Forgotten domains, campaign sites, test systems and cloud services persist because creation is easy and retirement is unclear. Attackers see the service, not the internal ownership boundary.
Discover from the outside in
Use DNS, certificates, IP relationships, cloud metadata and application fingerprints to identify candidates. Treat technical association as evidence requiring validation.
Resolve ownership quickly
Give teams a simple claim, reject or investigate workflow. Unowned does not mean irrelevant; it should trigger escalation to a risk owner with authority to remove or isolate.
Prevent recurrence
Automate registration, expiry reminders and external monitoring. Feed confirmed assets back into inventories, scanning coverage and service-management processes.
Practical next steps
- Review newly discovered assets every week.
- Quarantine high-risk unowned services where authority permits.
- Set expiry and owner metadata at creation.
- Measure time from discovery to ownership and treatment.
Continue the decision