Lumen Technologies Found It Had 1.1 Million Assets, Not 17,000
A new Axonius survey shows most companies still can't see what they own. Lumen's cleanup shows why that matters.
Key points
- A 2026 Axonius survey of more than 600 security leaders found only 45% of organisations pull their asset and exposure data into one view.
- Lumen Technologies, a US telecoms carrier, discovered its real asset count was around 1.1 million, not the 17,000 it had on the books.
- Every downstream security programme, from patching to incident response, inherits whatever the inventory gets wrong.
- Axonius argues that fixing the inventory is the precondition for fixing anything else.
Most security teams believe their list of company computers, servers and cloud accounts is roughly right. The numbers say otherwise.
The 2026 Axonius Actionability Report, based on a survey of over 600 security leaders, found that only 45% of organisations bring their asset data and their exposure data (the list of known weaknesses on each of those assets) into a single view. The rest are working from fragments. Different tools, different spreadsheets, different answers to the same question.
That matters because every other security job depends on the inventory being right. If you don't know a server exists, you can't patch it. You can't monitor it. You can't tell a regulator whether customer data lived on it.
Why does an accurate asset list matter so much?
Because you cannot defend what you cannot see. The Hacker News, reporting on the same Axonius findings, highlighted Lumen Technologies as the case study that makes the point uncomfortably clear.
Lumen is a large US telecommunications company. When its security team rebuilt its exposure management programme (the process of finding weaknesses across every device and account the company owns), the true asset count came in at roughly 1.1 million.
The previous figure was around 17,000.
That is not a rounding error. It is the difference between a small-town map and a national one. Everything the old programme did, vulnerability scanning, risk scoring, compliance reporting, was running against a picture that captured less than two percent of reality.
What was actually missing?
The short answer: most of the modern estate. Cloud workloads that spin up and down within hours. Contractor laptops. Software-as-a-service accounts bought on a department credit card. Internet-facing systems inherited through mergers. Old kit nobody had formally retired.
Traditional inventory tools were built for a world of desktops and data centres. They struggle with anything that moves or lives with a third party. So the gaps grow quietly, year after year.
Axonius' argument, and the reason Lumen is being held up as an example, is that consolidation has to come first. Pull the feeds from every source that already knows about assets: the cloud providers, the identity system, the endpoint agent, the network scanner. Reconcile the duplicates. Then, and only then, layer the exposure data on top.
What does this mean for ordinary customers?
If you are a customer of a telecoms, bank or health provider, you rarely see this work. But you feel it when it fails. Breach notifications that arrive months late, or say vaguely that "some customer data may have been affected," often trace back to a company that did not know which systems held what.
Regulators are starting to press on this directly. The US Federal Trade Commission and the UK Information Commissioner's Office have both cited poor asset management in recent enforcement actions, treating it as a failure of reasonable security rather than bad luck.
For security teams reading this: the practical takeaway from Lumen is not that you need a bigger tool. It is that the number in your inventory is probably wrong, and the first honest audit will hurt. Better to feel that pain internally than in a breach notification letter.
