What is IPAM?
IP address management (IPAM) is the practice, and the software, for planning and tracking an organization's address space. An IPAM system records every subnet and VLAN, the site and team that own each range, what the range is for, and the state of each address: assigned, reserved, leased or free. Most IPAM tools integrate with DHCP and DNS, a combination usually sold as DDI, so they also know which device holds each lease and which names resolve to which addresses. A small office can manage with a spreadsheet. Larger networks use dedicated tools, from open-source NetBox to commercial DDI platforms and the IPAM services cloud providers offer for their virtual networks.
Why IPAM matters for security
- Scan coverage. A vulnerability scanner checks only the ranges it is given. Feeding its scope from IPAM means a subnet created for a new branch or cloud network is scanned once it exists, not whenever someone remembers to add it.
- Unknown devices. An address answering in a range IPAM marks as unused, or a lease to a MAC address no inventory record recognizes, points to hardware nobody signed off on, such as a rogue wireless router, a developer's lab box or an attacker's implant.
- Attribution. Alerts and logs name IP addresses, not people. IPAM, with its DHCP lease history, tells responders which device and owner held an address at the moment of the event.
- Clean decommissioning. Releasing a retired server's addresses and removing its DNS records keeps the next host from inheriting its firewall rules, and stops DNS records from dangling at resources that no longer exist.
Example: who had that address?
The SIEM flags connections to a known command-and-control server from 10.40.12.87 at 14:06 last Tuesday. That address sits in a DHCP pool and today belongs to a different laptop. The IPAM record for the range, with its lease history, settles the question:
10.40.12.87 lease 2026-10-20 08:12-17:44 MAC 3c:52:82:1a:9e:07 host LT-FIN-0219 site HQ-3F owner Finance IT
The responder now has a hostname to isolate and a team to call. Without that history the investigation would stall on an address that has changed hands since.
IPAM vs. DHCP vs. CMDB
DHCP hands out addresses and knows its current leases, but it knows nothing about statically addressed servers, network gear or cloud ranges. A CMDB tracks assets and their relationships but is rarely accurate about which address each one holds right now. IPAM sits between them as the authoritative map of the address space, and the three are most useful when they are reconciled against one another. IPv6 makes the map even more valuable: a single /64 subnet holds about 18 quintillion addresses, so sweeping it with a scanner is pointless, and records from IPAM, DHCPv6 and the routers' neighbor caches are how hosts get found.
IPAM on the CompTIA Security+ exam
IPAM appears in SY0-801 objective 4.3 as one of the ways to identify vulnerabilities, because it proves that scanning and monitoring cover the whole network. Wording such as "scans keep missing new subnets," "an authoritative list of every network range," "unexplained addresses appearing on the network" or "which device held this IP address when the alert fired" points to IPAM. Distractors include a DHCP server, which assigns addresses but is not a complete record of them; a CMDB, which tracks assets rather than address space; and a network discovery scan, which only finds live hosts in ranges it already knows about.