Attack Surface and Attack Path Analysis
Unknown and Unowned Asset Discovery
We identify systems that are unowned, unpatched and unmonitored. We ensure each has an assigned owner and a decision.
What it is
An unowned asset is a system without a responsible party in the inventory or whose owner has left the organization. Examples include a server from a finished project, an old campaign site or a cloud account created for testing. These systems are not patched or monitored, so known vulnerabilities remain open for extended periods.
Scope
- Comparison of external and internal discovery results with inventory and CMDB records
- Identification of cloud accounts and subscriptions created outside central management
- Detection of systems linked to former employees or expired contracts
- Listing of operating systems and software that are out of vendor support
- Owner, purpose and recommended decision for each asset
The need
When organizations need it
- After a merger or acquisition when you inherit systems with unclear ownership.
- When a project or supplier contract ends and the remaining systems are unknown.
- When an audit requests the responsible parties for assets in your inventory.
Method
How we work
-
Comparison
We match discovered assets with your inventory, CMDB and cloud account lists.
-
Tracing
For each unmatched asset, we determine from records when it was created and for what purpose.
-
Risk
We assess whether the asset is internet-facing, still supported and what data it can access.
-
Decision
For each asset, we recommend retiring, transferring or securing it. We record the decision owner and due date.
Outcome
What you have at the end
Every unowned asset is assigned an owner and a decision. You receive the list of systems to retire and missing controls for those retained.
Frequently asked questions
Should we immediately shut down an unowned system?
Not always. Some old systems still support a business process. We first identify dependencies, then assess the impact of shutdown with you.
Is this a one-time exercise?
The initial exercise clears the backlog. It can be combined with continuous attack surface monitoring to detect new unowned assets early.
Attack Surface and Attack Path Analysis
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting