Cybersecurity Risk Management Starts With Knowing What You Run

Ask three people in the same organisation how many internet-facing systems it operates and you will often get three different answers. That disagreement is where cybersecurity risk management usually goes wrong. Organisations buy a scanner, commission a penetration test or request a dashboard before they have a reliable answer to a basic question: what systems, identities and services do we actually run?

Where security failures begin

This is not an administrative weakness. It is where material incidents start. A server that is missing from the asset inventory can easily be excluded from patching, monitoring and risk assessment. A cloud tenant with no named owner will not receive access reviews. A vendor connection opened for a project may still be available years after the project ended. A service account with broad permissions can become the fastest route from a limited compromise to a major incident.

What a useful inventory contains

A useful cyber asset inventory is more than a spreadsheet of laptops and servers. At a minimum, it should answer five questions:

What is exposed to the internet? Including domains, subdomains, certificates, remote access gateways and forgotten test environments.
What supports critical services? The systems the organisation cannot operate without for more than a few hours.
Where is sensitive data held? Including SaaS applications and file-sharing platforms, not only internal databases.
Which identities can administer the environment? Human administrators, but also service accounts, API keys, automation scripts and, increasingly, AI agents.
What depends on what? A customer portal may rely on a cloud platform, a DNS provider, a payment gateway, an identity service and several third-party APIs. Its risk cannot be assessed without understanding that chain.

Why it belongs in the board conversation

Senior management does not need a list of every device. It needs a clear view of the services that matter, the dependencies that support them and the risks that remain outside agreed control. That is the basis for decisions about investment, insurance, supplier assurance and incident planning. A board that is told “we are 94% patched” without knowing what the remaining 6% contains has not been given information it can act on.

Where to start

The work does not require a large programme. It requires order.

Look from the outside first. Attack surface management starts with what the internet can see: public DNS records, certificate transparency logs and exposed services. This is often the cheapest high-value step, because attackers begin in exactly the same place.
Reconcile your sources. Compare endpoint management, cloud accounts, vulnerability scans, network discovery and procurement records. Finance data is often the best detector of shadow IT: a SaaS subscription paid by card is an asset, whether or not IT knows about it.
Assign an owner to every critical and internet-facing asset. Treat anything without an owner as a priority finding, not a housekeeping item.
Review privileged identities separately from ordinary user accounts, including non-human identities.
Close or isolate what cannot be patched. An unsupported system that must remain in service should be segmented and monitored, with a documented reason.

The local dimension

For many organisations in Bosnia and Herzegovina, particularly smaller public institutions and municipalities, IT is run by a small team and a few long-standing suppliers. Knowledge of what exists often lives in the heads of one or two people. When one of them leaves, or a supplier contract changes, visibility leaves with them. In countries with an operational national CERT, organisations may receive warnings about exposed or vulnerable systems that have been detected externally. Cybersecurity in Bosnia and Herzegovina does not yet have that safety net at state level, so organisations here have to find their own exposure before someone else does.

Cybersecurity risk management becomes credible when controls are tied to real systems, real owners and real services. Without that connection, even a sophisticated security programme is working from an incomplete map.

Cybersecurity risk management, asset visibility and institutional responsibility will be discussed at Cyber Security Summit 2026, held on 18 and 19 November at Hills Congress Centre in Sarajevo.

Registration is open: https://yes-css.eventio.app/register