Ghost Assets vs. Zombie Assets: What IT Teams Need to Know

The terms “ghost asset” and “zombie asset” get thrown around in IT circles, and they don’t always mean the same thing to everyone. This guide gives you plain definitions of ghost assets vs. zombie assets, what each one costs your team, and a practical way to find them before an auditor or a security incident does.

A ghost asset is on your books but not in your environment. It’s recorded as active, but it’s lost, stolen, disposed of or never returned.

A zombie asset is the reverse problem: it’s in your environment but your records don’t reflect reality. Either it was never recorded at all, or it’s recorded and still costing you money while doing nothing useful.

In short, ghosts make your inventory look bigger than it is. Zombies hide spend and risk your inventory can’t see.

There’s a third case that’s neither: an asset that’s recorded, present and in use, but with the wrong owner, location or status. Call it misrecorded. For example, a laptop that moved from one office to another without an update is misrecorded. It’s still yours and still working; only its record is out of date.

To classify any asset, ask two questions: is it in your records, and is it in your possession doing useful work?

Here’s how the two problematic asset types compare:

What are ghost assets and where do they come from?

Ghost assets are items your asset register lists as active and available that are no longer in your possession. On paper, they’re assigned, depreciating and covered. In reality, they’re gone.

In IT, ghost assets usually come from a handful of everyday gaps:

• Offboarding misses. An employee leaves, and their laptop, monitor or hotspot never comes back. The record still shows it assigned to them, or worse, to nobody.
• Loss and theft. A phone is left in a rideshare. The ticket gets closed, but the asset record never changes.
• Undocumented disposal. Old devices go to recycling or e-waste in a batch, and no one updates the register or tells finance.

One case looks like a ghost but isn’t: equipment that moved between offices, desks or people without a record update. During an audit it seems to vanish from one place and appear unrecorded in another. Classify it by where it actually is. It’s misrecorded, and the fix is updating the record, not writing it off.

The common thread is manual updates. When the register only changes when someone remembers to change it, ghosts pile up quietly. If your team still tracks assets in a spreadsheet, this is usually the first place it breaks down.

Auditors notice. Gartner’s May 2026 research on hardware asset governance points to inaccurate inventories and weak evidence of process control as the reasons hardware audits most often fail. Its guidance centers on three areas: keeping inventories accurate, documenting the asset lifecycle and controlling unauthorized devices. (Gartner, Don’t Fail Your Next Hardware Audit: A Blueprint for IT Infrastructure Asset Governance)

Ghost assets are the first of those three problems in its purest form.

What are zombie assets? Two definitions, one problem

Here’s where the terminology gets messy. In accounting, a zombie asset is something you physically have but never recorded. In IT operations, “zombie” usually means something that’s recorded and running but no longer does any useful work. IT teams deal with both, so it’s worth naming them separately.

Untracked zombies: in use, never recorded

These assets are alive and working in your environment, but your register has never heard of them. Common sources:

• A laptop bought on a department head’s corporate card
• A switch or access point a contractor installed during an office build-out
• Devices that arrived in a merger or acquisition and never got tagged
• SaaS tools employees signed up for with their work email

You can’t patch, secure, renew or retire what you don’t know you have. Gartner lists controlling unauthorized devices as one of the three pillars of passing a hardware audit for exactly this reason.

Undead zombies: recorded, running, doing nothing

These assets are on the books and still consuming budget, power or access, but they deliver no value. Think idle servers, forgotten virtual machines, broken laptops sitting in a closet while still insured and under warranty, licenses renewed for people who left and software seats nobody opens.

The classic research here comes from data centers. A widely cited 2015 study by Anthesis Group and Stanford’s Jonathan Koomey examined 4,000 servers and found about 30% were comatose, meaning they had done no useful computing in six months or more. A follow-up study of more than 16,000 physical servers and 32,000 virtual machines found a similar share of zombie VMs. (Anthesis Group: Zombie Servers – Hunting Down the Lost Capital)

The same pattern shows up in SaaS, and it’s riskier there. An account that belongs to a former employee is still a working login with valid credentials. Nothing about it looks suspicious to your security tools. File-sharing links, CRM seats and project management workspaces are frequent offenders because team leads often provision them outside IT’s offboarding checklist. (The Technology Press: The “Zombie” SaaS Audit)

Whether untracked or undead, the root cause is the same: your records don’t match what’s actually happening.

What ghost and zombie assets cost IT teams

It’s tempting to treat this problem as simply housekeeping, but inaccurate asset records can create three major issues:

Money

Ghost assets keep showing up in depreciation schedules, insurance coverage and, in some jurisdictions, property tax filings. You’re paying to account for equipment you no longer have.

Undead zombies are a running cost. Every unused license renewal, idle server and support contract on a retired device is spend with no return. Your finance team will care about this spend, which makes it a useful argument when you’re asking for budget approval for better tooling.

Security

A ghost laptop that walked out with a former employee may still hold company data and cached credentials. An untracked zombie is an endpoint that isn’t getting patches, isn’t enrolled in MDM and isn’t covered by your security policies. A former employee’s live SaaS login is an access path nobody is watching.

Audit and compliance

Auditors want to see that you know what you own, where it is and who has it, and that you can prove it with records. SOC 2 auditors, for example, look for documented control over assets from procurement through disposal, and gaps in offboarding recovery and disposal records are among the most common findings. We cover what auditors check in detail in Asset Lifecycle Management Compliance Best Practices.

Software audits raise the stakes further. Zombie installs you didn’t know about can push you out of license compliance, while ghost licenses on your books can make you think you have headroom you don’t.

How to find ghost and zombie assets in your environment

The fix is reconciliation: comparing your asset register against every other system that knows something about your assets. Each mismatch points to a ghost or a zombie. Here’s a cleanup process you can run this quarter.

1. Gather every source of truth. Export your asset register, your MDM device list (Jamf, Microsoft Intune or similar), your current HR roster, recent purchase records from finance and the app list from your identity provider (Entra ID, Google Workspace or Okta).
2. Find register entries with no recent check-in. Compare the register to MDM. Devices that haven’t checked in for 30 to 90 days are ghost candidates. Confirm each one before you write it off. If a device turns up in another office or with another person, it’s misrecorded: update its location and owner instead.
3. Find devices with no register entry. Compare MDM, network and purchase data back to the register. Anything that shows up in those systems but not in your records is an untracked zombie. Tag it and assign an owner.
4. Match assignments against the HR roster. Any hardware, license or account still assigned to someone who has left is either a ghost (the device is gone) or an undead zombie (the license or login is still live). Recover the device or revoke the access.
5. Check usage on licenses and accounts. Seats with no login in 90 days are undead zombies. Reclaim or cancel them before the next renewal.
6. Spot-check physically. Walk the highest-value or highest-risk categories, such as laptops, network gear and loaner pools, and scan tags to confirm location and condition.

If you’re doing this by exporting CSVs and comparing them in a spreadsheet, it works, but it’s slow and it’s out of date the day you finish. An ITAM platform that connects to your MDM and other systems can surface many of these mismatches as they happen.

How to prevent ghost and zombie assets

Cleanup is the just the first step. Keeping your number ghosts/zombies at zero requires a few habits:

• Tie assets to onboarding and offboarding. Most ghosts and many zombies start the day someone joins or leaves. Make asset assignment part of onboarding and asset return part of offboarding, with a checklist that doesn’t close until every item is back. In Reftab, offboarding tickets can open automatically on an employee’s leave date and list every item currently assigned to them for check-in. Here’s how to set up onboarding and offboarding in Reftab.
• Extend offboarding past hardware. Add the SaaS apps team leads provision on their own, like file-sharing, CRM and project tools, to the checklist alongside email and laptops.
• Tag at receiving, not at deployment. An asset that gets recorded the day it arrives can’t become an untracked zombie.
• Sync instead of retyping. Connect your asset records to MDM, HR and identity systems so changes flow in automatically.
• Set a reconciliation cadence. Quarterly works for most hardware. For software, reconcile before every renewal.
• Agree on disposal steps with finance. Every retired device should leave a record: who disposed of it, how and when.

Get your records that match reality

Ghost assets are on your books but not in your building. Zombie assets are in your building, or your cloud, but missing from your books or quietly draining budget. Both happen for the same reason: an asset register that only changes when someone remembers to change it.

Start with one reconciliation pass this quarter, fix your offboarding process, and you’ll remove most of the conditions that create both.

Our team of specialists is ready to discuss your setup. Book your free 30-min evaluation now.