That’s not a technology problem. It’s an operational design question. The answer is process architecture, not audit frequency.
Consider a mid-sized enterprise processing around 2,000 device lifecycle events per month. That’s provisioning, reassignment, offboarding, refresh, retirement. Each event is a moment where records and physical reality can diverge. Over a year, that’s roughly 24,000 opportunities for the gap to widen.
The organizations that solve for this aren’t building more sophisticated monitoring. They’re building better handoffs. Every device movement has an owner. Every ownership change has a record. Every departure has a verified return or a documented exception.
How Drift Accumulates
Drift is invisible until it forces itself into view. Most organizations don’t detect it when it begins. They discover it during an audit, a security incident, or a budget reconciliation that doesn’t add up.
Hiren Hasmukh is the CEO and founder of Teqtivity, a leading IT Asset Management solutions provider. With over two decades of experience in the technology sector, Hiren has been at the forefront of developing innovative ITAM strategies for businesses navigating the complexities of digital transformation. Under his leadership, Teqtivity has evolved from a smart locker concept to a comprehensive ITAM solution serving companies of all sizes.
The IT teams I see maintaining clean environments have usually made the same shift in how they think about asset records. The record is a live account of current custody. That distinction changes how they design their processes, what they require at each transition, and who is accountable when something falls through.
- Hiring speed. Devices get provisioned fast. Records get created. The updates that should follow deployment don’t always happen on the same timeline.
- Role changes. A laptop moves desks, teams, or geographies. Custody shifts informally. The record stays with the last formal assignment.
- Offboarding. Logical access gets revoked immediately. Physical retrieval depends entirely on process discipline. In distributed environments, that discipline is inconsistent. According to a Capterra survey, 71% of HR professionals report at least one departing employee failing to return company equipment. Remote and hybrid employees are 17% more likely to hold onto it.
- Refresh cycles. New devices get issued. Old ones don’t always get formally retired. Both remain active in the system of record.
That gap is what we call inventory drift. The devices that live inside it are ghost assets: recorded as active, present in the system, but no longer in verified custody.
Why It Goes Undetected
Ghost assets don’t appear because something went dramatically wrong. They accumulate because something routine didn’t get documented. Fix the routine, and the ghost assets stop appearing.
If your organization is running scheduled audits and finding ghost assets each time, the problem is not that the audits are too infrequent. The problem is that the events creating the ghost assets are not being captured when they happen. More audits will keep finding the same type of gap. Governing the transitions directly will stop creating it.
Provisioning, custody transfer, location change, offboarding, refresh, retirement. Each one updates the system of record at the moment the asset changes state. The record moves with the device, not after it.
The Pattern in Organizations That Stay Clean
Drift occurs because the processes that generate records move faster than those that verify them.
The device nobody knows is out there is also the device nobody is monitoring.
After working across hundreds of enterprise environments, I’ve noticed that the organizations with the lowest ghost asset counts share a structural characteristic. They don’t just audit more frequently. They treat every lifecycle transition as a control point.
The Governance Reframe
The problem is somewhere between what the records say and what’s actually in the field, a gap opens. It starts small. A device changes hands without documentation. A laptop gets reassigned but the record stays with the previous employee. Someone leaves and returns the wrong device, or no device at all. The system marks it done anyway.
The standard framing around ghost assets treats them as an inventory problem. Run a better audit. Improve the data. Clean the records.
Most IT leaders I talk to are confident their asset records are accurate. The dashboard shows 100% patch deployment. Offboarding is marked complete. Hardware rollouts report full coverage. The numbers look clean.
None of these events are unusual. Each one is ordinary operational activity. At scale, their cumulative effect is what makes drift the default state, not an anomaly.
Lifecycle enforcement breaks that cycle. When each transition is structured and documented, drift rarely accumulates because the gap between records and reality never gets time to widen.
What This Means Practically
The compounding problem is that modern security tools are built to protect known environments. Endpoint detection, patch management, device policy enforcement — all of these require the device to be in the record. A ghost asset, by definition, sits outside that envelope. It may retain stored credentials, cached sessions, access history, and corporate data. IBM’s 2025 Cost of a Data Breach Report puts the average global breach cost at .44 million, and .22 million for U.S. organizations. The average time to identify and contain a breach: 241 days.
The four sources that generate most of the drift:
That framing misses the underlying issue. Ghost assets are a governance failure. They appear when the processes that should capture lifecycle transitions don’t, or when accountability for those transitions is unclear.
A device that leaves organizational custody without a verified retrieval and formal retirement is an unmanaged endpoint. It carries whatever data and access it held at the moment of loss. The question of where it is, who has it, and whether it can still reach company systems doesn’t get answered by running another audit six months later.
