Asset discovery and scan types: active vs passive, credentialed vs non-credentialed, agent vs agentless, internal vs external

You cannot protect or scan what you do not know exists. Vulnerability management therefore starts with asset discovery: building and maintaining an inventory of hosts, applications, cloud resources and devices, together with their owners and criticality. Unknown assets, such as a forgotten test server or a cloud instance someone launched for a project and never removed, are often the ones that get breached, because nobody patches or monitors them.