WEEK 33 · FORWARD MOVES

Name an owner for everything that entered your environment in the last 90 days.

Your inventory describes what got onboarded. The exposure arrived after that.

Submitted by Neil Watkins · MondayMove

Every security program has a front door with a procurement process behind it. It also has a side door, and the side door is a corporate card under the approval threshold.

Ownership gets assigned at two moments. Once at procurement, when the paperwork forces somebody to put a name in a field. And once after an incident, when the room needs a person who can answer the question. Everything landing between those two moments runs with nobody attached, and the last ninety days are almost entirely made of that middle.

Watch how it happens. A product manager expenses an AI writing assistant that never crossed a procurement desk. Marketing connects a new analytics platform to the CRM through an OAuth grant that nobody in security ever reviewed. A contractor gets access on a Tuesday for a six week engagement, wraps up in four, and keeps the account because offboarding never became anyone's ticket. Three new things in the environment. Zero names.

Your asset inventory won't surface any of it. Inventories describe what got onboarded, and the last ninety days haven't been onboarded yet.

Most teams read this as shadow IT and reach for tooling. Scan the OAuth grants, stand up the CASB, produce a ranked list of unsanctioned apps, forward it to the business, feel productive. The scan finds the tools. It doesn't find the missing name, and the name is the control.

Think about what actually happens to a system with nobody attached. Patching lives on somebody's calendar, so it doesn't get patched. Access reviews route to an owner of record, so nobody reviews it. Logging never gets configured. And it stays running forever, because switching something off requires a person willing to say out loud that it isn't needed anymore. Every control you run assumes a name exists upstream of it. Where the name is blank, the whole stack quietly no-ops.

That's why the ninety day window matters more than the full inventory. Old unowned systems are a known problem and someone has probably already written a ticket about them. New unowned systems are still growing dependencies. The AI tool marketing adopted in June has ten weeks of prompts in it and two integrations you haven't seen. Give it another two quarters and it stops being a cleanup task and starts being a migration project.

So, here's the MondayMove

Open a ninety day window. List every new SaaS subscription, AI tool, OAuth grant, and contractor account that entered your environment inside it, then write a named human beside each one. Every blank you leave is the finding.

Go find the blanks. That's the only column on the sheet that matters this week.

Friday Follow-Up

The blanks you won't fill.

Finding the unowned things is the easy half. Getting somebody to accept the name is where this stalls.

Submitted by Neil Watkins · MondayMove

August 14, 2026

MondayMove gives you one concrete action every Monday. FridayFollowUp closes the loop.

Each Friday, a short dispatch on what practitioners actually found when they ran the week's move: where they got stuck, what surprised them, and what to do next. Not sanitized case studies. Field notes. Practitioner to practitioner.

Monday's move was to list everything that entered your environment in the last ninety days with no security owner attached, and put a name beside each row.

My guess is the list came together faster than you expected. SSO, the expense system, and the OAuth consent log cover most of it between them. An afternoon, maybe two.

Then you tried to assign the names, and everything slowed down. The person who signed up left in April. The tool belongs to a team, and a team is not a name. The department head says software is IT's problem, IT says whoever bought it owns it, and neither of them is being difficult. There's no established answer, and you're the first person who's asked for one out loud.

Watch for this one specifically. Somebody accepts ownership in a meeting to make the question go away, you write the name down, and the row feels closed. Verbal acceptance is worth roughly nothing in November. If the name never lands somewhere that surfaces it at review or renewal, you had a pleasant conversation.

The AI rows will behave differently from everything else. A SaaS tool has a contract, a bill, and a fairly obvious owner once you push. An assistant somebody has been feeding internal documents since April has none of that, and the person using it may not think of it as a system at all. Expect that conversation to run long and surface something about data you weren't looking for this week.

So take one blank row with real reach and force it by Friday. Go to whoever benefits from the tool and give them two doors: accept the name, or agree it goes dark in thirty days. Don't offer a third. The third door created the blank.

Then write down which rows you couldn't force, and why. The tools go stale within a quarter. The reason nobody would take the name is structural, and it'll still be there next year.

Send me that second list. It's the one worth reading.

Keep going. See what a week can do.

No correct answers here. This is practitioner-to-practitioner. The more honest the responses, the more useful this gets for everyone reading on Monday morning.

See you then.

Discussion