What the Inventory Doesn't Show: Unknown Assets and the Access Broker Market

Every organization actually operates with two distinct exposure surfaces. The first is the one recorded in the CMDB (the configuration database) and the asset inventory, and known to the security team. The second is the one that actually exists — the subdomain from an old marketing campaign nobody decommissioned, the storage bucket a development team spun up for a test, the VPN concentrator from a subsidiary acquired years ago, an employee's laptop configuring the network, an agentic AI tool with excessive permissions.

The gap between these two worlds, between these two surfaces, is what we understand as the unknown asset. This is not a documentation-hygiene issue; increasingly, it is the exact point where an incident begins.

The label "unknown asset" covers several quite different realities, and it's worth telling them apart because each calls for a different response:

• Orphaned assets. They exist in the inventory but have no assigned owner. Nobody patches them, nobody decides to decommission them, nobody responds when a problem arises.
• Shadow IT. Third-party SaaS services, cloud environments, and applications procured outside the organization's purchasing and security-vetting process.
• Legacy assets. Systems brought in through mergers, acquisitions, or subsidiary integrations, arriving with their own technical debt and no documented handover.
• Forgotten perimeter exposure. Domains, subdomains, certificates, admin panels, and internet-facing appliances that outlived the project that justified them.
• Shadow AI. The newest and fastest-growing variant. AI tools and agents adopted without oversight from either IT or security.
• Third-party assets. Devices and access belonging to vendors, contractors, and external personnel operating inside the perimeter without being managed by it.

The common denominator is the absence of an owner accountable for the asset's entire lifecycle, from provisioning to effective decommissioning.

The available data points consistently in the same direction.

Arctic Wolf's attack surface report, built on aggregated data from more than 800,000 assets, puts at 33% the share of IT assets missing at least one critical control. 18% fall outside patch or configuration management, 10% lack security coverage, and 17% are effectively invisible to traditional vulnerability management tools. Nearly one in five assets has reached end of life and will never receive another vendor update. The report's most telling finding is organizational in nature: in a migration specifically meant to retire obsolete systems, business units confirmed completion, but a subsequent scan found that 8% of the assets were still end-of-life.

Verizon's 2026 DBIR, which analyzes more than 22,000 confirmed breaches across 145 countries, shows a shift in the trend. For the first time in the report's nineteen-year history, vulnerability exploitation has overtaken credential theft as the leading initial access vector, at 31% versus 20% the previous year. Edge devices — the hardware components that serve as an entry point to a network — and VPNs went from accounting for 3% to 22% of exploitation-related breaches, a sevenfold increase in a single year, and only 26% of vulnerabilities in CISA's KEV catalog were fully remediated, down from 38% the year before.

The report also documents the continued presence of ProxyShell and ProxyLogon vulnerabilities two and three years after disclosure, respectively. When a system remains vulnerable three years after a patch exists, the problem is no longer about patch management — it is about unknown assets that continue operating outside the inventory.

The criminal ecosystem has long operated on a logic of industrial specialization. Initial Access Brokers (IABs) don't deploy ransomware or negotiate ransoms; they focus exclusively on breaching corporate networks and reselling that access to whoever will. ENISA lays this out clearly in its Threat Landscape 2025. The combination of ransomware-as-a-service models, leaked builders, and access broker services has drastically lowered barriers to entry and fueled a professionalized, resilient criminal ecosystem.

What's interesting here is what's actually being sold. The DBIR's analysis of IAB listings found that, among the connection types identified, 44% corresponded to VPNs and 35% to some form of remote desktop application — precisely the kind of perimeter assets organizations tend to lose track of.

Pricing points to a relatively mature and segmented market. Rapid7's report on access brokers put the average sale price at just over $2,700, with nearly 40% of listings falling in the $500–$1,000 range and 71% including some level of privilege. Its follow-up update on the second half of 2025 documents a shift toward high-value targets, with a much higher average base price on the forums that emerged after the fall of BreachForums and the arrest of the XSS forum administrator. ZeroFox also notes that low-end access pricing has dropped below $500, a sign of oversupply at that tier.

The underlying takeaway is uncomfortable. Generic access has become cheap to the point of economic irrelevance, while privileged access to specific organizations has become more expensive. In other words, the market has learned to tell the quality of compromised assets apart. And that valuation is being made by a third party who, in practice, has inventoried the organization's surface better than the organization itself.

There's a category of unknown asset that rarely shows up in cybersecurity reports because, administratively, it doesn't belong to IT: electronic security infrastructure — cameras, access controllers, video intercoms, building management systems. These are connected devices, often exposed, with persistent default credentials, unpatched firmware, and a ten-to-fifteen-year lifecycle that far outlasts vendor support. Their management usually falls to facilities staff or physical security, not the CISO.

Unit 42's 2026 global incident response report sums it up well: protecting an organization today means looking beyond the corporate laptop, toward contractors' unmanaged devices and exposed cloud assets. This is, in essence, a hybrid security approach. An asset inventory that doesn't include the electronic security estate is incomplete by design.

There's no off-the-shelf product solution for a problem that is, at its root, a governance issue. But there is a reasonable order of priorities.

Continuous discovery, not periodic. External attack surface management and cyber asset tools work from the outside in, independent of the declared inventory. It's the only way to find what you don't know exists. Annual scanning cadences make little sense in environments where a cloud instance can live for thirty minutes.

Ownership before technology. Discovering an asset without assigning it an owner with decision-making authority over its decommissioning only creates a longer-term problem.

Verified decommissioning. The earlier data point about "completed" migrations that weren't shows that decommissioning must be technically validated, not simply accepted on the business unit's word.

Identity and context as the effective perimeter. When an asset can't be managed directly (a vendor device, a legacy system, etc.), control has to shift to access itself: phishing-resistant multi-factor authentication, short-lived sessions, segmentation, and least privilege. This substantially raises the barrier to entry.

Intelligence on the access market. Monitoring the forums, channels, and marketplaces where corporate access is traded makes it possible to detect exposure before ransomware materializes. If a broker is pricing access to your organization, that information exists before the encryption does.

It's also worth remembering that these have stopped being merely good practice. The NIS2 directive requires essential and important entities to implement risk analysis and management measures that presuppose an up-to-date asset inventory as demonstrable groundwork for an inspection.

The unknown asset embodies a structural asymmetry: the attacker only needs to find one, and has both automation and a market that rewards the discovery on their side. The defender needs to know all of them, while operating with finite budgets and organizational structures that fragment responsibility across IT, physical security, procurement, and business units.

Closing that asymmetry entirely is unlikely. Narrowing it is entirely achievable, and it starts with accepting an uncomfortable premise: it is very likely that, right now, there is an organizational asset that someone is pricing on a forum. The question isn't really whether that blind spot exists, but how long it will take the organization to find out.