IT asset inventory for SMEs: what you actually own — and what it costs you

Most SMEs we talk to can't answer four simple questions: how many laptops does the company own, how many active Microsoft 365 accounts are you paying for, what's the monthly SaaS bill, and where is that server that "probably does something". Not because they're sloppy. Because the company grew faster than any notebook could keep up.

IT asset inventory sounds like dull, bureaucratic work fit only for big corporations. In reality it's one of the highest-return 2-to-3-day exercises we know in the SME space. It shows how much money is leaking out in licences nobody uses. It pulls forgotten laptops out of cupboards — laptops that often still hold customer data. It tells you what IT actually costs before someone shows up offering you "cost optimisation".

And most importantly — you can't sensibly secure a company you haven't inventoried. You don't protect what you don't know exists.

What actually counts as "IT assets"

In a typical 30-person firm, "IT" hides far more than laptops and printers. A useful inventory covers five layers:

• Physical hardware — laptops, desktops, monitors, work phones, printers, barcode scanners, warehouse terminals, routers, switches, access points, servers in the rack, and that one NAS box under someone's desk.
• Installed software — the operating system and its licence, the office suite, the ERP (Comarch Optima, Subiekt, enova365, Microsoft Dynamics AX), antivirus, industry-specific tools, the VPN client, design tools (AutoCAD, Adobe), SQL Server and its CALs.
• Cloud and SaaS accounts — Microsoft 365 or Google Workspace (with licence counts per plan), CRM, marketing tools, Slack, Notion, Canva, ChatGPT Team, Asana, Trello, courier portals, marketplaces. Each per-user subscription multiplies by headcount.
• Domains, certificates, DNS — who owns the company .pl domain, which account pays for it, when the SSL certificate expires, where the website is hosted, in whose control panel.
• External system access — bank, KSeF (Polish e-invoicing), tax office, supplier portals, B2B accounts at manufacturers, integration accounts (API keys for wholesalers).

This isn't a "security audit". It's an IT stocktake. Without it, every next step — from cybersecurity to selling the business — is guesswork.

A real example: a 35-person transport company

At one of our clients — a 35-person transport and freight-forwarding company (28 drivers, 7 office staff) — we did a full IT inventory as preparation for network segmentation and an ERP swap. First conversation: "look, we've got maybe 10 computers, not much really, just send us an offer". After two days of inventory work, the numbers looked like this:

• Microsoft 365 Business Standard — 22 licences being paid for at 60 PLN/month each. Actively used: 9. The other 13 — accounts of former employees from the last 3 years that nobody had disabled (forwarding rules left in place, but that's a different article). Loss: ~9,360 PLN/year.
• Subiekt GT plus 2 workstations still on a paid subscription, although the company had been running solely on Comarch Optima for 18 months. The old Subiekt sat on the office PC as a "backup" — nobody used it. Loss: ~1,800 PLN/year.
• SQL Server Standard installed on a local server, hosting a custom app for driver settlements that had been replaced by a TMS module inside Optima. The app hadn't been called for 11 months, but the licence kept costing money. Loss: ~3,200 PLN/year.
• 6 private SaaS subscriptions paid by employees and refunded via expense reports (Canva Pro, ChatGPT Plus, Notion, two planner calendars, an invoicing tool for one sales rep). ~4,200 PLN/year, plus company data sitting on personal accounts.
• The server room — 4 servers in the rack. On inspection, one had been switched off for 8 months (nobody remembered), another existed solely to send a daily report to the former CEO's email address.
• 4 laptops in the office manager's cupboard — no BitLocker, one with a weak password, two with local copies of the customer database (Optima exports from 2024). If one had ended up in the wrong hands, that would be a GDPR incident.
• 23 monitors on the last accounting register, 18 workstations in the office. Five units that nobody could locate.

In total, the first year after introducing the IT register gave the company ~18,600 PLN in saved fees alone (disabled licences, closed accounts, reduced SQL subscription after retiring the old app) and one serious GDPR risk eliminated before it blew up. Two days of work.

This isn't an outlier. In a 20-to-50-person firm we typically see 10-20% surplus licences and at least one "forgotten" device with data on it.

What a first inventory usually uncovers

After dozens of inventories, we see the same patterns:

• M365 / Google Workspace licences for ex-employees — usually 5-15% of the total, costing several hundred to several thousand PLN a year for nothing.
• Unused subscriptions — an old CRM "everyone was supposed to migrate off", a marketing tool from before the last agency change, a supplier portal where you no longer have that supplier.
• SaaS on personal employee cards — the employee buys it, the company reimburses, company data ends up on an account registered to a private email. Nobody knows what data is there.
• Hardware outside the office — laptops with remote workers, work phones with people on sick leave, warehouse terminals "borrowed" to another branch.
• "Ghost servers" — physical or virtual machines whose purpose nobody remembers, but nobody dares to switch off.
• No domain owner — the company domain is registered to the private account of a former IT contractor or the CEO's brother-in-law who ran the business 8 years ago. Renewal invoices go to an inbox nobody checks.
• Expiring SSL certificates — with no owner, so the company finds out from a customer ("hey, your website says it's not secure").

Each item, in isolation, is trivial. Together they create a landscape where you can't tell what IT really costs you or where your data actually lives.

How to do it without a 50,000 EUR IAM system

In an SME you don't need expensive ITAM/CMDB software. You need two days, one spreadsheet and discipline. Here's the version we run with clients:

1. Start with accounting. Pull the last 12 months of invoices and grep for "IT", "licence", "subscription", "SaaS", "hosting", "domain", "cloud". That's 70% of your register — without leaving your desk.
2. Log into the M365 / Google Workspace admin panel and list every active account with its plan. Compare against the current HR roster. Accounts not on the HR list — flag for review.
3. Do a physical walkthrough. Catalogue laptops, monitors, printers, phones — with serial numbers. Check cupboards, storage, company cars.
4. Talk to each department head individually, 15 minutes each. "What tools does your team use that IT probably doesn't know about?". That pulls out 80% of shadow IT.
5. Put it all in one spreadsheet with columns: name, type (hardware/software/SaaS), owner inside the company, monthly cost, renewal date, who uses it, where the data lives.
6. Mark "to retire" anything nobody uses or that has no owner. Run it past the CEO and start switching things off.

First full inventory: 2-3 days. Updates: 30 minutes a month, quarterly review.

How to keep it current

An inventory you don't update is worse than no inventory — it gives you a false sense of control. Three simple rules that work in SMEs:

• Every new licence, device or SaaS goes through one person (office manager, IT, the CEO). Purchases outside that channel don't get reimbursed. Harsh, but it's the only thing that holds.
• Every new SaaS is registered to it@yourcompany.com, not to an employee email. The employee gets access as a user, but the company owns the account. When they leave, the account stays.
• A 15-minute quarterly review. One meeting, one spreadsheet, "what changed?". Without that, the register is fiction within six months.

What to do this week

If you've never done an IT inventory, start with three steps that will take you a total of two hours:

1. Open the Microsoft 365 / Google Workspace admin panel and list active accounts. Compare with HR. Every account without an owner — disable it today.
2. Go through the last 12 bank statements looking for IT/SaaS subscriptions. Anything nobody in the company can map to a process — candidate for cancellation.
3. Check whose account holds your company domain and when the SSL certificate expires. If you don't know — that's your starting point.

These three steps don't solve the problem, but they show the scale. In most SMEs, the result of those two hours pays for itself with the first disabled licence.

If you want to put your IT in order before it really starts costing you (or before something blows up on hardware nobody remembered) — at SilverData we do this with Polish SMEs regularly. The first call is free and takes half an hour.

You can't secure, optimise or sell a company whose IT you can't fit on a single sheet of paper.

← Back to blog