18% of Your IT Assets Aren’t Under Management: The Attack Surface You’re Not Watching

You can’t patch what you can’t see. Yet many organizations make patching and vulnerability management decisions using incomplete asset inventories: leaving forgotten servers, unmanaged devices, and cloud services outside routine security controls.

A 2026 analysis from Arctic Wolf found that 18% of IT assets in its dataset were not covered by enterprise patch or configuration management. The same report found that 33% of assets were missing at least one critical security control. These are not findings that 33% of organizations reported a shadow IT visibility gap. They are asset-level results from vendor-platform telemetry, not universal estimates or a measurement of shadow IT.

That distinction matters. Arctic Wolf says its analysis uses aggregated, anonymized data from more than 800,000 assets in its Aurora Exposure Management platform. The publicly available report does not provide a full statistical-methods appendix or establish that the data represents all organizations. Treat the figures as a useful warning signal, not a prediction of your own environment. Read the report and its findings, and use discovery in your own environment to learn where your real gaps are.

THE FORGOTTEN SYSTEM IS STILL YOUR RESPONSIBILITY

The October 8, 2026, joint CISA advisory AA26-281A describes threat actors using automated scanning and hands-on techniques to target organizations. Its list of successfully exploited vulnerabilities includes flaws dating to 2015 and 2016, including vulnerabilities affecting ProFTPD, ISC BIND, and Apache Struts.

The advisory does not say that every affected system was unmanaged. But it reinforces an important operational lesson: old vulnerabilities remain relevant when exposed systems are not identified, monitored, and updated. CISA advises organizations to identify exposed services, apply patches, replace end-of-life products, and routinely assess internet-accessible assets.

A vulnerability report is only useful when it covers the systems you actually operate. If a forgotten server is missing from inventory, it may also be missing from scanning, patch management, endpoint security, and remediation workflows.

HOW ASSETS SLIP OUT OF VIEW

An asset inventory can fall behind even when IT teams are doing their best. Technology changes faster than annual reviews, and systems can be introduced or left in place by many different teams.

Common blind spots include:

• Shadow IT and unregistered SaaS: A business unit signs up for a new service without involving IT or security.
• Decommissioned servers that keep running: A migration is marked complete, but an old system remains powered on and reachable.
• Vendor-managed appliances: A supplier maintains a device, but no one internally verifies its exposure, owner, or patch status.
• Test systems promoted to production: A temporary environment becomes business-critical without going through normal security controls.
• Remote offices with local hardware: Branch equipment may not be visible to scans that only cover headquarters.
• Cloud sprawl: Accounts, subscriptions, and workloads multiply across providers without a single consolidated view.
• Inherited systems after a merger or acquisition: Networks and applications arrive before ownership and security responsibilities are fully mapped.

These are not all malicious or unauthorized systems. Many have legitimate business purposes. The risk arises when nobody can confirm what they are, who is accountable for them, and whether they receive the protection they need.

EXTERNAL VIEW AND INTERNAL INVENTORY: BOTH ARE NEEDED

External attack surface monitoring asks: What can someone see from the internet right now? It can help uncover public IP addresses, domains and subdomains, exposed services, cloud-hosted applications, and remote-access endpoints. It provides an outside-in perspective. Useful for finding exposures that may not appear in an internal asset list.

Internal asset inventory asks: What exists across our environment, whether it is publicly reachable or not? It helps identify endpoints, servers, network devices, cloud workloads, and other assets, then connect them to owners, locations, configurations, and security controls.

Neither view is complete on its own. External monitoring can reveal forgotten internet-facing systems, but it may not establish who owns them or what business purpose they serve. Internal tools can provide useful ownership and configuration information, but may miss systems that were never enrolled or recorded.

The UK National Cyber Security Centre’s EASM guidance describes external attack surface management as focused on internet-accessible assets and notes that a fuller picture may require internal monitoring or cloud-provider integrations. Meanwhile, CISA’s Internet Exposure Reduction Guidance recommends identifying internet-accessible systems, investigating unexpected exposure, and making routine assessments.

The goal is to reconcile the views: identify the asset, validate that it belongs to your organization, assign an owner, understand its exposure, and track the next action.

A PRACTICAL ASSET DISCOVERY CHECKLIST

Use these steps to build a more dependable picture of your environment:

1. Scan every network segment. Include all VLANs, subnets, data centers, and remote sites, not just the main office. Use approved scans and coordinate with system owners to minimize operational impact.
2. Connect to cloud-provider APIs. Review all providers, accounts, subscriptions, and regions. Look for workloads and services that do not appear in your central inventory.
3. Review identity and SSO integrations. Check SSO and SAML applications, identity-provider catalogs, and sign-in records. These can surface SaaS services in use but missing from IT’s registered application list.
4. Check DNS and certificate transparency records. Review known domains, DNS records, and certificate transparency logs for forgotten subdomains, old environments, and services that may still point to active infrastructure. Validate discoveries before taking action.
5. Assign an owner and disposition. For every newly discovered asset, record who is responsible, its business purpose, whether it should be internet-accessible, and which security controls apply. Remove unnecessary exposure or bring the asset into management.
6. Make discovery continuous. Repeat discovery as systems change, and use routine checks or automated monitoring to identify new assets. An annual inventory is a snapshot, not a dependable picture of a changing environment.

An open port or newly discovered domain does not automatically mean there is a vulnerability or compromise. Confirm ownership and business need, then decide whether to restrict access, patch, update configuration, or retire the system. As CISA emphasizes, unexpected internet exposure should be investigated, not ignored or treated as proof of an incident.

TURN DISCOVERY INTO REMEDIATION

Discovery is the starting point, not the finish line. A useful asset record should help your team answer practical questions:

• Is the asset in scope for patch and configuration management?
• Is it covered by vulnerability scanning and endpoint protection where appropriate?
• Is it exposed to the internet, and is that exposure necessary?
• Is its software supported and current?
• Who owns the system and coordinates remediation?

Cenova Cyber’s Vulnerability Management as a Service (VMaaS) combines asset discovery with internal and external scanning, risk-based prioritization, guided remediation, and validation. That means findings can move beyond a spreadsheet: teams can focus on what is most relevant to the business and verify when issues are resolved.

Request a free attack surface review. We’ll help you assess what is visible, identify potential inventory gaps, and discuss practical next steps for your environment. Contact Cenova Cyber to get started.