IT asset inventory

An IT asset inventory is the up-to-date list of what a company owns and exposes: workstations, servers, network gear, cloud accounts, applications, software versions and internet-facing addresses. Nothing gets patched, monitored or backed up unless it is known first. December 2021: the Log4Shell flaw (CVE-2021-44228) hit a Java library embedded in a huge number of products. In the days that followed, many teams could not say where it ran in their own estate. The standard cyber application asks whether an inventory exists, whether it is automated, whether it covers hardware, software and exposed assets, and how often it is reconciled with reality. The underwriter checks the answer against an external attack surface scan: a forgotten subdomain, an old remote access appliance or an indexed test server reveal what the inventory misses. Every asset the scan finds that the application left out opens a follow-up question. The usual gaps are well known: shadow IT, recently acquired subsidiaries, cloud accounts opened on a department credit card. The link to the policy runs through patch management. An unpatched vulnerability exclusion, where the policy carries one, assumes the insured knows which systems were affected and since when. On the software side, the software bill of materials (SBOM) extends the inventory down to a product's components. A practitioner's caveat: a complete inventory does not exist in a company with several thousand endpoints. The underwriter judges the gap between the list and the scan, and how fast the company closes it.