Ask most IT managers exactly how many servers, devices and cloud services their business runs, and you’ll usually get an estimate rather than an answer delivered with any real confidence. That gap between estimate and reality is where a surprising number of breaches originate, not through some sophisticated attack on a system everyone knew about and had already hardened, but through a forgotten server nobody remembered was still switched on, quietly accumulating risk in the background.
The Assets Nobody Put on the List
Businesses grow in fits and starts, and their technology estate grows the same messy way alongside them. A department spins up its own cloud trial without telling anyone in IT. A developer leaves a test server running after a project wraps up and moves on to the next thing. An old marketing microsite from three years ago is still live because nobody ever got round to decommissioning it properly. Individually these look trivial, barely worth a second thought. Collectively, they form a shadow estate of unmanaged, unpatched, unmonitored systems that sit quietly outside whatever security programme the business believes it has firmly in place. Mergers and acquisitions make the problem considerably worse, folding in whole new estates of infrastructure that nobody on the current team has ever properly documented.
Regular vulnerability scan services against your known and suspected infrastructure is one of the few reliable ways to surface exactly what’s out there, including the systems your own records have already quietly forgotten ever existed.
Why Discovery Has to Come Before Defence
You cannot patch a server you don’t know exists, however good your patching process might be on paper. You cannot lock down a database that isn’t on anyone’s spreadsheet or asset register. Security teams spend enormous energy hardening the systems they’re aware of while entirely overlooking the ones they aren’t, simply because those systems were never on the list to begin with and nobody thought to ask whether the list was complete. A proper asset discovery exercise turns up old subdomains, forgotten cloud instances, and devices still quietly connected to the network years after their intended purpose ended and everyone moved on. Spreadsheets and informal knowledge passed between colleagues are no substitute for a genuine, repeatable process of finding what’s actually there.
William Fieldhouse has built entire engagements around exactly this blind spot.
“We once found a live server for a project that had been cancelled two years earlier, still holding a full copy of customer data and still reachable from the internet, and the client genuinely had no idea it existed anywhere in their estate.”
— William Fieldhouse, Director of Aardwolf Security Ltd
Stories like that aren’t rare exceptions, they’re a pattern that shows up in almost every discovery exercise we run for a new client. Businesses are generally very good at protecting what’s in front of them and remarkably poor at remembering what they built five years ago and quietly stopped thinking about once the project ended. The fix isn’t complicated, but it does require someone to actually go looking with fresh eyes and no assumptions about what should or shouldn’t still be there.
Find It Before Someone Else Does
Getting a clear, independent map of everything your business actually owns is the natural first step, and it’s worth putting that question directly to a best pen testing company rather than assuming your internal records already tell the full and complete story.
About the Author
