Terminate an EC2 instance and its root disk goes with it. Every volume attached after launch stays behind, and AWS documents the default plainly: DeleteOnTermination is true for the root volume and false for attached volumes. Nobody chose that for your estate; it is what the account does when the question never comes up. Your engineers were not careless. Your infrastructure is larger than your documentation because the defaults sit on the side of the leftovers.
A cloud asset inventory assembled from memory will always be a subset of what is running and billing. Flexera's 2026 State of the Cloud Report, published on 18 March 2026 from 753 cloud decision-makers, put wasted cloud spend at 29 percent, the first increase in five years. That is filed as a finance number. The security version of it is worse: a machine nobody remembers renting is a machine nobody is patching. It is still holding the credential it was issued, still answering on a port, and outside the scope of your next penetration test, because the scoping call worked from the same list you did.
Where orphaned cloud resources actually come from
The engineer who left is the cleanest example. Somebody stood up a proof of concept in a region the team does not otherwise use, demoed it, and left eighteen months later. The instance is still running and it is in nobody's Terraform. Next to it sits the second account: a project that needed to move faster than procurement, opened on a personal card, never folded back in. Cisco puts the share of employees using unsanctioned technology at 80 percent. Gartner found 41 percent acquired, modified or created technology outside IT's visibility in 2022, and puts 38 percent of technology purchases under business leaders rather than IT.
The rest is mechanical. Autoscaling scaled up for a launch and the scale-down policy was never written as aggressively as the scale-up one, so a group that should sit at four sits at eleven. A load balancer outlives the service it fronted. Snapshots run on a schedule someone set in 2022 with no expiry. And somewhere in most estates a staging environment became production by accident, because a customer integration was pointed at it once and nobody wanted to be the one to turn it off.
An unknown machine is an unpatched machine
Verizon's 2026 DBIR, published on 20 May 2026, found vulnerability exploitation had become the single most common initial access vector at 31 percent of breaches, up from 20 percent the year before. It puts the median time to remediate a known-exploited vulnerability at 43 days, up from 32, and finds only 26 percent of the vulnerabilities on CISA's known-exploited list were ever fully remediated. Those figures describe the machines you know about. For the others the remediation time is never.
An instance that predates your patch tooling is also still holding whatever credential it was handed on its first day. Datadog's State of Cloud Security 2025 found 59 percent of AWS IAM users have an active access key older than a year, a quarter of all keys older than three years and one in ten older than five. The 2026 Cloud Security Report from Cybersecurity Insiders and Fortinet, based on 1,163 IT and security practitioners, has 69 percent naming tool sprawl and visibility gaps as the top factor limiting their cloud security. The forgotten machine is where those two findings meet.
What idle cloud spend looks like line by line
Since 1 February 2024 AWS charges $0.005 per hour for every public IPv4 address, attached or not, about $43 a year for an address doing nothing. An Application Load Balancer in US East (N. Virginia) is $0.0225 an hour, roughly $16.43 a month, billed whether or not it routes a single request. Individually these are rounding errors, which is why they survive: no line is big enough to make anyone open a ticket, and a mid-size estate carries hundreds of them. The heavier money is in resources running correctly and doing nothing. Datadog's 2024 State of Cloud Costs found 83 percent of container costs associated with idle resources: 54 percent of container spend is cluster idle, infrastructure provisioned and never scheduled onto, and 29 percent is workload idle, resource requests larger than the workloads need.
Running discovery across accounts you did not open
Start from money and identity, not from consoles. Every account is attached to a payment instrument, so twelve months of card and bank statements is a better discovery source than any provider API; after that your identity provider and your DNS zones, because an account nobody remembers still resolves a name somebody registered.
Inside an account the provider tooling helps and also lies by omission. AWS Resource Explorer builds one index per Region, permits exactly one, and needs one promoted to an aggregator before cross-Region search works at all, so a Region you never indexed contributes nothing to results that look complete. Tagged resources surface in minutes and untagged ones take up to two hours or longer, so the least documented resources are the slowest to appear. Run it twice, a day apart, before you believe it.
Across providers the merge is the work, and by hand it never finishes, because each export has its own idea of what counts as a resource and no two name regions the same way. Sencai does that merge as the product: connect an account with scoped credentials and its existing instances, networks, storage and DNS arrive in one list, beside the machines in your own racks that a host agent can reach, none of it migrated or rebuilt. Promotion into management happens one resource at a time, so seeing something is not agreeing to run it.
Triage by blast radius, not by monthly cost
The first pass returns more than any team can act on. A sheet of a thousand-odd findings sorted by monthly cost puts a $9 disk above an internet-facing instance with a three-year-old access key on it. Wiz's State of Cloud Risk 2026 found only 9 percent of findings are remote code execution; exposure and access issues dominate what becomes an incident. Order by what an attacker gets instead: anything reachable from the internet that holds a credential first, then anything holding data, then the keys and roles belonging to unclaimed resources. Unattached addresses and idle load balancers go last, however easy they are to fix. Being wrong about one of those costs $43.
Deletion is the wrong first action for anything unclaimed. Stop it and watch instead. An instance that sits stopped for thirty days without one person noticing is safe to remove; one that produces a support ticket within four hours has just identified its owner. Snapshot anything with a disk before you touch it. The single irreversible mistake available here is deleting the storage of something that turned out to be load-bearing, and every team that has done it once performs the thirty-day wait forever after.
An inventory with a finish line is worthless in six weeks
A spreadsheet is accurate on the afternoon it is produced and decays from that evening. Everything that produced the gap is still running: the defaults have not changed, and the deadline that justified the second account comes round again in March. Article 21(2)(i) of NIS2 lists asset management among the ten minimum risk-management measures in-scope entities must implement, alongside risk analysis under 21(2)(a) and cyber hygiene under 21(2)(g), and no document satisfies any of them. The transposition deadline was 17 October 2024; on 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice over incomplete transposition, asking for daily penalties.
Continuous discovery is a different thing from a project, and the only version that survives a real estate. Sencai's free configuration, one user and one organisation with five managed resources, will run a discovery pass against a real account and show you the list before you promote anything into management. Be clear-eyed about the limit: live management at the provider is deep rather than wide, DNS on five providers, firewalls on two and networks on one, so plenty of what you find you will still change in the provider's console. Whatever you use, take your oldest account, enumerate every region including the two you are certain are empty, and sort what comes back by whether it can be reached from the internet, not by what it costs. The first resource nobody can put a name to is where the work begins.