A best practice for threat assessments within the seven domains of a typical IT infrastructure is "Assume nothing, recognizing that things change." What do you think "assume nothing" means in this context?

A best practice for performing vulnerability assessments within the seven domains of a typical IT infrastructure is to identify assets first. Why should you identify assets before performing vulnerability scans?