You Can’t Protect a Computer You Forgot You Owned
Quick question: how many computers does your business own?
Not a ballpark. The actual number. Now add the laptops that went home during the shutdown and never came back. The old desktop in the storage room that still logs into the accounting software. The tablet by the front desk. The two phones you bought for the field techs. The printer that’s really a little computer with a hard drive in it.
If you had to guess on any of those, you just found the biggest hole in your security, and it didn’t cost a dime to find it.
The oldest rule in security still trips everyone up
You cannot protect something you don’t know exists. Every firewall, every antivirus, every backup plan assumes you know what you’re protecting. If a device isn’t on your list, it isn’t getting updates, it isn’t getting monitored, and when it gets hacked, nobody notices because nobody was watching it.
Attackers love the forgotten machine. It’s the one running an old version of Windows. It’s the one with a password that got set once in 2019 and never changed. It’s the one that’s still connected to your network with full access and zero eyes on it. They find it, they sit on it, and they use it as their front door.
What a forgotten device actually does to you
Picture the old desktop in the back room. Someone set it up years ago to run one piece of software. Everyone stopped using it, but nobody unplugged it, so it’s still on the network. It stopped getting security updates ages ago because the version of Windows it runs went end of life.
That machine is a wide-open window into your network. An attacker who gets in through a phishing email can hop to that desktop, and from there reach everything the desktop can reach. Your files. Your other computers. Your backups, if they’re connected. All because of a box nobody remembered to deal with.
Now multiply that by every device you can’t name off the top of your head.
It’s not just the obvious stuff
When people hear ‘asset inventory’ they think computers. The real list is longer:
- Laptops and desktops, including the ones at employees’ homes
- Phones and tablets that touch company email or files
- Network gear, the router, switches, and access points
- Printers and scanners, which store copies of everything that passes through them
- Security cameras and door controllers
- That one smart TV in the conference room that’s been on your Wi-Fi since you bought it
Anything with a network connection is a possible way in. If it’s not on your list, it’s not being managed, and if it’s not being managed, it’s a liability sitting quietly in the corner.
The accounts count too
Hardware is half of it. The other half is who can log into what. Every business accumulates accounts the same way it accumulates devices. The former employee whose email still works. The shared login three people use for the same system. The vendor you gave access to for one project two years ago who never got turned off.
An asset inventory worth anything includes a list of accounts and who owns them. When you line it up, you almost always find a few logins that should’ve been shut off a long time ago. Each one is a key that’s still cut and still works.
How to actually build the list
You don’t need fancy software to start. You need an afternoon and a willingness to walk around.
Step one: walk the building
Physically go room to room and write down every device with a plug and a network connection. Serial number, where it lives, who uses it, what it runs. Boring work. Incredibly useful.
Step two: check the network
Your router can show you a list of everything connected to it right now. That list almost always has a few surprises, a device you can’t identify, something that shouldn’t be there. Those surprises are the whole point.
Step three: list the accounts
Pull up your email system, your main software, your file storage, and write down every account and who it belongs to. Flag anything you can’t match to a current person.
Step four: keep it current
A list you build once and never touch is worthless in six months. The real value comes from updating it when you buy something, when someone leaves, and when a device gets retired. This is the part most businesses skip, and it’s the part that matters most.
Why this is the best money you’re not spending
Most security spending is about adding stuff. More tools, more licenses, more subscriptions. An asset inventory is the opposite. It’s about knowing what you already have so you stop paying to protect things that are gone and start protecting things you forgot.
Businesses find all kinds of savings in this exercise. Software licenses they’re paying for on machines that are dead. Subscriptions nobody uses. Devices they can safely retire. The list pays for itself before you spend a cent on new security.
More than that, it turns your IT from a guessing game into something you can actually reason about. When you know what you have, you can protect it, budget for it, and replace it on your schedule instead of in a panic after it fails.
If you can’t list every device and account in your business right now, you’re not alone, and you’re not in a hopeless spot. You just have a starting point.
We build and maintain these inventories for small businesses across South Florida, and we usually find a few surprises worth acting on. Want us to map out what you’ve actually got? Get in touch.