Closing Security Gaps by Identifying Unmanaged Devices

The scan finished just before noon, and the number on the screen was wrong. Security had asked for something simple: a count of every device responding on the corporate network, and discovery returned 1,418. The asset register said 1,120. Nobody in the room had been careless with their records; the register was simply older than the network it claimed to describe.

That difference of roughly three hundred machines is where the conversation gets uncomfortable. Some of them turned out to be duplicates and stale entries, which is a relief. The rest were real: contractor laptops, a few test servers spun up for a project that ended in spring, two printers in a regional office, and a small cluster of sensors installed by facilities without a word to IT. None were being patched, because no one knew they existed.

Most teams file this under housekeeping and promise to tidy up next quarter. That instinct is wrong. An unmanaged device is not a paperwork error with a cosmetic cost; it is an unmonitored entry point within the perimeter that reports to no one.

The Gap Between the Register and the Network

Asset records drift for ordinary reasons. Someone replaces a laptop, and the old serial stays open. A financial system tracks the purchase order but never hears about the decommissioning. Cloud instances appear on a developer’s card and vanish before anyone reconciles them. Each of these is small, and together they produce a register that is directionally right and operationally useless.

The consequence shows up in coverage math. If patch compliance reads 97 per cent, the real question is 97 per cent of what? A denominator built from a stale register flatters every metric that depends on it, and vulnerability dashboards inherit the same optimism. Cyber Kendra’s rundown of autonomous endpoint management makes the point from the operations side: a weekly scan can be obsolete before it finishes, so decisions drawn from it target the wrong population.

Where Unknown Devices Actually Come From

Shadow IT gets blamed first, and it deserves some of that, but the bigger sources are mundane. Acquisitions bring whole subnets inventoried under a different scheme. Remote work scattered endpoints across home networks, where they connect irregularly and miss every scheduled check. Hardware refreshes leave old units in drawers, still domain-joined, still holding credentials.

Then there is the category nobody owns. Conference room displays, badge controllers, warehouse scanners, and lab instruments running an embedded Windows build from a decade ago. These arrive through facilities or a line of business, get plugged into a port, and never enter a managed lifecycle. They are rarely the target, yet they make an excellent staging ground, because they go unexamined for years.

Inventory as a Security Control

The frameworks are blunt about priority here. CIS Critical Security Control asks organisations to actively inventory, track, and correct all enterprise assets, including non-computing and IoT devices, specifically so unauthorised and unmanaged assets can be removed or remediated. It sits first on the list for a reason, since nearly every other control assumes you know the asset exists.

The threat data lines up with that ordering. Verizon’s 2026 Data Breach Investigations Report found that 31 per cent of breaches now begin with the exploitation of software vulnerabilities, overtaking stolen credentials as the leading way in. A flaw on a device you track gets a patch window. The same flaw on a device you cannot see gets nothing, indefinitely.

Building a Discovery Habit That Holds

One-time cleanups feel productive and decay within a month, so the useful version is continuous. Pull from several angles and compare: network discovery, DHCP and DNS leases, agent check-ins, identity sign-in logs, enrollment records, switch port tables. Any device that shows up in one source and not the others is the finding, and that reconciliation is where good asset management software earns its cost by holding assignment, location and status in one place rather than four exports.

Give every record an owner and a last-seen date, because unowned assets are how the gap reopens. Then close the front door: procurement, onboarding and facilities installs all need to write into the same register, or new unknowns arrive faster than you retire old ones. Define what happens when discovery finds something unexpected, including who investigates and when a device is quarantined rather than researched.

None of this requires a transformation program. The first pass is a reconciliation that a competent team can run in a fortnight, and it tends to pay for itself quickly, since surplus licenses, leases on hardware that left the building, and duplicate support contracts usually surface alongside the security findings.

What changes afterwards is the quality of the questions you can answer. Asked how many machines are missing a critical patch, you give a number you trust. Asked whether an exploited model is in the estate, you answer the same day rather than the same week. Asked for audit evidence, you produce records instead of assembling them.

The three hundred unexplained devices from that Tuesday scan did not all turn out to be dangerous. A few were, and the team only found them because it stopped treating the register as a filing task and started treating it as the foundation on which every other control stands.