# Subsidiary Oversight

URL: https://www.deepinfo.com/solutions/use-cases/subsidiary-oversight/

## See the Whole Group on One Scale.

A group’s attack surface is the sum of its subsidiaries, each with its own IT, its own vendors and its own idea of what counts as an asset. Subsidiary Oversight monitors each subsidiary, regional brand and acquired company as a portfolio, all scanned across one set of data layers and scored by one engine.

[Request demo](https://www.deepinfo.com/request-demo/)

Subsidiaries each count *their assets differently.*

Some subsidiaries run mature security teams, others have none. Every acquisition adds domains and hosts that never made it into anyone’s inventory, and group reporting turns into spreadsheets that can’t be compared.

### From the Parent Domain to a Group View.

1. **Discover**

   Start from the parent’s domains. Reverse lookups on registrant, name servers and mail servers surface the domains subsidiaries registered on their own, and your team approves what belongs to the group.
2. **Separate**

   Give each subsidiary a portfolio with its own inventory, issues and score. Tags mark business units, regions or brands inside a portfolio.
3. **Scan**

   All portfolios share the data layers, the issue states and the severity scale.
4. **Compare**

   Scores sit on one scale, so the group sees which entities carry the most risk and which way each one is moving.

### One Central View With Local Ownership.

#### Group Security

Scores, issues and trends for each subsidiary, compared directly, without asking anyone for a spreadsheet.

#### Subsidiary Teams

Findings for their own portfolio, with evidence and states. Nobody has to replace the tooling they already run.

#### Asset Owners

Notification rules scoped by asset or tag send each entity’s new issues, score drops and new assets to the people responsible for them.

#### Business Context

A weight on each asset records how much it matters to the business, so a payment platform stands apart from a campaign site.

### One Yardstick for Each Entity.

| Element | Across the group |
| --- | --- |
| Data layers | WHOIS, IP WHOIS, DNS, SSL, ports, web data and HTTP on every asset |
| Issue states | One set, from newly detected to verified resolved |
| Severity | Critical, High, Medium, Low, Information |
| Frameworks | OWASP Top 10 2021, PCI DSS 4.0 and 3.2, HIPAA, CWE, CAPEC, WASC |
| CVE ranking | CVSS, EPSS and CISA KEV together |
| Scores | One engine per asset, domain and portfolio, each with a timeline |

### Each Shared Supplier Is Scanned Once.

Subsidiaries often share suppliers, and some groups run internal service companies that serve the rest. [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) monitors those vendors as portfolios too, scanned like the subsidiaries.

A supplier that serves five subsidiaries is one portfolio with one score, not five questionnaires.

### Groups That Work This Way.

- [An industrial conglomerate](https://www.deepinfo.com/customers/industrial-conglomerate/) (Customer story): 30+ subsidiary brands monitored as separate portfolios, with rolled-up group dashboards.
- [A defense manufacturer](https://www.deepinfo.com/customers/defense-manufacturer/) (Customer story): The parent and all subsidiary brands under one platform, with the supplier network scanned the same way.
- [A national telecom operator](https://www.deepinfo.com/customers/telecommunications-national-operator/) (Customer story): Subsidiary and acquired infrastructure found by discovery and monitored as separate portfolios.

### Use This Data in Your Tools

Your tools can look up any company’s domains, subdomains and registration data through the API, from the index the Deepinfo Platform scans vendors with.

- [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/)
- [Associated Domain Finder API](https://www.deepinfo.com/data-api/apis/associated-domain-finder/)
- [Subdomain Finder API](https://www.deepinfo.com/data-api/apis/subdomain-finder/)
- [Domain WHOIS API](https://www.deepinfo.com/data-api/apis/whois-lookup/)

### Questions About Subsidiary Oversight

**Do subsidiaries have to change their tools?**

No. Monitoring runs from outside, on each subsidiary’s internet-facing assets, next to whatever tooling it already runs.

**How are subsidiaries found if they register domains on their own?**

Discovery pivots on what the parent and its subsidiaries share: registrant details, name servers, mail servers, IP addresses and certificate organization. Your team approves what belongs to the group.

**What if discovery proposes a domain that isn’t ours?**

Ignore it. Candidates wait in a queue until someone approves them, an ignored one stays out of monitoring with the decision kept, and any decision can be reverted if it turns out wrong.

**How does a new acquisition join?**

Add the acquired company’s primary domain as a new portfolio. If you assessed it during the deal, the inventory from [due diligence](https://www.deepinfo.com/solutions/use-cases/mergers-acquisitions-due-diligence/) is the starting point.

**How is pricing set for a group?**

Pricing depends on the scope you monitor across the group and the modules you use. See [pricing](https://www.deepinfo.com/pricing/), or ask for a scoped quote.

### See Your Group’s Full External Surface.

Start from the parent domain in a demo and see what discovery finds across the group.

[Request demo](https://www.deepinfo.com/request-demo/)