Discovery, and the inventory that is always wrong

Every infrastructure assessment starts with the same finding: the network contains things nobody listed.

Use several sources

No single source is complete, and each is incomplete differently:

• The asset inventory, which reflects what people remembered to record.
• Address allocations and DHCP, which show what was assigned, not what is live.
• DNS, including internal zones, which holds names for things long gone and things never documented.
• Cloud provider APIs, authoritative for the accounts you know about — so start from billing, which knows about all of them.
• Directory and endpoint management, which knows about managed machines and says nothing about the unmanaged ones.
• Active probing, which finds what is live and misses what is off today.

Compare them. Hosts appearing in only one source are the interesting ones: the unmanaged device, the forgotten virtual machine, the system whose owner left.

Enumerate carefully

For each live host: what is listening, what software and version, how is it authenticated, and who owns it. Treat version banners as hints — services misreport, and backported patches make versions misleading on long-term-support distributions. Verify before reporting.

Look here first

Management interfaces exposed beyond their intended network — hypervisors, out-of-band management, printers, building systems, databases. Default or shared credentials, which remain the most reliable way into an internal network. Legacy protocols still enabled. Forgotten environments: staging with production data, a test domain the real one trusts.

The output

Not a port list. A list of owned things, each with a purpose and a person — plus the list with no owner, which is where the next incident starts.