Discover how Lumen Technologies went from 17,000 to 1.1 million assets by rebuilding their exposure management program. A real-world case study on the importance of accurate asset inventory.
Most enterprises assume their asset inventory is close enough to accurate. The evidence suggests otherwise. According to a survey of over 600 security leaders in the 2026 Axonius Actionability Report, only 45% of organizations consolidate their asset and exposure data into a single view. And every downstream security program inherits whatever the inventory gets wrong.
It's a scary thought, right? You're making decisions about vulnerabilities, patching, and risk based on data that might be incomplete. But here's the real kicker: even if you think you're doing okay, you're probably not. The gap between what you know and what's actually out there can be massive.
Lumen Technologies, a global communications and IT services company, found this out the hard way. They started with 17,000 assets in their inventory. That number seemed reasonable. But when they dug deeper and rebuilt their exposure management program, they discovered a staggering 1.1 million assets. That's a 64x increase. Let that sink in for a second.
### The Inventory Trap
Why does this happen? Because most asset discovery tools only see what's easy to find. They miss the shadow IT, the forgotten servers, the cloud instances spun up for a test and never shut down. Lumen's journey shows that you can't manage what you can't see.
- **Shadow IT:** Devices and services employees set up without IT's knowledge.
- **Cloud sprawl:** Instances that multiply across AWS, Azure, and Google Cloud.
- **Legacy systems:** Old hardware or software still running but not tracked.
- **Third-party integrations:** APIs and tools that connect to your network but aren't in your inventory.
### How Lumen Did It
Lumen didn't just buy a new tool and hope for the best. They rebuilt their entire approach to exposure management. Here's what they focused on:
1. **Broad discovery:** They used multiple discovery methods, including network scanning, API integrations, and agent-based detection.
2. **Continuous monitoring:** Instead of quarterly checks, they moved to real-time asset tracking.
3. **Centralized view:** They consolidated data from all sources into a single dashboard.
4. **Automated tagging:** They used metadata to classify assets by risk, owner, and location.
The result? They went from 17,000 to 1.1 million assets. But more importantly, they gained visibility into their true attack surface. That's the real win.
> "The biggest risk is the one you don't know about. Once you see it, you can start protecting it." — Lumen's security team.
### What This Means for You
If you're a security professional, this should be a wake-up call. Your asset inventory is probably wrong. And that means your vulnerability management, patching, and compliance programs are built on shaky ground.
Here's a simple test: can you confidently list every device, server, and cloud instance on your network? If not, you're in the same boat Lumen was in. But the good news is, you can fix it.
#### Steps to Rebuild Your Asset Inventory
- **Audit your current tools:** What are you using for discovery? Is it giving you a full picture?
- **Add more sources:** Don't rely on just one method. Combine network scans, agent data, and cloud APIs.
- **Automate everything:** Manual inventory updates are error-prone. Use tools that update in real time.
- **Tag and classify:** Assign metadata to each asset so you know what's critical and what's not.
- **Review regularly:** Set up a monthly review to catch new assets and remove stale ones.
### The Bottom Line
Lumen's story isn't unique. Many companies have similar blind spots. But what sets them apart is that they took action. They didn't settle for a 17,000-asset inventory. They pushed until they found the truth.
And the truth is, your attack surface is probably bigger than you think. But that's okay. Once you know it, you can protect it. So start today. Audit your inventory. Look for what you're missing. And don't stop until you have a complete picture.
Because in cybersecurity, what you don't know can hurt you. And what you do know can save you.
