Continuous discovery

Discovery is not an annual exercise. The estate changes with every deployment, and the asset that appears on a Friday afternoon is the one somebody else will find first.

The sources, and what each is good for

DNS. Your zones tell you what you publish; passive DNS data reveals names that were never documented. Watch for records pointing at released cloud resources — a dangling record is a takeover waiting to happen.

Certificate transparency. Every publicly trusted certificate is logged. Searching the logs for your domains routinely surfaces hosts, environments and even whole projects that no inventory contains.

Cloud provider APIs. The only authoritative source for what is actually exposed: public addresses, load balancers, storage with public policies, functions with public URLs, managed databases with public endpoints. Enumerate every account — and find the accounts from billing.

Registrars, address allocations and acquisitions. Companies you bought bring domains, addresses and systems, usually with no owner and worse hygiene.

Your own build and deployment systems, which know about environments before DNS does.

Make it a pipeline

Scheduled collection, normalised into one store, differenced against the last run, with changes as the output. The daily question is not "what do we have?" but "what is new, and who created it?"

Scope carefully

Define what belongs to you before you scan it: domains, address ranges, cloud accounts. Enumerating infrastructure that turns out to be a supplier's — or a different company with a similar name — is an easy and embarrassing mistake, and in some jurisdictions a legal one.