Asset Management as the Foundation of Vulnerability Management: Unknown Assets Cannot Be Protected
Asset management is presented as the true foundation of vulnerability management because organizations cannot protect assets they do not know exist. The article stresses that without accurate, up-to-date inventory data, vulnerability management produces only meaningless reports.
Data can be collected from multiple sources beyond vulnerability scanners: SIEM systems, NTA/NDR traffic analysis, Active Directory and CMDB, virtualization and orchestration platforms, cloud APIs, and manual input when automation is incomplete. Each source covers only part of the environment, so the central task is merging these fragments into one reliable picture while validating ownership and data accuracy.
A minimal asset record must include network address, MAC address, hostname, owner, department, and approval status. For vulnerability management three additional fields are essential: asset criticality that drives SLA requirements, a named responsible person or team for remediation, and the date of the last successful data collection. Without the last field, teams cannot distinguish between assets that have no vulnerabilities and assets the scanner has been unable to reach for months.
Why Categorization Matters
Assets are grouped by importance to focus limited resources on those involved in attack paths leading to unacceptable events. High-importance assets typically include perimeter web servers, network devices, VPN gateways, and critical business systems such as 1C:Accounting. Medium-importance assets provide indirect access, while low-importance assets do not lead to prohibited outcomes when compromised. Executive and chief accountant workstations are automatically treated as high importance because they often provide direct paths to key systems.
The guiding principle is to treat unknown assets as critical until proven otherwise. NIST CSF 2.0 and CIS Controls both recommend this conservative approach because the cost of an extra scan is far lower than the cost of a missed incident.
Regulatory Requirements
Russian regulations now explicitly require asset inventory. FSTEC Order No. 117 effective 1 March 2026 names inventory systems as a data source for configuration control. Monthly vulnerability detection and 24-hour remediation of critical issues become impossible when half the infrastructure remains unknown. Federal Law No. 58-FZ and Government Decree No. 1762 introduced industry-specific lists of critical information infrastructure objects, shifting categorization from self-defined analysis to comparison against official sector lists.
International standards impose similar obligations. CIS Controls v8.1 Control 1 requires accurate inventory of all corporate assets with semi-annual reviews and weekly reaction to unauthorized devices. NIST CSF 2.0 ID.AM-08 adds explicit lifecycle management, recognizing that decommissioning breaks asset data as severely as onboarding. ISO/IEC 27001:2022 A.5.9 and A.5.12 mandate inventories of information assets and their classification.
New Asset Types and Attack Surface Expansion
The asset landscape has changed dramatically. Forgotten cloud resources continue to incur costs and host real vulnerabilities for an average of 31 days before discovery. SaaS applications adopted by marketing, development, and HR teams often bypass IT registration yet contain corporate data. EU AI Act and ISO/IEC 42001 now require registers of AI systems, while NIST AI RMF pushes similar mapping requirements. Containers, Kubernetes clusters, IoT devices, and industrial control systems further expand the attack surface.
The article concludes that vulnerability management quality depends directly on the completeness, accuracy, and currency of asset data. Continuous reconciliation between CMDB, monitoring systems, and orchestration tools is necessary because no single source remains authoritative over time.
Related articles
Peter Levashov Accused of FBI Collaboration and Running XSS Honeypot Forum After Kelihos Sentence
Russian spammer and botnet operator Petr Levashov, known online as Petr Severa, was arrested in Barcelona in 2017 and later pleaded guilty to running the Storm, Waledac and Kelihos botnets. He received a lenient sentence of under three years despite prosecutors seeking 14.5 years, which experts attribute to possible cooperation with the FBI. After release, Levashov remained in the United States while remaining wanted in Russia. Forum users bratva and stallman on XSS.mx and Exploit.in have been linked to Levashov through stylistic analysis and shared references to the Telegram channel Dark News admin nicknamed golub. Stallman, identified as the final administrator of the RAMP4u forum, openly purchased access to U.S. critical infrastructure including power grids, water systems and hospitals while moderators allegedly suppressed competing posts. Observers including researcher Olga Kuprina suggest these accounts operated under agreements with U.S. authorities, allowing forums to function as intelligence-gathering platforms rather than purely criminal marketplaces.
Russian Cybersecurity Market Set to Hit 455 Billion Rubles by 2026 as Talent Shortage Persists
MWS Cloud forecasts that the Russian information security market will grow 20.8 percent to reach 455.4 billion rubles in 2026. The largest segment will be software at 216.5 billion rubles, followed by services at 167 billion and hardware at 71.9 billion rubles. Demand is increasingly driven by sophisticated attacks, regulatory requirements and fines rather than import substitution alone. BI.ZONE offers a more conservative estimate of 10-15 percent annual growth. Managed security services such as monitoring, incident response and vulnerability management are leading the services segment because few organizations can maintain 24/7 in-house teams. Director Artem Gribkov of Angara MTDR estimates the personnel deficit at approximately 40 percent, especially at middle and senior levels.
Russian Internet Users Report Growing Access Restrictions as Certificate Revocations Affect 39 Percent of Respondents
A recent telephone survey conducted by Russian Field between September 23 and 30, 2026, among 1,600 participants representative by gender, age, federal districts, and settlement types shows that 39 percent of Russian internet users have noticed restrictions or complications when trying to access websites. When sites fail to open due to certificate problems, 26 percent of respondents said they would simply stop visiting the resource. The findings, published by Kod.ru, also indicate that 57 percent of users are aware that Russian websites may not load in certain browsers because of revoked foreign certificates. In response to certificate errors, 55 percent would switch browsers, 22 percent would install the required certificates, and 21 percent would try accessing the site from a mobile device. Younger users are more inclined to use VPNs or proxies, while older respondents more often choose to abandon the site. Overall, 77 percent of those surveyed expect further changes to the Russian internet segment, with only 9 percent believing it will remain unchanged.
CISA and NSA Urge Shift to Memory-Safe Languages Like Rust to Eliminate Memory Vulnerabilities
Official reports from CISA, NSA, FBI and partners highlight that decades of safe coding practices and code analysis tools have failed to resolve memory safety issues in languages such as C and C++. Government documents cite statistics showing that 70-75% of exploited vulnerabilities and zero-days stem from memory errors, including data from Microsoft, Google Chromium, Mozilla and Project Zero. Google reports that Rust adoption in Android reduced memory-related vulnerabilities below 20% in 2025, with a 1000-fold lower vulnerability density compared to C++. The analysis details Rust's ownership, borrowing and move semantics that provide compile-time guarantees unavailable in C++, enabling stronger compiler optimizations. Reports also acknowledge migration challenges including learning curves, interop issues and ecosystem gaps, while noting ongoing C++ safety improvements targeted for C++26 and C++29. Major organizations including Microsoft, Amazon and Google are already committing to Rust for critical new code.