The IT inventory has a reputation as a dull spreadsheet filled in once a year for the admin department. In reality it is the only tool that answers the question “is my infrastructure under control?” Without it you manage IT on instinct, and sooner or later instinct fails.
What are you actually inventorying?
A complete IT inventory covers four layers:
Hardware
- desktops and laptops (model, year, serial number, user)
- servers, physical and virtual
- network devices: routers, switches, access points, firewalls
- peripherals: printers, scanners, UPS units
- company mobile devices (phones, tablets)
Software
- operating systems and their versions
- business software with licence expiry dates
- software installed by users themselves
- ERP and CRM systems, and industry-specific applications
Services and accounts
- cloud service accounts (Microsoft 365, Google Workspace and so on)
- SaaS subscriptions
- service and administrative accounts — who has access to what
- active accounts of former employees, which are often forgotten
Documentation
- network topology
- access credentials, securely stored
- configurations of critical devices
Why ageing hardware is more than just “a slow computer”
A device past End of Life (EOL) receives no security updates. To an attacker that is an open door: the vulnerabilities are public, the exploit is available, and the victim cannot patch the hole because the vendor has stopped issuing patches.
Example EOL dates for common systems
- Windows 10 — October 2025 (no further security fixes)
- Windows Server 2012 R2 — October 2023
- Exchange Server 2013 — April 2023
A company running a Windows 10 machine after October 2025, or an Exchange 2013 server, owns a device that cannot be secured, whatever else it puts in place.
An inventory lets you plan replacement in advance. Without one you replace hardware “because it broke” — always in a hurry, always for more money.
The risk in ageing software and licences
Software without active support is a legal and a technical risk at the same time.
Legal
GDPR and NIS2 require adequate technical measures to protect data. Running software that no longer receives security updates is hard to defend as an “adequate measure” during an incident and the inspection that follows.
Technical
withdrawn software does not integrate with newer systems, receives no compatibility fixes, and creates problems with new file formats and protocols.
Licensing
expired software licences are potential claims from vendors. An inventory shows what is active, what is expiring and when — instead of the surprise of a blocked login or a licence audit.
The dishonest employee, and settling accounts
It sounds like an edge case, but staff turnover is unavoidable in any company. Without an inventory:
- a laptop “disappears” when someone leaves and nobody is certain it ever existed
- a former employee’s ERP account stays active for months
- hardware licence keys go missing and nobody knows who had them
An inventory ties every device and account to a named person. The handover protocol when someone leaves becomes a formal, documented procedure rather than “a request to bring the laptop back at some point”.
How to run an inventory — the method
Frequency
- full inventory: once a year
- updates on every change (new hardware, new employee, someone leaving)
- licence review: quarterly
Tools
- for small companies up to 20 workstations, a well-designed spreadsheet is enough
- for mid-sized companies, dedicated ITAM (IT Asset Management) tools — Snipe-IT (open source), GLPI, or the modules built into RMM platforms
- automated network scanning: Lansweeper, Nmap, or the features built into Windows Server
Who owns it
- in companies without an IT department, the external partner should deliver the inventory as part of onboarding
- in companies with their own IT, a named person with a schedule and a procedure
What to do with the results
- list of EOL devices → replacement plan with dates and costs
- list of expiring licences → renewal planning
- list of accounts with no active user → immediate deactivation
With an inventory versus without — the concrete difference
Scenario
a ransomware attack, three servers encrypted.
Without an inventory
- nobody knows exactly what was encrypted
- nobody knows whether the backup covered all the critical systems
- restoring takes weeks, because first you have to reconstruct the knowledge of what existed at all
- the incident report to the regulator is guesswork, with no certainty about which data leaked
With an inventory
- you know immediately which systems went down
- you know which data lived on those systems, because it is mapped to the servers
- you verify the backup against the documentation: you know what you have and what is missing
- the report to the regulator is precise and truthful
An inventory does not prevent the attack. It means you come out of it faster and with smaller losses.
The inventory as the first step of onboarding
If you are starting with a new IT partner, the inventory should come first. Without one the partner works from assumptions and from whatever “looks about right” on the first visit.
A good IT partner delivers the inventory as a starting document, updates it on every change, and gives you access to the current state as the client. That is not bureaucracy — it is the precondition for looking after anything sensibly.
