Lumen Technologies Found It Had 1.1 Million Assets, Not 17,000
A new Axonius survey shows most companies still can't see what they own. Lumen's cleanup shows why that matters.
Key points
- A 2026 Axonius survey of more than 600 security leaders found only 45% of organisations pull their asset and exposure data into one view.
- Lumen Technologies, a US telecoms carrier, discovered its real asset count was around 1.1 million, not the 17,000 it had on the books.
- Every downstream security programme, from patching to incident response, inherits whatever the inventory gets wrong.
- Axonius argues that fixing the inventory is the precondition for fixing anything else.
Most security teams believe their list of company assets is roughly right. The numbers say otherwise.
The 2026 Axonius Actionability Report, drawn from a survey of over 600 security leaders, found that only 45% of organisations bring their asset data and their exposure data (the list of known weaknesses on each asset) into a single view. Fragments everywhere. Different tools, different spreadsheets, different answers to the same question.
That matters because every other security job depends on the inventory being right. If you don't know a server exists, you can't patch it, monitor it, or tell a regulator whether customer data lived on it.
Why does an accurate asset list matter so much?
Because you cannot defend what you cannot see. The Hacker News, reporting on the same Axonius findings, highlighted Lumen Technologies as the case study that makes the point uncomfortably clear.
Lumen is a large US telecommunications company. When its security team rebuilt its exposure management programme (the process of finding weaknesses across every device and account the company owns), the true asset count came in at roughly 1.1 million. The previous figure was around 17,000.
That is not a rounding error. Everything the old programme did, vulnerability scanning, risk scoring, compliance reporting, was running against a picture that captured less than two percent of reality. Our June piece on attack-surface growth found the same structural problem from a different angle: forgotten admin panels and unpatched endpoints accumulate precisely because no one confirmed they existed.
What was actually missing?
Most of the modern estate. Cloud workloads that spin up and down within hours. Contractor laptops. Software-as-a-service accounts bought on a department credit card. Internet-facing systems inherited through mergers. Old kit nobody had formally retired.
Traditional inventory tools were built for desktops and data centres. They struggle with anything that moves or lives with a third party, so the gaps grow quietly, year after year.
Axonius' argument is that consolidation has to come first. Pull feeds from every source that already knows about assets: the cloud providers, the identity system, the endpoint agent, the network scanner. Reconcile the duplicates. Then layer exposure data on top.
Should you worry if you're a customer?
You rarely see this work. You feel it when it fails. Breach notifications that arrive months late, or say vaguely that "some customer data may have been affected", often trace back to a company that did not know which systems held what.
Regulators are pressing on this directly. The US Federal Trade Commission and the UK Information Commissioner's Office have both cited poor asset management in recent enforcement actions, treating it as a failure of reasonable security rather than bad luck.
For security teams: the practical lesson from Lumen is not that you need a bigger tool. The number in your inventory is probably wrong, and the first honest audit will hurt. Better to feel that pain internally than in a breach notification letter.
