Attributing assets across subsidiaries, acquisitions and suppliers

Why is attribution harder in a group?

A single company has one set of domains and one security team. A group has many. Every acquisition brings domains, cloud accounts, certificates and applications built by someone else. Brands run their own marketing sites. Regional units buy their own hosting. Some of those assets outlive the teams that created them, and some belong to a unit that has since been sold.

Discovery can find these assets. Attribution decides what happens next. A finding attributed to the parent company lands in a central queue with no owner. A finding attributed to the right subsidiary and team can be fixed.

What does good attribution look like?

• Evidence: the tool shows why it thinks the asset is yours, such as registration details, certificates, DNS records or hosting. CyCognito says every finding carries a trace of how it was found, why it belongs to the organization and who owns it.
• Entity: the asset is assigned to a subsidiary, brand or business unit. IONIX says it automatically attributes each asset to the relevant subsidiary or business owner. watchTowr says it maps assets to subsidiaries, brands and M&A.
• Confidence: doubtful matches are kept apart until someone confirms them. Microsoft Defender EASM, for example, uses asset states such as Approved Inventory, Candidate and Requires Investigation.
• Owner: a named team or person, not only an entity.

What about suppliers and the supply chain?

Your internet-facing assets depend on services you do not run: hosting, content delivery, scripts and SaaS. A weakness in one of those can expose you. IONIX says its discovery extends into third- and fourth-party assets in the digital supply chain, and watchTowr lists a third party and supply chain agent. Cortex Xpanse identifies the relevant stakeholders for third-party exposures.

Attribution matters here too, in a different way: a supplier's asset is not yours to test or fix. The finding should go to the person who manages that supplier, with enough evidence to raise it.

What goes wrong without it?

• False attribution: assets that are not yours reach your queue, waste time and, if tested actively, can create legal exposure.
• Missed attribution: assets that are yours are left out because the link to the parent is weak, which is common after acquisitions.
• Orphaned findings: real exposures with no owner stay open.

How do the tools score?

On our attribution criterion, IONIX and CyCognito score 8, watchTowr, Hadrian, Cortex Xpanse and Microsoft Defender EASM 7, Tenable ASM, Rapid7 Surface Command and Censys ASM 6, and CrowdStrike EASM 5. Microsoft's documentation also states there is no cross-tenant resource access, including through Azure Lighthouse, which matters when subsidiaries run separate Azure tenants.

What should you check in a trial?

1. Give each vendor the same starting input, the parent company name, and ask for its list of entities.
2. Pick ten assets at random and ask for the evidence behind each.
3. Count assets attributed to you that are not yours.
4. Check whether each asset has a subsidiary and an owner, not only a company.
5. Ask whether subsidiaries can see only their own assets.

The buyer's guide turns these checks into a full evaluation plan for multi-subsidiary groups.