Start with your organisation’s traces
Domains, applications, hosted services and previous locations can create a fragmented picture. Prepare known reference points, relevant entities and recent changes. Missing information may itself be part of the question to investigate.
Distinguish visibility from vulnerability
An accessible service is not automatically vulnerable. An observation needs attribution, context and sometimes verification. An exposure audit organises these findings; online investigations can help answer an information question; penetration testing is a separate step when exploitability must be tested.
Act on the observations
Ask for a usable inventory distinguishing confirmed assets, suspected relationships and out-of-scope elements. Involve technical owners in validation. Decisions about fixes or further tests should be explainable from this work.