CMDB
A configuration management database, or CMDB, is the record of an organisation’s configuration items and, more importantly, the relationships between them. In security work it is what turns a list of hosts into a map: which service depends on which database, which application a certificate belongs to, and who owns the result.
The distinction from an asset inventory is the relationships. An inventory answers what exists; a configuration management database answers what breaks if this is taken offline, what else holds the same credential, and which business service a compromised host belongs to. That is the difference between knowing you have a finding and knowing what it costs.
Its reputation is poor for a reason: populated by hand, it is wrong within weeks, and a database that is confidently wrong is worse than an empty one because decisions get made from it. The ones that stay accurate are fed by discovery and by the deployment pipeline, and treat manual entry as an exception that needs justifying.
Two moments expose its real state. The first is incident response, when someone has to say within minutes which systems depend on a host that is about to be isolated. The second is asking which business service an IP range supports, when the answer takes days to assemble. When that happens, we record it as an observation about the estate, because it is a reliable predictor of how long containment will take when it is needed for real.