Network inventory system having a plurality of computers which form network end points (110, 120, 130) in a computer network, wherein each network end point (110, 120, 130) comprises at least one interface (111, 112, 213) to the computer network, which interface is assigned a network address (IP1, IP2, IP3) and a physical address (MAC1, MAC2, MAC3); and an inventory server for inventorying the computer network, wherein an initial number of network end points of the computer network is known to the inventory server, wherein the inventory server is configured to receive the following network information from the network end points known to it: the respective network address (IP1, IP2, IP3) and physical address (MAC1, MAC2, MAC3) of the at least one interface (111, 112, 213) of the known network end points, interfaces (121, 331) with an associated network address and physical address of further network end points (120, 330) of a subnetwork reachable for the known network end points via an Open Systems Interconnection, OSI, layer 2 protocol, network addresses of interfaces (131, 421, 511), reachable for the known network end points, of further network end points (130, 420, 510) which are outside the subnetwork reachable for the known network end points via an OSI layer 3 protocol, and to determine new network end points (120, 130, 330, 420, 510) which are not among the known network end points on the basis of the received network information, to add the newly determined network end points (120, 130, 330, 420, 510) to the known network end points and to gradually determine further new network end points of the computer network, wherein the inventory server is also configured: to create an ACTUAL list containing interfaces (111, 112, 213) of known network end points on the basis of the received network information relating to the known network end points and to create an inventory of the computer network on the basis of a comparison of the ACTUAL list with a whitelist and a blacklist, wherein the whitelist comprises network addresses which fall in a predefined range of network addresses, and wherein the blacklist comprises network addresses which are outside a predefined range of network addresses and network addresses of threats which have already been identified. the respective network address (IP1, IP2, IP3) and physical address (MAC1, MAC2, MAC3) of the at least one interface (111, 112, 213) of the known network end points, interfaces (121, 331) with an associated network address and physical address of further network end points (120, 330) of a subnetwork reachable for the known network end points via an Open Systems Interconnection, OSI, layer 2 protocol, network addresses of interfaces (131, 421, 511), reachable for the known network end points, of further network end points (130, 420, 510) which are outside the subnetwork reachable for the known network end points via an OSI layer 3 protocol, and to create an ACTUAL list containing interfaces (111, 112, 213) of known network end points on the basis of the received network information relating to the known network end points and to create an inventory of the computer network on the basis of a comparison of the ACTUAL list with a whitelist and a blacklist, wherein the whitelist comprises network addresses which fall in a predefined range of network addresses, and wherein the blacklist comprises network addresses which are outside a predefined range of network addresses and network addresses of threats which have already been identified.