From 17,000 to 1.1 Million Assets: Lumen Technologies Strengthens Exposure Management Through Comprehensive Data Reconciliation

In a landscape where cybersecurity threats are increasingly sophisticated, accurate asset inventory is paramount. However, many organizations operate under the assumption that their asset inventories are sufficiently accurate. A recent survey from the 2026 Axonius Actionability Report reveals a stark reality: only 45% of organizations consolidate their asset and exposure data into a single, comprehensive view. This gap in visibility can lead to significant vulnerabilities, as every downstream security program inherits inaccuracies from the asset inventory.

Lumen Technologies, a telecommunications giant with nearly a century of operational history, recently undertook a significant initiative to address this issue. Geoff Krahn, Director of Product and Platform Security at Lumen, and his team leveraged the Axonius asset intelligence platform to reconcile data from over 40 disparate systems into a unified view. The results were staggering: they discovered 60 times more devices than previously accounted for, fundamentally reshaping their exposure management strategy.

Why Asset Inventories Break Down at Enterprise Scale

Lumen’s experience highlights a common challenge faced by many security teams. The organization was managing more than 40 independent IT and security tools, each providing different perspectives on device counts, ownership, and coverage status. This fragmentation made it nearly impossible to answer critical questions, such as the percentage of servers equipped with Endpoint Detection and Response (EDR) solutions.

Krahn noted the chaos that ensued during incident response calls, where ownership of assets was often unclear. The Axonius platform enabled the Lumen team to consolidate these disparate sources into a single model, revealing a far larger scope of assets than anticipated:

• Starting point: Approximately 17,000 known cyber assets
• After initial reconciliation: 500,000 devices identified and categorized
• Current scope: Roughly 1.1 million devices

Krahn remarked on the profound impact of this newfound visibility, stating, “It has really been an eye-opener for the organization as a whole how large our responsibilities are. Being able to quantify it and highlight gaps in controls has allowed us to gain the leadership support and funding we need.”

What Trusted Asset Data Makes Possible

The implications of having accurate and comprehensive asset data are significant, particularly in the context of responding to zero-day vulnerabilities. When a critical vulnerability is identified, the speed of response hinges on knowing which systems are affected and who is responsible for them. Krahn’s team can now quickly identify impacted systems, assess their exposure, and establish ownership within minutes. Alerts can be dispatched to engineers via a chatbot integrated with Axonius, facilitating rapid communication and action.

In addition to vulnerability response, Lumen’s asset data has enhanced application posture visibility. The organization operates thousands of internal applications, and understanding the implications of a compromised server goes beyond knowing whether it is patched. By correlating Configuration Management Database (CMDB) relationships with control coverage, vulnerability data, and end-of-life status, Lumen developed an Application Posture Dashboard. This tool evaluates risk at the application level, linking cybersecurity exposure directly to revenue streams.

How Risk-Based Exposure Management Replaces “Scan and Spam”

Many organizations still rely on traditional methods for vulnerability management, often sorting by Common Vulnerability Scoring System (CVSS) scores and addressing issues in a top-down manner. The Actionability Report indicates that 56% of organizations primarily use CVSS for prioritization, despite a consensus that exploitability, blast radius, and business impact should guide these decisions.

This conventional approach can bury critical issues beneath a mountain of medium-severity findings that pose no specific risk to the environment. Krahn described this outdated model as “scan and spam,” where teams scan everything, compile results, and hope that the most pressing issues are addressed first.

With reliable asset data in place, Lumen adopted a more strategic approach. The Axonius Exposures feature allowed the team to integrate technical findings with asset context, business criticality, and control coverage. This enabled them to identify which remediation efforts would yield the greatest risk reduction.

Krahn emphasized the transformative potential of this approach: “Exposure management will allow us to evolve vulnerability management beyond scan and spam to intelligent risk-based requests driven by remediation actions that will deliver the most risk reduction.”

What Happened When Lumen’s Leadership Trusted the Data

The shift to trusted, quantified visibility has led to significant changes in Lumen’s strategic decisions:

• Cloud migration: Enhanced visibility into end-of-life systems prompted the decision to migrate the majority of infrastructure to the cloud.
• 10x security investment: Leadership increased spending on security measures to roughly ten times its previous level, recognizing the full scope of their responsibilities.
• Board-level reporting: Lumen’s board now relies on Axonius-generated reports for insights into asset coverage, EDR deployment, and compliance.

Krahn noted that the visibility provided by Axonius was instrumental in the decision to migrate infrastructure to the cloud, resulting in a 40% reduction in overall risk.

Is Your Asset Data Carrying the Same Gaps?

Lumen’s experience serves as a cautionary tale for organizations with dedicated security leadership and multiple inventory systems. If a company of Lumen’s scale found its cyber asset management picture to be off by a factor of 60, it is reasonable for other enterprises to assume they may face similar gaps.

Every exposure management program is only as strong as the asset data that underpins it. If this foundational data has not been rigorously tested, the prioritization, ownership mapping, and remediation workflows built upon it may be based on flawed assumptions rather than solid evidence.

For further insights into risk-based exposure management and the capabilities of Axonius Exposures, visit thehackernews.com.

Keep reading for the latest cybersecurity developments, threat intelligence and breaking updates from across the Middle East.