The Breach Nobody Saw Coming — Because Nobody Knew the Device Existed

In 2021, a water treatment facility in Oldsmar, Florida made international headlines when an attacker remotely accessed its systems and attempted to poison the water supply. One of the contributing factors investigators flagged? Outdated, poorly tracked software running on machines that had fallen off the IT team’s radar. Nobody had catalogued them. Nobody was monitoring them. And that’s exactly how attackers got in.

You don’t need to run a water plant to face this kind of risk. If you’re a small business owner, office manager, or IT administrator, there’s a good chance right now that somewhere on your network there’s a device, account, or piece of software that nobody is actively managing. That’s not carelessness — it’s just what happens when organisations grow without a solid IT asset management strategy in place.

The hard truth: you cannot secure what you don’t know you have.

What Is IT Asset Management — And Why It’s a Security Issue

IT asset management (ITAM) is the process of tracking and maintaining information about every technology asset your organisation owns or uses. That includes hardware like laptops, servers, printers, and routers, as well as software licences, cloud subscriptions, and user accounts.

Most people think of ITAM as a budgeting or procurement concern — making sure you’re not paying for software nobody uses, or that you’re replacing aging hardware on time. And yes, it does that. But from a cybersecurity standpoint, ITAM is foundational. Every untracked asset is a potential blind spot. Every blind spot is an open door.

What Counts as an IT Asset?

• Endpoints: Laptops, desktops, tablets, smartphones — including personal devices used for work (BYOD)
• Network devices: Routers, switches, firewalls, wireless access points, IP cameras
• Servers: On-premise servers and virtual machines
• Cloud resources: SaaS subscriptions, cloud storage accounts, hosted services
• Software: Installed applications, browser extensions, plugins
• User accounts: Active employee accounts, service accounts, third-party vendor access

If it connects to your network, stores your data, or processes business information — it’s an asset that needs to be tracked.

The Hidden Dangers of Poor IT Asset Management

Shadow IT: The Threat You Invited Without Knowing

Shadow IT refers to tools, apps, and devices that employees use for work without formal IT approval. It’s rarely malicious — someone signs up for a free project management tool, connects a personal tablet to the office Wi-Fi, or installs a browser extension to speed up their workflow. Harmless enough on the surface.

But here’s the problem: those unsanctioned tools often don’t meet your security standards. They may not receive updates, may store company data outside approved systems, and your IT team has zero visibility into them. According to Gartner, shadow IT can account for 30 to 40 percent of IT spending in large enterprises — and in small businesses where oversight is lighter, the percentage is likely higher.

Unpatched and Forgotten Devices

An asset you don’t know about is an asset you’ll never patch. Attackers actively scan for outdated, unpatched systems using tools like Shodan — a search engine that indexes internet-connected devices. If your old network-attached storage (NAS) device hasn’t had a firmware update in three years because nobody remembered it existed, it’s potentially visible to anyone looking for an easy target.

Orphaned Accounts Are an Open Invitation

When an employee leaves and their account isn’t deprovisioned, that’s an orphaned account. If a former contractor’s login credentials are still active in your CRM, cloud storage, or email system, anyone who obtains those credentials — through phishing, credential stuffing, or a data breach — can walk right in. This is one of the most common and most preventable causes of unauthorised access.

How to Build a Practical IT Asset Management Strategy

You don’t need a massive budget or an enterprise-grade platform to get started. What you need is a process, consistency, and the right tools for your size.

Step 1: Conduct a Full Asset Inventory Audit

Start by discovering everything currently on your network. Use a network scanning tool to identify connected devices — most small businesses can get started with free or low-cost options like Advanced IP Scanner (Windows), Angry IP Scanner (cross-platform), or the built-in features in tools like Spiceworks or Lansweeper.

For software, check installed applications on each machine and cross-reference against your approved software list. Don’t forget cloud services — pull a report from your company credit card statements and ask department heads to list every subscription they’re using.

Step 2: Create and Maintain a Living Asset Register

Once you’ve discovered your assets, document them. A spreadsheet works for very small teams, but purpose-built tools scale better. Your asset register should capture:

• Device name, type, and model
• Operating system and version
• Assigned user or department
• Purchase date and warranty status
• Last patch or update date
• Physical location (office, remote, offsite)
• Network access level

The key word is living. This document is useless if it’s accurate once and never touched again. Build a process — quarterly reviews at minimum — to keep it current.

Step 3: Classify Assets by Risk and Sensitivity

Not all assets carry the same weight. A guest Wi-Fi router is lower risk than the server storing your customer payment data. Classify your assets so you know where to focus your security resources. A simple three-tier model works well:

• Critical: Assets that store or process sensitive data, or whose failure would halt operations
• Important: Assets that support business functions but aren’t directly handling sensitive data
• Standard: General-use devices and low-risk tools

Step 4: Automate Where You Can

Manual tracking is better than nothing, but automation dramatically reduces the chance of assets slipping through the cracks. Consider tools that offer automatic discovery and alerting when new devices join the network. Microsoft Intune, Jamf (for Apple-heavy environments), and open-source options like OCS Inventory can automate much of the tracking workload. Most modern endpoint detection and response (EDR) platforms also include asset visibility features.

Step 5: Integrate Asset Management With Your Offboarding Process

Create a formal offboarding checklist that includes IT tasks: collect the device, revoke all system access, deactivate accounts, and remove the employee from your asset register as an assigned user. This single step eliminates the orphaned account problem and ensures devices are either returned, wiped, and reassigned, or properly retired.

IT Asset Management Tools Worth Knowing

• Spiceworks Inventory — Free, small-business friendly, includes network scanning
• Lansweeper — Powerful discovery and reporting, free tier available
• Snipe-IT — Open-source asset management, self-hosted option
• Microsoft Intune — Strong for Microsoft 365 environments, mobile device management included
• Jamf Now — Ideal for businesses running Apple devices

Choose based on your environment size and existing tech stack. The best tool is the one your team will actually use consistently.

IT Asset Management Is the Foundation of Cybersecurity

Every security framework worth following — from the NIST Cybersecurity Framework to the CIS Controls — lists asset inventory as a top priority. It’s not an advanced technique. It’s the baseline. You can invest in the best firewall, the most sophisticated endpoint protection, and the strongest password policy — but if there’s a forgotten device sitting on your network running outdated firmware, all of that is undermined.

Effective IT asset management gives you visibility. Visibility gives you control. And control is what security is built on.

Start with a simple network scan this week. Build your asset list. Review it quarterly. Integrate it into your hiring and offboarding workflows. These are not complicated steps — but they close the gaps that attackers count on staying open.

If you’d like help building an asset management process tailored to your small business, Techbytes has practical guides, tool recommendations, and step-by-step templates to get you started. Don’t wait for an incident to find out what you were missing.