Asset Management.

Asset management is the foundation of every other security control: you cannot protect, patch, monitor, or respond to what you do not know exists. A modern asset inventory covers endpoints, servers, network devices, mobile, cloud workloads, SaaS tenants, identities, code repositories, and data stores, with ownership, criticality, and exposure attributes. Discovery is increasingly continuous and tool-driven through CMDB integrations, EDR data, cloud APIs, and EASM probes. Strong asset management feeds vulnerability management, configuration management, incident response, and zero-trust enforcement, and is a prerequisite for frameworks like the CIS Controls.

Its primacy is not academic: the CIS Critical Security Controls (v8) make "Inventory and Control of Enterprise Assets" and "of Software Assets" Controls 1 and 2 — the very first things an organisation should do — because unmanaged hosts are where intrusions hide. Log4Shell (CVE-2021-44228) drove the lesson home: teams that could not answer "where do we run Log4j?" spent days hunting while those with an accurate software inventory and SBOM scoped exposure in hours. Equifax's 2017 breach (CVE-2017-5638) likewise persisted partly because a vulnerable Apache Struts asset was not tracked to an owner who would patch it. The hardest gap is the "shadow" estate — forgotten cloud instances, expired-but-live subdomains, and SaaS signups outside IT — which external attack-surface management (EASM) tools surface by scanning from the attacker's vantage point.

flowchart LR
  A[Discovery sources] --> B[Normalize & dedupe]
  subgraph A[Discovery sources]
    A1[EDR / agents]
    A2[Cloud & SaaS APIs]
    A3[Network scans / EASM]
    A4[CMDB / DHCP / IdP]
  end
  B --> C[Single source of truth]
  C --> D[Enrich: owner, criticality, exposure]
  D --> E[Vulnerability mgmt]
  D --> F[Patch & config mgmt]
  D --> G[Incident response]
  E --> H{Reconcile gaps}
  H --> A

The goal is a continuously reconciled single source of truth: each cycle compares what each source sees, flags assets that appear in one system but not another (a classic sign of an unmanaged or rogue host), and assigns an owner before the asset can drift back into the dark.