Between regulatory requirements and the increasing sophistication of cyberattacks, IT leaders can no longer afford to protect only what they can see. The real question is no longer “how to defend ourselves,” but “what we don’t see yet.”
The Essentials in 4 Points
- According to Netskope, 97% of cloud applications used in enterprises are neither known nor approved by the IT department—a figure that reveals the sheer scale of the “invisible assets” phenomenon.
- IoT, shadow IT, OT, abandoned VMs, undocumented network equipment: a significant portion of the actual IT infrastructure is not included in the official inventory.
- The NIS2 Directive requires asset inventory starting at the “Basic” level of the CyFun framework—not just at the “Important” or “Essential” levels.
- Shinka selected Armis after a comparative R&D study (desktop research + field PoV) to help its clients achieve this visibility.
A Paradox That Costs Companies Dearly
Cybersecurity budgets are rising, IT teams are being trained, and security tools are proliferating. And yet, incidents continue to occur through channels no one anticipated. The reason is often the same: part of the network slips under the IT radar.
This lack of visibility is no trivial matter: according to a Netskope study cited in the industry press, 97% of cloud applications used in enterprises are neither known nor approved by the IT department. While this figure pertains to the cloud, it illustrates a broader reality: the organic growth of infrastructure automatically creates blind spots, extending far beyond the scope of applications alone.
It is therefore not a matter of a lack of expertise or negligence on the part of IT teams. It is an inevitable consequence of the growth of modern infrastructure: every new connected device, every new cloud application, and every piece of equipment installed by a third-party provider expands the attack surface without systematically undergoing centralized IT approval.
As a result, many organizations do an excellent job of protecting what they know about, yet remain blind to a significant portion of their actual infrastructure.
What does the invisible part of your network encompass?
When we talk about “unmanaged” or “invisible” assets, we’re referring to a very specific set of devices and services that are indeed connected to the company’s network but are missing (or obsolete) from its official inventory:
- Connected devices (IoT): surveillance cameras, time clocks, printers, air conditioning systems, and smart building equipment.
- Shadow IT: applications, cloud accounts, or tools installed by business units without IT approval.
- Operational Technology (OT) equipment: PLCs, sensors, and production systems, historically designed without cybersecurity requirements.
- Forgotten or unmanaged equipment: old, unpatched hardware that is still active on the network.
- Abandoned virtual machines: test environments or completed projects that were never decommissioned.
- Undocumented network equipment: switches, access points, or devices installed locally, outside the official network diagram.
- Unrecorded cloud services: instances or subscriptions acquired outside standard IT channels.
Each of these elements represents a potential entry point. And just one is enough.
Why IT Doesn’t See Everything—and It’s Not a Governance Failure
This situation is not a sign of poor management. It stems from the way infrastructure actually evolves: organic growth over the course of projects, decentralization of IT procurement, the proliferation of connected devices in buildings and on production lines, and the use of external vendors who install their own equipment.
Traditional tools (antivirus, EDR, firewalls) are designed to protect what has already been identified. By their very nature, they have no visibility into anything that has never been presented to them. It is precisely this blind spot that attackers know how to exploit.
Real-life example: when a simple surveillance camera becomes the point of entry
This scenario is not theoretical. One of our clients, a Belgian industrial company, experienced it firsthand.
Yet its environment had a security foundation built up over the years: firewalls at each site, antivirus software, multi-factor authentication on some accounts, an EDR solution, infrastructure redundancy, regular security audits, and even cyber insurance. On paper, a solid security posture.
However, the breach did not originate from a workstation or a critical server, but from a surveillance camera exposed to the Internet. This camera model was vulnerable to a known flaw that had never been patched. Compounding the problem: this camera was connected to the company’s Active Directory to enable the recording of footage to a network storage space.
An attacker exploited this access to discreetly infiltrate the network, monitor the environment for several days, then compromise the Active Directory before deploying ransomware. The consequences: nearly 95% of production was halted, physical and virtual server environments were encrypted, data was exfiltrated and published on the dark web, and it took several weeks to return to normal operations.
This case illustrates a simple reality: a device perceived as secondary (a camera) can become the weak link that compromises the entire information system—precisely because it fell outside the scope of traditional IT monitoring.
What level of asset visibility does NIS2 require?
Visibility into all connected assets is a requirement at the very foundation of the regulation. The Centre for Cybersecurity Belgium (CCB) provides a framework for NIS2 compliance through the CyberFundamentals (CyFun)framework: even at the Basic level—the minimum expected of any entity subject to NIS2—there are already requirements for documentation and inventory of network assets. The Important and Essential levels—which apply depending on the sector and the entity’s criticality—reinforce this requirement but do not create it: it applies from the outset, to everyone.
In other words, no company can avoid this requirement on the basis of its classification: it is impossible to document, protect, or demonstrate control over an information system if part of it remains invisible. Precise knowledge of one’s IT, OT, and IoT asset inventory is therefore a cross-functional prerequisite, required from the very first stage of compliance.
Why Shinka Chose Armis: The Result of a Rigorous R&D Approach
In light of this, Shinka undertook a structured internal research and development initiative to identify the most relevant Cyber-Physical Security (CPS) solution to meet its customers’ actual needs.
This study was based on an independent market analysis, supplemented by the definition of precise comparison criteria among the sector’s leading players. After an initial phase of desktop research and solution evaluation, a proof of concept (PoC) was conducted with the shortlisted vendors, based on real-world customer use cases, to concretely assess their capabilities in the field rather than relying solely on sales pitches.
At the conclusion of this comparative evaluation, Armis was selected as Shinka’s preferred platform for Cyber Exposure Management—a choice guided by the study’s methodological rigor, not by a mere business relationship.
Armis is notably recognized for launching the market’s first enterprise OT/IoT security platform—a positioning that played a key role in our decision to cover the full IT, OT, and IoT spectrum for our clients.
How does the Armis platform actually work?
Armis’s promise boils down to three simple questions that IT teams rarely fully address: What do we actually have? What really matters? How can we effectively address the issue?
In practice, the platform relies on an agentless, cloud-native approach, which means it requires no installation on the devices themselves—a key consideration for OT environments where installing agents is often impossible or risky. Its operation is structured around four steps:
- Discover: Identify all connected assets—IT, IoT, OT, IoMT, IIoT, cloud, and applications—and map their network connections.
- Assess and Prioritize: Consolidate all security findings and prioritize them based on their likelihood of exploitation and their actual business impact.
- Remediate: orchestrate corrective actions and automate the assignment of remediation responsibilities.
- Monitor and report: ensure continuous monitoring of assets and the network, with actionable reporting for teams and management.
This approach transforms a list of unknown devices into a concrete, prioritized action plan—an essential prerequisite for any remediation or network segmentation strategy.
In conclusion: See before you protect
The security of an information system can never exceed the level of knowledge we have about it. Before investing further in additional layers of protection, the most useful question to ask remains the simplest: Do you really know everything that is connected to your network?
At Shinka, we support IT managers, CISOs, and CIOs in this visibility process, from the initial mapping of their assets through NIS2 compliance to the effective securing of their attack surface.
Would you like to objectively assess your current level of visibility? Let’s discuss it—a single initial conversation is enough to identify your priorities.
Frequently Asked Questions
What is Cyber Exposure Management?
Cyber Exposure Management is a cybersecurity approach that involves discovering, mapping, and prioritizing all of an organization’s connected assets (IT, OT, IoT, cloud) to reduce the actual attack surface—beyond what traditional security tools can detect.
At what NIS2 level is asset inventory mandatory?
Asset inventory and documentation are required starting at the Basic level of the CyFun framework, the minimum baseline applicable to any entity subject to NIS2. The Important and Essential levels reinforce this requirement but do not make it conditional: it applies starting at the first compliance tier.
What is an “unmanaged” or “invisible” IT asset?
This refers to equipment or services connected to the company’s network but missing from its official inventory: IoT devices (cameras, time clocks), shadow IT, industrial equipment (OT), forgotten hardware, abandoned virtual machines, undocumented network equipment, or unlisted cloud services.