Asset inventory bounds vulnerability truth

You can only find flaws in systems you know exist, so the inventory sets a hard ceiling on how true any vulnerability report can be.

Every organisation has systems missing from that list: forgotten, inherited, built by a team in a hurry. None of them appear in the scan, so none appear in the report, and the report looks better as a result. An incomplete inventory does not produce a worse picture; it produces a falsely reassuring one.