According to an Orca Security study conducted in 2025 across 1,800 European and North American organisations, 73% of companies have significant IT assets missing from their official inventory. The figure has been repeated for years by different sources, and for years it has not come down. It is rising, because the speed of cloud, SaaS and IoT deployment structurally outpaces the speed at which reference baselines are updated.
The NIS2 Directive, in its Article 21.2.a, requires the entities concerned to implement "policies and procedures for the identification of relevant assets". DORA, in its Article 28, requires a register of information on ICT arrangements, including critical assets and dependencies. In both cases, compliance presupposes an inventory, and an inventory presupposes that you know what exists.
In this article, you will discover the three categories of assets that are systematically missing from inventories during first NIS2 audits, why traditional CMDB approaches fail to capture them, and which continuous inventory method addresses them.
The regulatory context: the inventory as a foundation, not a deliverable
The asset inventory is often treated as a preparation task: a deliverable to produce before the audit, then archive. This is a framing error, and it partly explains why most NIS2 inventories are incomplete as soon as they are produced.
NIS2 does not ask for an inventory document. It requires "policies and procedures" for identifying assets, meaning a continuous process, not a one-off snapshot. The difference is structural. An inventory produced in 2025 and not updated in 2026 does not prove your compliance in 2026: it proves that you were potentially compliant a year ago.
For entities subject to DORA, the requirement is even more explicit: the register of information must be kept up to date and available to supervisors. The European Banking Authority (EBA) has published standardised formats (EBA templates) that structure this register. The quality of its upkeep is one of the elements assessed during inspections, without any prior request being necessary.
Finally, the asset inventory is not only a requirement in its own right: it is the prerequisite for every other measure under Article 21. You cannot apply a patch management policy to an asset you do not know about. You cannot monitor a system whose existence you are unaware of. You cannot notify an incident affecting an asset that is absent from your declared scope.
First blind spot: SaaS subscribed outside IT
The proliferation of SaaS subscriptions is the most documented, and least controlled, source of shadow IT. It results from a structural change: the marginal cost of a SaaS subscription is low enough to be approved on an individual credit card or an operational service budget, without going through the IT department.
A marketing team subscribes to a customer data segmentation tool. A finance department deploys an Excel add-on connected to a third-party cloud service. An HR manager uses an interview management tool hosted in the United States. Individually, each use seems harmless. Collectively, they constitute processing of personal data, externally open access points, and operational dependencies that your IT department does not know about.
According to Gartner, a mid-sized organisation (500 to 2,000 employees) deploys on average 254 SaaS applications across its environments, of which 40 to 60% are used without explicit knowledge from IT. For NIS2, every SaaS application processing sensitive data or connected to your information systems constitutes a relevant asset within the meaning of Article 21.
The common mistake: limiting the inventory to licences managed by the purchasing department. Operational purchases slip under the radar, and free tools (freemium versions) appear nowhere. An audit of outbound DNS flows over 30 days systematically reveals connections to services that are not on record.
Second blind spot: cloud debt in development teams
Cloud environments have a property that on-premise infrastructure did not: they can be deployed in minutes, by anyone with access to a console. Development teams create AWS, Azure or GCP accounts for specific projects, tests and staging environments, and these environments outlive the project. "Forgotten instances" (virtual machines and serverless functions deployed and then forgotten) are a classic blind spot.
An audit conducted by a security team across 47 mid-sized European organisations in 2025 (Wiz Threat Research) identified an average of 23% of active cloud assets that were not recorded in the official inventory. These assets are not necessarily exposed, but they are not monitored, patched, or included in incident response plans. If compromised, they become invisible lateral movement pivots for your detection team.
The common mistake: assuming that your cloud provider's dashboard covers your inventory. It covers your inventory within that cloud provider, in that tenant, in that subscription. Developer access to personal tenants or test accounts not attached to the corporate tenant remains invisible.
Third blind spot: OT and IoT equipment connected to the IS
IT/OT convergence is a structural phenomenon in the industrial, healthcare and transport sectors, three of the 18 sectors covered by NIS2. Operational equipment (industrial controllers, building management systems, surveillance cameras, IoT sensors) is increasingly connected to information networks for supervision and remote maintenance.
This equipment has a characteristic that makes it particularly problematic for inventory: it has often been deployed by technical teams outside IT (maintenance teams, facilities management, business units), it runs on protocols that standard IT inventory tools do not detect, and its lifecycle is measured in decades, not years. It does not receive regular patches, does not always have centralised logs, and its firmware may be several generations old.
For NIS2, this equipment constitutes relevant assets as soon as it is connected to information systems. Article 21.2.h requires supply chain security, which includes connected OT equipment whose firmware is supplied and maintained by third parties.
How to assess the real extent of your scope
Discovering unknown assets is not done with traditional inventory methods, precisely because those methods rely on a declaration of what exists. Three complementary approaches capture what CMDBs miss.
Passive discovery through network flows. Analysing outbound DNS flows, connections established at your internet exit points, and internal north-south traffic reveals the destinations your systems connect to, including unrecorded SaaS services and orphaned cloud instances. This discovery is non-intrusive and does not disrupt operations.
Identity-based inventory. What exists can be inferred from what is used, and what is used leaves traces in your identity providers. An export of applications that received an OAuth token in your Azure AD or Okta tenant over the last 90 days lists all the services your employees have authenticated to. This is not an exhaustive inventory, but an inventory of live assets, which usefully complements a static CMDB.
Audit of operational spending. A review of professional payment card statements, cross-referenced with cloud service invoices by department, reveals subscriptions taken out outside IT. This approach is often perceived as intrusive, and it is, which is why it must be conducted within a defined framework, with the agreement of senior management.
Presidio includes an asset qualification module connected to your identity providers and network logs, which automates continuous discovery and produces a map of the real scope for the CISO and auditors. See Presidio features →
Conclusion
Three takeaways. An asset inventory is never "finished": it is a continuous process that the speed of cloud and SaaS deployment renders obsolete within weeks. Shadow IT is not a problem of user behaviour: it is the symptom of an IT procurement process that has not evolved at the same pace as the tools available. And an asset absent from your inventory is not a managed asset: it is an undeclared risk that your supervisory authority may identify before you do.
Organisations that approach their NIS2 audit with maturity start with a simple question: "What is the difference between the scope we declare and the real scope?" The honest answer to that question is the starting point of any serious compliance effort.
And in your context, do you have the visibility needed to answer that question accurately?
Also read: Non-human identities: the blind spot in your NIS2 and DORA audits and Third-party governance: the blind spots of supplier risk under NIS2 in 2026.