How does discovery start? Company names, seeds and prebuilt inventories at five vendors

Why does the starting point matter?

If a tool needs a complete list of your domains and IP ranges before it starts, it will find what you already know plus a little more. If it starts from less, it has to work harder at attribution but can surprise you. For groups with subsidiaries and acquisitions, that difference is the point of buying discovery at all.

What does each vendor describe?

• CyCognito: "Starts from your organization's name. No IP ranges, no asset lists." It attributes assets to subsidiary, brand or business unit with a trace for each finding.
• Censys: customers add seeds in the console or through the API, and assets Censys finds beyond them appear under a Found by Censys tab.
• Microsoft Defender EASM: a prebuilt inventory for many organisations, plus recursive discovery from seeds, with each asset given a state such as Approved Inventory or Candidate.
• watchTowr: zero install, with assets mapped to subsidiaries, brands and M&A.
• IONIX: discovery with 13 techniques, reaching third- and fourth-party assets in the digital supply chain, and automatic attribution to subsidiary or business owner.
• Hadrian describes hourly or event-triggered scans and machine learning to confirm ownership; its starting inputs are not described on the pages we read.

What does this mean for a proof of concept?

Give every vendor the same starting information, record what each asked for, and keep a private list of assets you already know about. Then compare what each found on and off that list. Writing a proof of concept plan sets this out step by step.

What about attribution?

Starting from less means more doubtful matches. Ask each vendor to show why an asset was attributed to you and to which subsidiary, and how you reject a wrong match. The subsidiary check in the exposure finder uses what each vendor's pages say on this.