The loudest story in security this year is AI. The quietest one is the same problem we have had for twenty years: someone forgot to turn off a server, and now it is the attacker’s front door.
Forgotten infrastructure is the unsexy backbone of most major compromises. Not zero-days. Not nation-state sophistication. Just an old box that nobody owns anymore, still on the internet, still trusted by something.
The shape of the problem
It rarely looks like a breach in progress. It looks like a Friday afternoon in 2019, when a developer spun up a cloud instance to test something, then left. Or a merger in 2021 that orphaned a subdomain. Or a vendor you stopped paying three years ago, whose appliance still has a static IP and an open management port.
These systems are invisible to your dashboards because they were never on them. They don’t show up in your asset inventory because they were never tagged. They don’t page anyone because nobody wrote a monitor for them.
What “forgotten” actually means
It is a broad category, and most security teams are working on only one slice of it.
- Legacy servers: physical or virtual machines running unsupported operating systems. Windows Server 2008, RHEL 6, Debian 8. No patches, no fixes, no roadmap.
- Unpatched software: still-supported systems running software that has had a critical CVE for over a year. Log4Shell should have been the last time anyone had to learn this lesson. It was not.
- Abandoned cloud instances: AWS, Azure, and GCP accounts littered with resources nobody is paying for and nobody is monitoring. They still respond to the public internet.
- Orphaned subdomains: DNS records pointing to services that no longer exist, or worse, to services a third party now controls because the original IP was reassigned.
- Stale credentials: service accounts, API keys, and personal tokens belonging to people who left the company. Often with admin scopes. Still valid for years.
- Old vendor appliances: firewalls, VPN concentrators, and management consoles from vendors you no longer pay. The vendor may not even patch them anymore.
Why it keeps working for attackers
Attackers do not need a novel exploit. They need a known one, in a system nobody is watching. The economics are brutal for the defender: you have to find and patch every forgotten box, and the attacker only has to find one.
Mass scanning the entire IPv4 address space takes hours. Once they find a foothold, lateral movement into the rest of your environment is the easy part, because the forgotten box is usually trusted by something that is not forgotten.
What to actually do about it
This is not a budget problem. It is an inventory problem, then a process problem.
- External attack surface scan, monthly. Tools like Shodan, Censys, runZero, or your preferred ASM platform. Find what is exposed that you did not know about.
- Asset inventory with owners. Every external system needs a name, a team, and a decommission date. If a system has no owner, it has no future.
- Quarterly “is this still alive” review. Pick a sample of long-lived systems. Ask the team: do you still need this? If the answer is silence, decommission it.
- Strict cloud account hygiene. Tag everything. Anything without a tag is a candidate for deletion on a schedule. Rotate service account keys.
- DNS as a first-class concern. Audit your DNS records. Subdomain takeover is a 1990s vulnerability that still works in 2026 because nobody is watching the zone file.
The AI hype will keep generating headlines. The attackers will keep using the oldest trick in the book: a forgotten box with a known CVE. The teams that fix this category of problem will have a quieter, less dramatic year, and a much safer one.
That is a trade worth making.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
