The same pattern applies to software vulnerabilities, end-of-support announcements and product recalls. Every time something new is announced, the inventory turns a question into an answer.

Common objections, and answers

"We're too small to need this." Small organizations are often targeted precisely because they have fewer controls. A simple spreadsheet maintained consistently is enough to start.

"It'll be out of date immediately." Only if updates aren't built into everyday processes. Record changes when devices are bought, moved, repaired and retired, and reconcile monthly.

"We already have tools that track devices." Great. Then reconcile those tools against each other. Each one usually misses something the others catch.

"It's IT's job, not mine." Department managers often know about equipment and cloud services IT doesn't. Inventory works best as a shared responsibility.

How it connects to the rest of security

Once you have a reliable inventory, everything else gets easier. Patching becomes measurable because you know how many devices should be patched. Monitoring becomes complete because you know which devices should be sending logs. Access reviews make sense because you know which systems hold sensitive data. And incident response speeds up because responders can answer basic questions instantly.

Questions to ask about your own inventory

If you want a quick health check, try answering these without guessing:

• How many laptops and desktops does the organization own right now, and how many are in use?
• Which devices are past their end-of-support date?
• Which servers and services are reachable from the internet?
• Who owns each critical system?
• Which cloud services hold company data?

If any answer takes more than a few minutes to find, that's where to start.

The takeaway

Asset inventory isn't glamorous, and it rarely gets credit when things go well. But it's the foundation every other security control stands on. If you're not sure where to start improving security, start by finding out exactly what you own, and keep that list accurate every day.

How confident are you that your organization's inventory includes every device on the network?