Oct 17, 2026, 5:33 PMRE: https://infosec.exchange/@TindrasGrove/117456758033860715
I beg to differ: I have promoted someone for finishing an asset inventory. That’s the single most useful baseline for security governance there is. It’s foundational and its absence makes multiple other things impossible.
@Tarah I was in charge of asset inventory at a bank. We found hundreds of examples of security, financial, and fraud risk. Financials for a user hardware refresh project rested on (never verified itrw) estimates of residual value of swapped equipment.
When the project executive got my final report on the total number and type of equipment returned and ran it against valuation numbers she nearly lost her mind.
The real total residual value was close to 30% lower than expected. People had “disappeared” equipment over many years, and there was no way to trace the perps. Many people refused the new equipment because the essential function of their job was only possible with specialized legacy software. So techs dropped off the new stuff to meet project completion goals and left the old stuff with a promise to come back. In one case, an entire office was found to be shuttered and empty from a previous move that had never been logged centrally. And the air gapped goodies, project leftovers, and missing servers…😱
Verified asset data doesn’t matter til it does.
One of the joys with seeing our early VMware server product get used in serious corporate environments were the IT staff telling me (sometimes too much) about using it for Netware server consolidation/replacement, back around 2001/2002. They would start these projects and then be finding small Netware servers in closets all over the company. Some running, some powered off. Many spun up by small teams (to bypass corp IT?) and missed from assets inventory. Happened the same at several places, these were government regulated serious orgs. Their IT execs were surprised AF. This is serious shit worth trying to get right.
Oct 18, 2026, 6:19 AM@Tarah Absolutely 100% correct. Not for nothing are asset and software inventories the CIS critical security controls #1 and #2.
Oct 22, 2026, 5:54 PM@Tarah people get promoted?!?