In AppSec, it's basically impossible to know for certain that you’ve found all the vulns in a given website. For similar reasons, the same is true in Asset Inventory. It’s impossible to know that you’ve found all a companies Internet-connected assets.

There is always a discomfort level in this understanding. But what I’ve found is that if you’re diligent and follow a process that accounts for all the known discovery techniques, the odds of an adversary exploiting a missed area and causing harm is exceedingly low.

And effectively every InfoSec industry report says the same thing. When bad things happen (ie breach, fraud, etc), it’s almost always the result of NOT doing something we already knew should have been done. Rare does the way a hack happened genuinely surprise us.

Another notable AppSec and Asset Inventory similarity. Counting.

How exactly do you go about counting the total number of vulnerabilities in a website? It’s harder than you think, and everyone has a different way of doing it.

How do you count Internet-connected asset? Think about CNAMES, wildcard DNS, redirects, vanity domains, intl TLDs, etc etc.