Elias Virtanen
September 24, 2026
5 min read
Moving workloads between cloud providers can make sense for all kinds of businesses. One platform might suit a particular application, while another offers better pricing, regional coverage or a service the first provider does not. The tradeoff is that every environment brings its own accounts, tools, configurations and security settings.
That makes knowing what is actually running a much bigger job. Before a security team can investigate a vulnerability or lock down an exposed service, it needs to find the relevant resources first. This is where IT Asset Discovery becomes especially useful, giving teams a way to build a clearer picture of infrastructure spread across different environments.
A company could have virtual machines in one cloud, containers in another, databases sitting across several regions, and SaaS applications owned by separate departments. If those systems are tracked separately, connections between them can be missed.
Using several cloud providers does more than increase the number of assets a company has to manage. It can also create different ways of doing essentially the same thing.
Each provider has its own management console, terminology, APIs, identity controls and configuration options. A security rule that is straightforward to implement in one environment may require a different approach elsewhere.
Then there are the relationships between resources. An application hosted on one platform could rely on a database somewhere else. A service account may have permissions across multiple environments. A container could communicate with an external API that security teams rarely think about when reviewing their main cloud infrastructure.
A useful asset inventory therefore needs to capture more than a list of servers. It should help answer questions such as:
- Which resources exist in each environment?
- Who is responsible for them?
- Which applications rely on them?
- What identities can access them?
- Where is sensitive data being stored?
- How are different resources connected?
Without those answers, it becomes much harder to work out where the most significant gaps are.
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
NIST identifies 23 multi-cloud challenges
The complexity of multi-cloud security has also been documented by the National Institute of Standards and Technology. Its Multi-Cloud Architecture Challenges report identifies 23 consolidated challenge areas associated with multi-cloud environments.
Among the areas NIST highlights are identity and access management, telemetry and logging, configuration and change management, data protection and compliance and authorization. Coordinating these functions across different cloud environments can be hard because providers and organizations may approach them in different ways.
That puts asset visibility near the beginning of the process. Take identity management as an example. Reviewing someone’s permissions is much harder when there’s no reliable record of the resources they can reach. The same principle applies to configuration management. A team can’t easily check whether systems are configured correctly if it doesn’t know which systems are present.
Discovery isn’t a complete answer to these problems. It gives security teams something more basic, but essential: a current view of the environment they are expected to protect.
Why a static inventory falls short
A spreadsheet can tell a security team what existed when somebody last updated it. But cloud infrastructure doesn’t necessarily wait for the next update.
New resources can be spun up automatically. Developers can create temporary environments for testing. Workloads can be moved, changed or deleted. An asset that was important six months ago might no longer exist, while something created yesterday might not have made it into an inventory at all.
For that reason, discovery works better as an ongoing process rather than a periodic housekeeping task.
Automated tools can look across cloud environments and pick up changes as infrastructure evolves. That can also bring attention to resources that have been forgotten, such as unused accounts or services that were created for a project that has since ended.
These assets may not represent an immediate security incident, but they can add unnecessary exposure and make an environment harder to manage.
Finding the context behind an asset
Simply knowing that a database exists does not tell a security team how important it is. Imagine that database contains customer information. The next questions are more useful: Which applications connect to it? Who can log in? Is it reachable from the public internet? Where are its backups kept? Which cloud account owns it? Does its configuration meet the company’s requirements?
Those details turn an inventory into something security teams can actually work with.
The same applies when a vulnerability is discovered. Rather than investigating an isolated hostname or resource ID, a team can look at its connections, ownership, permissions and data. That can make it easier to establish what needs attention and who should deal with it.
Making asset discovery part of the security process
Improving visibility doesn’t have to mean rebuilding an organization’s entire cloud architecture. A few practical measures can make a difference:
Cover every environment: Include accounts, projects, subscriptions, workloads, databases, containers and other relevant cloud resources.
Automate where possible: Continuous discovery is better suited to infrastructure that changes frequently than a manually maintained inventory.
Record ownership:Knowing which team or person is responsible for an asset makes follow-up much easier.
Track relationships: Connections between applications, identities, networks, and data can reveal risks that are not obvious when resources are viewed individually.
Pay attention to sensitive systems:Assets handling financial, customer, or other sensitive information may require closer monitoring than less critical resources.
A clearer starting point for cloud security
Multi-cloud infrastructure is not automatically a security problem. The challenge is maintaining a consistent understanding of what is happening across environments that can work very differently.
Asset discovery gives organizations a place to start. With a current picture of their resources, relationships, ownership and access, security teams have more of the information needed to manage vulnerabilities, review permissions, monitor configurations and meet compliance requirements.
As cloud infrastructure becomes more dynamic, knowing what is running cannot be treated as a one-time inventory exercise. The environment changes too quickly. Keeping that picture current is an important part of keeping the wider security strategy grounded in reality.
