Winning At Attack Surface Management: A Buyer's Guide for Frustrated CISOs

3 Reasons You Can't Live Without Asset Intelligence

A Buyer's Guide for Frustrated CISOs

Asset Sprawl and Hidden Risks — Are You Prepared?

Connected devices are proliferating across your enterprise, and it's not just traditional IT assets like laptops and mobile phones. You're now confronted by a sprawl of specialized IoT, OT, and other connected devices — whether in hospital systems, retail stores, banks, manufacturing plants, or university campuses.

The challenge is that many of these devices can't have software installed, leaving them undetected by tools like EDR and MDM. This means you lack visibility into a significant portion of assets within your network — high-risk devices holding sensitive data, using default credentials, lacking proper security, and capable of halting operations if compromised.

As your asset attack surface expands, this buyer's guide will show you how to build comprehensive asset intelligence, empowering you to take action with confidence.

Highlights:

• Why traditional tools miss critical aspects of your attack surface
• The essentials of asset intelligence for proactive security
• Steps to leverage asset intelligence for real-world security actions

Asset Intelligence 101: Why You Should Care

Many enterprises still rely on spreadsheets or tools like a CMDB to track their asset inventory. However, the data in these manual operations are rarely up-to-date or accurate and often falls short when it comes to assessing security software coverage, patching vulnerabilities, or responding to incidents.

While IT and security tools may provide critical information, it's often fragmented. Even when you aggregate this data via API, major gaps remain — especially for IoT and OT devices that can't run endpoint agents or are fully owned by teams that don't communicate well with each other.

Asset intelligence is the glue that ties this fragmented data together. It starts with every CISO's goal: minimizing risk. It achieves this by first providing a consolidated view of all assets — IT, OT, and IoT. Then, it communicates this view to all stakeholders and solutions, offering actionable insights that create remediation workflows or even enforce policies in real time.

Reason 1: Security Gaps Transcend Individual Tools

Tracking your assets using tools like EDRs, MDMs, or vulnerability scanners is a good start. However, many devices — on average, 42% according to ORDR data — cannot install endpoint agents.

These tools often don't know what they're missing. If there are devices that should have an agent installed but don't, or if an agent isn't functioning properly, there's no way to detect these gaps.

Asset intelligence operates at a higher level than individual tools. It provides a comprehensive snapshot of all assets, enabling swift action — whether that involves installing or troubleshooting endpoint agents or creating segmentation policies to isolate devices that can't be protected by agent-based solutions.

ORDR AI Platform Data: on average, 42% of enterprise assets cannot install an agent.

Do you have the right insights to close security gaps? Must-have capabilities:

• Insights into agent health: It's one thing to install an agent, it's another to know whether it's working properly and communicating with the management console.
• Keep track of assets that can't install agents: A big chunk of any enterprise are assets that cannot enroll with your existing tools but need to be monitored.
• Asset profiling data for informed actions: Insights aren't useful if you can't take actions. Make sure you know the device owner, location, and other information so you can build workflows or enforce policies to close gaps.

Reason 2: Managing Risks Requires a Lot More Than CVE Scores

NIST's National Vulnerability Database recorded 29,065 new vulnerabilities in 2023 — averaging 2,400 each month. This volume creates a massive challenge for organizations managing tens to hundreds of thousands of devices. Tracking which devices have vulnerabilities is hard enough, let alone patching every single one. The problem is further complicated by assets like legacy medical devices, industrial systems, and banking machines that often have outdated, unpatchable software.

Asset intelligence provides an organization-wide view of your vulnerabilities with context. Instead of focusing solely on the severity of each CVE, it evaluates how each device — considering its function, the data it holds, and other factors — contributes to risk within the context of your organization.

Only by combining in-depth insights mapped to your specific risk tolerance can you begin to prioritize and take effective action, whether that's patching, real-time quarantining, or proactive segmentation.

The context you need for effective risk management:

• Comprehensive device profiling: Identify every device type, its function, and the software and vulnerabilities it carries to assess risk accurately.
• Actionable remediation data: Having information on device ownership and location enables you to streamline and expedite remediation efforts.
• Legacy and unsupported systems: Track all devices running obsolete or unsupported OSs to identify those requiring additional protective measures.

Reason 3: Lack of Blast Radius Insights Is Hindering Incident Response

A significant part of incident response involves analyzing compromised assets and understanding their relationships with their surroundings. This can be a time-consuming task, often taking upwards of 24 hours as teams scramble to gather and correlate data from various IT and security tools.

Because asset intelligence provides always up-to-date insights into all assets, incident response teams are better equipped to dive directly into action — whether that involves quarantining a device or updating policies.

Critical intelligence for containment, eradication, and recovery:

• User interaction mapping: Track every asset that each user interacts with to quickly identify affected assets when an identity is compromised.
• Detailed software and vulnerability data: Understand the software packages installed on each device and identify vulnerabilities that may have been exploited during the incident.
• Internal and external communication tracking: Monitor device communications to detect signs of lateral movement or interactions with phishing or malicious sites.

The Asset Intelligence Checklist

Here are three tips to help you obtain asset intelligence, so your team has ready-to-go insights to build and automate workflows, detect and respond to threats, or even create microsegmentation policies to reduce risk on high risk, highly vulnerable assets.

1. Develop primary sources for asset insights — Don't rely solely on existing tools like EDRs or MDMs. Many assets can't be enrolled in these solutions or install endpoint agents. Real-time monitoring of agentless devices is crucial for mitigating organizational risk.
2. Ensure precise device identification — Gain clear asset profiling and classification for each device, including its type, function, ownership, and location. Vulnerability scanners often only provide IP and MAC addresses on agentless devices. You need in-depth insights to effectively assess risk, create remediation workflows, and enforce policies.
3. Incorporate business context — Understand which device profiles, data, and behaviors have the most impact on your organization. Use this context to map each asset's risk profile and prioritize patching or protection measures.