The starting point decides the result
Asset discovery is the process of identifying what an organization has in operation. It looks like a tooling task and is, before that, a choice of premise.
Whoever starts from the existing inventory confirms the existing inventory. The scan leaves from the list, visits what the list says to visit, and returns a more detailed picture of the same set. What was left out stays out, now with a report saying everything is fine.
Whoever starts from the root domain finds something else. The question shifts from "what state are these assets in" to "which assets exist", and those two questions almost never return the same set.
Active and passive
Passive discovery observes what is already public: DNS records, issued certificates, the answers services give to whoever asks. It does not touch the target in a way it notices, so it needs no authorization and no maintenance window.
Active discovery interacts with the service to confirm what it is and what state it is in. It returns more precision and requires authorization, because it generates identifiable traffic.
The order that works is passive first, to draw the map, and active after, over what the map showed. Reversing it means spending interaction on assets you already knew about.
What "complete" means here
Nothing, and assuming otherwise is the most expensive mistake in the field.
The surface changes every week. A new subdomain goes live, a temporary environment comes up, a third-party service changes configuration. A complete inventory describes an instant, and the instant passes before the report is finished.
What you chase is growing coverage with continuous refresh, and the honest metric is the gap between what the official inventory records and what discovery finds. While that gap shrinks, the program works.
Finding is the easy part
What stalls the program is assigning.
Good discovery returns hundreds of assets nobody claims. With no owner, each one stalls: it does not become a ticket, does not enter a remediation cycle, and does not go offline, because turning something off requires someone to confirm nothing depends on it.
This is where most programs get stuck, not at the technical phase. A discovery tool solves the survey; attribution depends on connecting an asset to a department, and that connection is rarely written down anywhere.
Attack surface management treats discovery and attribution as the same step, precisely because separating them produces a list nobody executes.