Request demo

Subsidiary Oversight

See the Whole Group on One Scale.

A group’s attack surface is the sum of its subsidiaries, each with its own IT, its own vendors and its own idea of what counts as an asset. Subsidiary Oversight monitors each subsidiary, regional brand and acquired company as a portfolio, all scanned across one set of data layers and scored by one engine.

Request demo

Parent domain

acme.example

Found through registrant name servers mail servers

  1. acme-eu.example

    approved

  2. acme-energy.example

    approved

  3. acquired-co.example

    approved

Subsidiaries each count their assets differently.

Some subsidiaries run mature security teams, others have none. Every acquisition adds domains and hosts that never made it into anyone’s inventory, and group reporting turns into spreadsheets that can’t be compared.

From the Parent Domain to a Group View.

  1. 01

    Discover

    Start from the parent’s domains. Reverse lookups on registrant, name servers and mail servers surface the domains subsidiaries registered on their own, and your team approves what belongs to the group.

  2. 02

    Separate

    Give each subsidiary a portfolio with its own inventory, issues and score. Tags mark business units, regions or brands inside a portfolio.

  3. 03

    Scan

    All portfolios share the data layers, the issue states and the severity scale.

  4. 04

    Compare

    Scores sit on one scale, so the group sees which entities carry the most risk and which way each one is moving.

One Central View With Local Ownership.

Group Security

Scores, issues and trends for each subsidiary, compared directly, without asking anyone for a spreadsheet.

Subsidiary Teams

Findings for their own portfolio, with evidence and states. Nobody has to replace the tooling they already run.

Asset Owners

Notification rules scoped by asset or tag send each entity’s new issues, score drops and new assets to the people responsible for them.

Business Context

A weight on each asset records how much it matters to the business, so a payment platform stands apart from a campaign site.

One Yardstick for Each Entity.

ElementAcross the group
Data layersWHOIS, IP WHOIS, DNS, SSL, ports, web data and HTTP on every asset
Issue statesOne set, from newly detected to verified resolved
SeverityCritical, High, Medium, Low, Information
FrameworksOWASP Top 10 2021, PCI DSS 4.0 and 3.2, HIPAA, CWE, CAPEC, WASC
CVE rankingCVSS, EPSS and CISA KEV together
ScoresOne engine per asset, domain and portfolio, each with a timeline

Each Shared Supplier Is Scanned Once.

Subsidiaries often share suppliers, and some groups run internal service companies that serve the rest. Third-Party Risk Management monitors those vendors as portfolios too, scanned like the subsidiaries.

A supplier that serves five subsidiaries is one portfolio with one score, not five questionnaires.

  1. acme.example

    Yours · your own surface

    A

  2. Subsidiaries

  3. acme-energy.example

    B

  4. acme-retail.example

    A

  5. acme-logistics.example

    C

  6. acme-eu.example

    B

  7. Shared suppliers

  8. payroll.example

    Score fell C → D · RDP exposed

    C→D

  9. cloud-hosting.example

    A

  10. law-firm.example

    B

  11. cdn-provider.example

    A

  12. call-center.example

    C

Groups That Work This Way.

Customer story An industrial conglomerate 30+ subsidiary brands monitored as separate portfolios, with rolled-up group dashboards. Read Customer story A defense manufacturer The parent and all subsidiary brands under one platform, with the supplier network scanned the same way. Read Customer story A national telecom operator Subsidiary and acquired infrastructure found by discovery and monitored as separate portfolios. Read

Use This Data in Your Tools

Your tools can look up any company’s domains, subdomains and registration data through the API, from the index the Deepinfo Platform scans vendors with.

Questions About Subsidiary Oversight

Do subsidiaries have to change their tools?

No. Monitoring runs from outside, on each subsidiary’s internet-facing assets, next to whatever tooling it already runs.

How are subsidiaries found if they register domains on their own?

Discovery pivots on what the parent and its subsidiaries share: registrant details, name servers, mail servers, IP addresses and certificate organization. Your team approves what belongs to the group.

What if discovery proposes a domain that isn’t ours?

Ignore it. Candidates wait in a queue until someone approves them, an ignored one stays out of monitoring with the decision kept, and any decision can be reverted if it turns out wrong.

How does a new acquisition join?

Add the acquired company’s primary domain as a new portfolio. If you assessed it during the deal, the inventory from due diligence is the starting point.

How is pricing set for a group?

Pricing depends on the scope you monitor across the group and the modules you use. See pricing, or ask for a scoped quote.

See Your Group’s Full External Surface.

Start from the parent domain in a demo and see what discovery finds across the group.

Request demo