You find unscanned assets by comparing independent inventories against the scanner's list and investigating every difference. Source control, registries, cloud accounts and build systems each know about assets the scanner does not. The gap list is your to do list.
Why scanners miss things
A scanner sees what it is pointed at. Repositories added after the integration was set up, images pushed from a developer laptop, projects in a cloud account that joined through an acquisition, and services behind a different login can all fall outside it. Nobody decided to skip them. They were simply never added.
Step by step
- List the sources. Pick at least three: source control, container or package registries, and cloud accounts. Add build systems if you have them.
- Export identifiers. Use stable keys such as repository URL, image name with registry, or cloud account ID. Avoid display names, which change.
- Normalise. Lowercase hostnames, strip trailing slashes and tags where the tag is not part of identity, and map forks to their parent when you want one row per codebase.
- Diff against the scanner. Produce three lists: in both, in sources but not in the scanner, in the scanner but not in sources.
- Triage the gaps. For each item decide: onboard, exclude with reason, or investigate.
- Record the owner. An asset without an owner is unlikely to be onboarded.
Read the third list too
Items in the scanner but not in any source are also informative. They may be deleted assets the scanner still counts, which inflates coverage and finding counts, or sources you forgot to include.
Common finds
- Repositories created by personal accounts inside a company organisation.
- Old images still running in a cluster, built long ago and never rescanned.
- Test or demo projects that quietly became production.
- Mobile or browser extension packages published to stores by a team that never joined the central process.
Keep the loop going
Run the diff on a schedule. A one time clean up decays. Put the gap count on the dashboard as its own number with a trend, and include the date of the last comparison. If the number rises after a reorganisation or an acquisition, that is the signal the process is working, because the gaps are now visible.
What counts as done
Done does not mean zero gaps. It means every gap has an owner, a decision and a date. Reviewing that table each month is a small cost compared with an unnoticed exposure.
Safeguard does this kind of counting in one place: SBOM and dependency scanning, asset discovery and reachability analysis feed the same inventory, so each number can be traced back to its source. Asset discovery is a GA capability, and it can feed the inventory that scans and reachability analysis then use. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Where should I start if I have no inventory?
Start with source control and the container registry. They are easy to export and usually hold most of the code and images.
Do I need agents on every machine?
Not for this exercise. The method here compares existing lists. Agents are a separate decision.
Last reviewed: 19 October 2026.
