Inventory

Inventory (asset inventory) in cybersecurity is an up-to-date, central record of all of an organization’s IT assets together with their descriptions — hardware, software, cloud services, accounts, and data. It is the foundation for managing risk, vulnerabilities, and the attack surface. The principle is simple: you cannot protect, monitor, or patch something you do not know about. That is why inventory is the first step of any mature security program.

What is inventory in a security context?

This is something different from warehouse or accounting inventory, where what counts is goods and fixed assets. Here the record covers everything that processes, stores, or transmits information and could become a way in for an attacker. A plain list of names is not enough — each asset is described by a set of attributes that matter for security and compliance.

Common asset classes include:

• Devices — workstations, laptops, servers, mobile devices, network gear (routers, switches, firewalls), IoT/OT devices, virtual machines, and cloud instances.
• Software — operating systems, applications, libraries and components, firmware, and SaaS services.
• Accounts and identities — users, service accounts, privileged accounts, and machine identities.
• Data — repositories annotated with sensitivity classification and regulatory requirements.
• Network — segments, subnets, IP addresses, certificates, and exposed services and ports.

What attributes should an asset record contain?

The value of an inventory comes not from the list itself but from the context attached to each asset. A useful record usually includes:

• Asset identifier, type, location (on-premises / cloud / remote), and address (e.g., IP, MAC, hostname).
• Business owner or responsible department.
• Criticality level and sensitivity classification of the data it handles.
• Software state and version, patch level, and known vulnerabilities.
• Dependencies on other systems and links to third-party vendors.
• Authorization status — whether the asset is approved or unknown/unauthorized.

Asset discovery vs. inventory vs. CMDB: what is the difference?

These three terms are often confused, yet they describe different stages and scopes:

• Asset discovery — detecting assets (scanning, traffic listening, integrations), which supplies the raw data.
• Inventory — the organized, normalized, and enriched record built from that data after duplicates are removed and information is correlated; it also covers cloud, SaaS, and agentless assets.
• CMDB (Configuration Management Database) — a database focused on configuration items (CIs) and the relationships between them, used in IT service management (ITSM). It tends to be narrower and operations-oriented. A security inventory aims for full coverage, including assets a CMDB usually misses: shadow IT, vendor integrations, and cloud resources.

How is an inventory built and maintained?

No single source sees the whole environment, so several discovery methods are combined:

• Active scanning — querying hosts (network scanners, port probing) to identify devices and services.
• Passive listening — analyzing network traffic (flow telemetry, metadata) to detect assets without sending packets. It matters for OT/IoT devices that tolerate scanning poorly.
• Logs and authoritative sources — DHCP leases, DNS records, authentication logs, ARP tables, and NetFlow/IPFIX.
• Agents and agentless methods — endpoint agents (EDR) and MDM tools, plus API integrations with cloud, identity systems (IAM), and hypervisors for environments without agents.

Continuity matters most. An audit done once a quarter quickly stops being accurate. A good inventory runs without a break — it catches both new assets and the ones that disappear.

How does inventory relate to CIS Controls 1 and 2?

In the CIS Critical Security Controls, the first two controls are precisely about inventory and count as essential cyber hygiene (Implementation Group 1):

• CIS Control 1 — Inventory and Control of Enterprise Assets: actively manage (inventory, track, and correct) all hardware — end-user devices, network devices, IoT, and servers, on-premises and in the cloud. The point is full visibility plus detecting and blocking unauthorized devices.
• CIS Control 2 — Inventory and Control of Software Assets: actively manage all software (operating systems and applications) so that only authorized software runs and unauthorized software is found and removed.

These two controls are the foundation for everything else. You cannot manage vulnerabilities, harden configurations, or control access for assets you do not know exist.

Why does inventory matter for security and the attack surface?

The attack surface is the sum of all points through which an attacker could get inside. Every unknown or forgotten asset enlarges it — and does so invisibly to defenders. Many breaches come not from sophisticated techniques but from exactly these assets: forgotten, misconfigured, or simply unknown — an unpatched test server, an overlooked cloud instance, a device plugged in without approval.

An accurate record translates into security in several ways:

• Vulnerability management — you can only scan and patch what you know about; gaps in the inventory are gaps in coverage.
• Detection and response — during an incident, a SOC/NDR team works out faster which systems are affected and how they are interconnected.
• Detecting unauthorized assets — comparing what is observed against what is authorized reveals shadow IT and potential attacker footholds.
• Compliance — frameworks such as NIST CSF, ISO 27001, and sector regulations require a documented, current asset inventory.

Network telemetry (flow, metadata, DNS and DHCP logs) is especially valuable here, because it surfaces assets that no agent reports and keeps the inventory close to real time.

Learn more

• Software Bill of Materials (SBOM) — SBOM lists software components, helping inventory track what is installed and in use.
• Cloud Security Posture Management (CSPM) — CSPM depends on cloud asset inventory to find and assess exposed resources.
• BYOD (Bring Your Own Device) — BYOD expands inventory to personal devices that access company data and systems.
• SaaS Security Posture Management (SSPM) — SSPM uses SaaS inventory to monitor accounts, settings, and connected apps.
• API Security — API security relies on inventory of APIs to identify and protect exposed endpoints.