An asset inventory is a maintained list of the systems, software and components an organization runs, along with details such as versions, owners and locations. For patching, its value is that it lets you answer a simple question quickly: when a new vulnerability is announced, which of our systems use the affected software?
A useful inventory goes beyond physical servers. It can include virtual machines, containers and their base images, runtimes such as PHP or Node.js, web applications, hosting accounts and third-party dependencies. Each entry should show what is actually installed or running, and who is responsible for updating it.
An inventory is only as good as it is current. Systems get created without being recorded, old servers are forgotten, and recorded versions drift away from what actually runs. A listed version also does not prove a system is vulnerable or safe, because exposure depends on configuration, backported fixes and whether the affected component handles untrusted input. Treat the inventory as the starting point for investigation, not the conclusion.
To keep it useful, update it as part of normal change work, compare it against what scanning or discovery tools find, and assign an owner to each entry. When an advisory arrives, use the inventory to list candidate systems, then confirm each one directly by checking the running version and the vendor notice that applies to it.