Asset discovery should find the repositories, packages, images and services your organisation actually has, including ones nobody registered. Ask vendors which sources they connect to, how often they refresh, how they handle things owned by no one, and what they cannot see, then compare the result with a list you already trust.
Definitions
An asset inventory is a list of what you own that could be attacked: code repositories, deployed services, container images, packages, and the accounts and keys that tie them together. Asset discovery builds that list automatically instead of relying on people to fill in a spreadsheet. Shadow assets are the ones missing from any official list.
Why a list matters first
You cannot scan what you do not know about, and many incidents trace back to a forgotten repository or service. The first 30 days of an application security program start with inventory for this reason.
Questions to ask
| Question | What it reveals |
|---|---|
| Which sources does it connect to: source hosts, registries, cloud accounts? | Where it can look |
| Does it need credentials, or work from metadata? | Access and risk |
| How often does it refresh? | How stale the list gets |
| Does it detect new repositories automatically? | Whether shadow assets are caught |
| Can it link a repository to its deployed service and owner? | Usefulness for response |
| What happens to archived or forked repositories? | Noise and risk |
| Can it show what it could not reach? | Honest gaps |
The last row is a good tell. A tool that reports 100 percent coverage has not looked at its own blind spots.
Ownership is half the value
An inventory with no owners is a list of problems with nobody to call. Ask whether ownership comes from existing data such as code ownership files, team metadata or commit history, and whether it can be corrected by hand. An unowned asset should be flagged as a finding in itself.
A reality check procedure
- Write down the repositories and services you are sure exist. Aim for twenty.
- Run discovery and check that all twenty appear.
- Look at what else it found and ask owners about five unfamiliar items.
- Count how many are archived, test or abandoned.
- Check that creating a new test repository appears within the promised refresh time.
- Ask for the list of sources it could not read and why.
If five items from step 3 turn out to be unknown to their supposed owners, you have just justified the tool.
Related inventories
Dependencies and browser extensions belong in the picture too. See browser extensions in your asset inventory for a less obvious category.
Quick check
Is asset discovery the same as attack surface management?
Not necessarily. Discovery of your code and package assets differs from scanning the internet for exposed hosts. Ask the vendor which one they mean.
How often should discovery run?
As often as new assets can appear and cause harm. Daily or continuous is common to ask for.
Safeguard offers asset discovery and SBOM and dependency scanning; try the free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
