When you’re a security professional tasked with securing “all the assets in your organization,” the fundamental question which arises is, “What assets do I have?” While it appears to be a benign question , the answer has become increasingly complicated for two reasons. First, the definition of cyber asset varies greatly depending on whether its security operations, security engineering, IT, development, or DevOps. Second, because we live in a software-defined world with virtual servers, containers, access rows, and more, the traditional “asset” is made up of multiple granular atomic assets, with unique security and compliance implications.