All the pen testing and tabletop exercises in the world won't help unless an organization has a complete and accurate understanding of its assets.