No Reliable Asset Inventory During Incident Response

At the start of an incident, no single source can quickly answer basic questions: what assets exist, where they are, what they do, who owns them, and how they depend on each other.

Available lists are partial, outdated, or contradictory. Each reflects its own angle — billing, directory, agents, network, virtual machines, or backups. None provides an operable view of the environment.

Without a reference population, there is no way to demonstrate that all exposed systems were examined, isolated, or restored. A forgotten asset may retain persistence, stolen credentials, or a path into the rest of the network.

A poor inventory also slows down decisions. The team ends up discovering, in real time, whether an address belongs to a critical server, whether an old machine is still in use, or whether shutting down a service will affect another business unit.

Containment becomes an impression rather than a demonstrable state.

• Request an up-to-date list of assets, their function, owner, and criticality, then spot-check a sample against reality.
• Compare multiple sources: directory, DHCP, DNS, network, hypervisors, endpoint management, EDR, backups, and procurement records.
• Flag assets with no owner, no known function, no last-seen date, or unresolved duplicates.
• Time the response to a simple question: “What systems could communicate with this asset today?”
• Check whether the inventory remains accessible when core systems are unavailable.

• Designate a primary source and reconciliation sources rather than chasing a mythically perfect database.
• Automate discovery and reconciliation; route discrepancies to an owner.
• Track at minimum: asset identity, function, owner, criticality, logical location, and key dependencies.
• Fold inventory updates into procurement, deployment, change, and decommissioning processes.
• Maintain a minimal out-of-band copy, protected and recent enough to be usable during a major outage.

• Build a crisis inventory by merging available sources; don’t wait to find the “right” list.
• Mark each asset as confirmed, probable, unknown, or decommissioned, with source and last-observed time.
• Prioritize privileged, exposed, critical assets and those not covered by security tooling.
• Assign an owner to unknowns and document areas that cannot be validated.
• Do not declare eradication or full containment complete while unexplained assets can still reach the environment.