How do you detect production systems that no asset inventory or account list knows about?

This is the coverage problem in its hardest form. Stale inventory records are recoverable — the record exists and is wrong. A shadow system has no record at all, and no amount of care applied to the inventory will reveal it. ## Why one source can never find it Any enumeration built on a registry answers 'what does this registry contain'. If a team stood up a production Kubernetes cluster in an account nobody added to the platform, that cluster is not a stale record or a failed collection. It is absent from the question. Detection therefore requires a second enumeration whose construction has nothing to do with the first, and then a reconciliation between them. ## Sources a running workload cannot avoid The useful independent sources share a property: the workload consumes them to function, so opting out is not free. - **Spend and billing.** Compute costs money and the money is centrally recorded. Charges attributed to a container or database service in an account with no registered systems is a strong signal. - **Identity.** People and workloads authenticate. Sign-ins into an account or cluster that the platform does not operate show up in the identity provider's logs. - **DNS.** Anything reachable by name has a record somewhere, and zones are usually centrally delegated. - **Network egress and flow records.** Traffic leaving from address ranges nobody claims tells you something is running there. - **Code and deployment configuration.** Repositories containing manifests or plan files pointed at an endpoint the platform does not recognise. - **Certificate issuance.** Certificates issued for names nobody has registered. None is complete alone. The union is much better than any single one, and the reconciliation is a recurring job rather than a one-off sweep. ## Registration as a control in its own right The strongest move is to make the scoping problem a control that can fail. 'Every production cluster is registered with the platform' converts an unknown-unknown into a measurable state: the registry supplies one set, the independent enumeration supplies the population, and the unmatched entries are findings with a due date and a named owner. That is a meta-control — it does not protect a workload directly, it protects every other control's denominator. It is also the honest answer to anyone asking how you know your population is complete: not 'we believe it is', but 'here is the reconciliation, here is its delta, here is who owns each item in it'. ## What a discovered system is, and is not A newly discovered cluster is not a pass and it is not a failure of the encryption control. It is unassessed: it is now known to be in the population and nothing has yet evaluated it. Recording it as failing overstates what you know and buries the real remediation queue; recording it as passing repeats the original sin. It moves into pass or fail only once collection actually reaches it, which usually means deploying credentials and registering it properly. ## Making the reconciliation stick Two forces refill the shadow estate. The first is friction: if the registered path is slow — a ticket, a review, a wait — and the unregistered path takes an afternoon, teams will keep choosing the afternoon. Registration has to carry benefits people want, such as ingress, secrets distribution, log routing and on-call integration, so the cheap path is the visible one. The second is incentives: discovery grows the denominator, which pushes the pass rate down. If a team's scorecard drops because they found things, the rational response is to stop looking. Reporting the growth of the population as progress, separately from the pass rate, is what keeps discovery worth doing. ## Attribution A finding with no owner does not get fixed. Each unmatched item needs an owner derived from something durable — who pays for the account, who created the identity, who owns the repository that deploys into it. Attribution is often the slow part of the work, and it is worth doing before the finding is published rather than after, because an unowned finding tends to be argued about rather than closed.