What an inventory should record

  • Identity: hostname, IP address, domain and the organisation or supplier it belongs to.
  • Exposure: open ports, running services, software versions and login pages.
  • Hosting: cloud provider, data centre and country.
  • Ownership: the team or person responsible for fixing issues.
  • Risk: known vulnerabilities, certificate status and recent changes.

Why internal lists are not enough

Internal registers, CMDBs and spreadsheets only contain what someone remembered to add. They miss agency-built sites, assets from acquired companies, services launched by developers in their own cloud accounts, and old systems nobody switched off. An inventory built from the outside in, by discovering what is actually reachable, shows the gap between what you think you expose and what you really expose.

How to build and maintain one

  1. Start from known seeds: company names, primary domains and IP ranges.
  2. Expand through DNS, certificate transparency, WHOIS and reverse DNS data.
  3. Confirm attribution so third-party assets are not mistaken for your own.
  4. Assign owners and record purpose for each asset.
  5. Re-run discovery continuously and alert on changes, because the inventory goes stale within weeks.

How DarkInvader helps

DarkInvader builds your internet-facing asset inventory automatically from a company name and domain, maps how assets connect and where they are hosted, and keeps the inventory current with daily monitoring.

Explore Asset Discovery

Frequently asked questions

How is an internet-facing asset inventory different from a CMDB?

A CMDB is built from the inside and records what IT manages. An internet-facing asset inventory is built from the outside and records what is actually reachable, including assets no internal system knows about.

How often should the inventory be updated?

Continuously. New subdomains, cloud services and open ports appear every week, so an inventory refreshed once a year quickly misses real exposure.

Does Cyber Essentials require an asset inventory?

Cyber Essentials requires you to define the scope of internet-facing devices and services being assessed, which is difficult to do accurately without an up-to-date inventory of what you expose.

Related terms and reading

Sources