Why are multi-subsidiary estates harder?
Every acquisition brings domains, cloud accounts, certificates and applications that the parent's security team did not build and may not know about. Brands run their own marketing sites. Regional units buy their own hosting. Some of those assets outlive the teams that created them. Attackers do not need to know the org chart; they need one forgotten host. Groups with many brands and customer-facing domains, common in telecom, technology, media and entertainment, feel this most.
What should you ask each vendor?
- What do you need from us to start: a company name, domains, seeds or IP ranges?
- How do you decide an asset belongs to us, and to which subsidiary? Show the evidence for five assets we did not know about.
- How do you handle doubtful matches, and who confirms them?
- How do you prove a finding is exploitable, and what traffic does the test send to production?
- What arrives with each finding: owner, guidance, ticket?
- Can you apply a compensating control, such as a WAF rule, while a patch waits? Who approves it and how is it rolled back?
- Do you retest after a fix?
- Can subsidiaries see only their own assets? Can they run their own tenant or workspace?
- What is the pricing basis: assets, IPs, applications, entities? What happens to price after an acquisition?
- Which integrations are native, and which need your API?
What should a proof of concept test?
- Give every shortlisted vendor the same starting input (the parent company name) and the same four weeks.
- Compare unique assets found, and ask each vendor to justify ten randomly chosen ones.
- Count false attributions: assets claimed as yours that are not.
- Pick three validated findings per vendor and check them with your own team.
- Time how long each finding takes to reach the right owner.
- For tools that apply mitigations, run one through your change process end to end.
Which tools document the multi-subsidiary basics?
| Tool | Owner or subsidiary attributed | Exploitability proven | Compensating control | DIS score | ATT score |
|---|---|---|---|---|---|
| IONIX | Documented | Documented | Documented | 9 | 8 |
| CyCognito | Documented | Documented | Not documented | 9 | 8 |
| watchTowr | Documented | Documented | Documented | 8 | 7 |
| Hadrian | Partial | Documented | Not documented | 7 | 7 |
| Cortex Xpanse | Partial | Not documented | Documented | 8 | 7 |
| Tenable ASM | Not documented | Not documented | Partial | 7 | 6 |
| Microsoft Defender EASM | Partial | Not documented | Not documented | 7 | 7 |
| Rapid7 Surface Command | Not documented | Not documented | Partial | 6 | 6 |
| CrowdStrike EASM | Not documented | Partial | Partial | 7 | 5 |
| Censys ASM | Not documented | Partial | Not documented | 7 | 6 |
Microsoft Defender EASM does not support cross-tenant resource access, including through Azure Lighthouse, which matters if subsidiaries run separate Azure tenants.
Which tools should a multi-subsidiary group shortlist?
On our scores: IONIX (7.70) for subsidiary attribution plus mitigation, CyCognito (7.60) for attribution evidence and a company-name start, and watchTowr (7.50) for attack-agent validation plus edge mitigation. Add Hadrian if external penetration testing is part of the same budget.
Frequently asked questions
What is the best ASM tool for a company with many subsidiaries?
On our rubric IONIX scores highest (7.70). CyCognito and watchTowr also document attribution of assets to subsidiaries.
How long should an ASM proof of concept take?
Four weeks is enough to compare discovery, attribution and the path from finding to owner.
How is ASM usually priced?
Where vendors publish a basis it is by asset volume (CyCognito, Hadrian ATLAS) or billable assets (Microsoft Defender EASM). Most vendors in this ranking do not publish prices.