We document a lot of environments that nobody has looked at properly in years. The findings are remarkably consistent — which is either reassuring or alarming, depending on how you read it.
Here’s what actually turns up.
Nobody knows what’s installed
Almost every first audit produces at least one device nobody could account for. An old switch in a ceiling void. A wireless access point still broadcasting a network from a previous tenant. A computer under a desk that turns out to be running something important.
You can’t secure or maintain what you don’t know exists.
Cabling that was never labelled
Untraceable cable is the most expensive small problem in IT. Every future job — moving a desk, adding a camera, diagnosing a dead port — starts with someone spending an hour working out what connects to what. Labelling costs almost nothing at install time and is tedious to retrofit.
Default credentials still in place
Routinely. Switches, access points, cameras, recorders. Often the network gear was installed by whoever ran the cable, who had no reason to think about it afterward.
Backups that have never been restored
Nearly everyone has a backup. Far fewer have ever tested one. We find backups that have been silently failing for months, backups running on a schedule nobody adjusted after the data moved, and backups going to a drive sitting next to the server they’re protecting.
An untested backup is a hypothesis, not a safety net.
Software past end of support
Usually one machine running something the business depends on, which nobody has updated because it works and touching it feels risky. It’s a legitimate constraint. It’s also an unpatched system on your network, and it needs to be isolated if it can’t be replaced.
Licenses paid for and not used
Subscriptions for departed staff. Two products doing the same job because one was bought and forgotten. This is the finding clients are most pleased about, because it often offsets part of the audit fee.
A flat network
Everything on one segment. Guest devices able to reach the server. Cameras on the same network as the payment terminals. It’s the default state of any network that grew organically, and it’s the finding with the most serious consequences.
Why this is worth knowing
None of these are exotic. They’re the predictable result of infrastructure that grew over years with different people touching it and nobody writing anything down.
The point of documenting them isn’t to alarm you — it’s that you can’t prioritize what you can’t see. That’s what Groundwork is for: a written picture of what you actually have, with a fix list sorted by what matters.