A penetration test is only as complete as the scope it covers - and scope depends entirely on knowing what you have.
In practice, asset inventories are rarely as current or as complete as organisations assume. Subdomains registered for a project years ago and never decommissioned. Cloud instances provisioned directly by a development team and never formally documented. Acquired companies with infrastructure that was never fully absorbed. Service accounts and third-party integrations that predate the current IT team. All of it represents real attack surface, and none of it disappears from an attacker's view just because it dropped off an internal spreadsheet.
An external attack surface review - approaching your perimeter the way an unauthenticated attacker would - is often the most useful first step before structured testing. It establishes what is actually exposed, not just what is assumed to be. The findings frequently include assets the client had no idea were still resolvable, let alone accessible.
If your asset inventory hasn't been validated recently, that is the place to start.