Most âhardware auditsâ are glorified headcounts. Someone walks around with a clipboard, confirms what you already know, and sends an invoice.
What you actually need is not an asset list. You need a liability map.
This is a practical way to surface risk, waste and obsolescence in a single afternoon, using tools you already trust. No procurement theatre. No slide deck.
What we would say is, you might want to discuss this with your friendly IT expert. This is a handy checklist, but it will mean more to someone with a little inside knowledge. đ
Why your asset register canât be trusted
Because it only shows what was bought, not what is still active.
Devices move desks, get forgotten, or quietly reconnect themselves to Wi-Fi. The only reliable view of reality is the network itself. If something has an IP address, it exists and it matters.
How do you find âghostâ devices on your network?
By scanning the subnet, not the cupboard.
Download a lightweight scanner such as Advanced IP Scanner or Angry IP Scanner and run it against your main subnet.
What we usually see:
- Generic names like EPSON-XXXX or Unknown Device that nobody can assign to a person.
- Old printers or personal phones still connected to corporate Wi-Fi.
- Devices responding on HTTP that are not recognised servers.
Any unowned device is not neutral. It is unmanaged risk.
What makes a device a âshadow serverâ?
Ports, not performance.
If something on your network responds on port 80 or 443 and it is not a known application, it deserves scrutiny. In practice these turn out to be routers, NAS boxes or cameras running default credentials.
From an attackerâs point of view, these are gifts.
How do you tell if your PCs are actually 2026-ready?
Ignore the sticker.
CPU branding stopped being a useful signal. What matters now is whether the machine can handle local AI workloads without choking.
On a sample of your oldest and newest machines:
- Open Task Manager.
- Go to the Performance tab.
- Look for an NPU graph.
If it is missing, that device will struggle with future OS and productivity updates, regardless of how âfastâ it once felt.
Why are printers still such a big security problem?
Because they sit quietly and never get checked.
Type the IP address of your main printer or MFD into a browser. Two quick tells usually appear:
- If the page loads over HTTP instead of HTTPS, credentials and data are moving in plain text.
- If admin/admin works, you do not have a configuration issue. You have a crisis.
Also check SNMP. Anything running v1 or v2 should be disabled. Only v3 is fit for purpose now.
What does firmware age actually indicate?
Support, not just features.
If the last firmware update predates 2024, the manufacturer has likely moved on. That means vulnerabilities will remain vulnerabilities. This is where printers quietly become entry points rather than tools.
How do you spot energy waste without spreadsheets?
Turn the lights off.
At the end of the day, walk the floor. Blinking lights tell stories. Switches, monitors and printers drawing power when nobody is there are costing you every night.
Under desks, you will often find personal heaters, fans or daisy-chained power strips. These are not only expensive to run. They are a fire risk and a sign the workspace was never properly provisioned.
How do you tell how old a PC really is?
Ask the BIOS, not Accounts. And if you don’t know what this means, ask your IT expert to ask the BIOS! It can get messy in there!
Windows will not show purchase dates, but the BIOS release date is a good proxy for manufacture. Run this in PowerShell:
Get-CimInstance Win32_BIOS | Select-Object Manufacturer, SMBIOSBIOSVersion, ReleaseDate
If that date is pre-2021, the machine is almost certainly out of warranty and missing security capabilities expected by current operating systems.
Turning findings into action without analysis paralysis
Do not build an upgrade wish list. Build a kill list.
In practice, the priorities are blunt:
- Any device relying on SMBv1 or SNMPv1.
- Any PC with a BIOS date before 2021.
- Any printer that still accepts default admin credentials.
Removing these does more for security and productivity than buying shiny replacements at random.
The discipline most teams skip
If I were doing this internally, I would treat this audit as recurring hygiene, not a one-off project.
Once you know how to surface liabilities yourself, you stop paying for reassurance and start making deliberate trade-offs. That is usually the point where hardware spending becomes calmer, smaller and far easier to defend.
