The existing tools stop
short of ownership

Overview

What the chain is made of, and why dependency becomes leverage.

Layers

Eight layers, eight owners, and one mostly empty column.

Control

Ownership changes without changing a line of code.

Boundary

Nine tools already in use, and where each one stops.

Mapping

Capture, resolution, attribution, and reconciliation.

Every organization reading this already runs a third-party program. Bills of materials, build attestations, control reports, posture scores, attack surface tooling: the reasonable first reaction to a new method is that one of these already covers it. Mostly they do not overlap with it at all, and it is worth being precise about why.

Every one of these was built for a question and answers it. The gap sits between them rather than inside any one of them.

Request a Briefing

The Coverage

Where each tool stops

Nine categories of existing standard and tool, from software bills of materials through to beneficial ownership screening, each with what it establishes and where its coverage stops, and a final highlighted row stating what this method adds.

The Toolbox

Each one answers the question it was built for

Read across any row and the tool is plainly fit for its purpose. The column that decides anything is the last one.

The build is well covered

Bills of materials record what went into an artifact. Provenance frameworks and signing establish that it was built and signed the way it claims. Dependency scanning checks declared components against known flaws. Between them the build is genuinely well served, and all of it describes the build. None of it describes what the finished thing reaches for once it is running, or who answers when it does.

Declarations are well covered, as declarations

Exploitability statements, sub-processor registers, data-processing agreements, and control reports are the supplier's account of itself: what it says a flaw does, who it says it uses, which controls it chose to have tested and on what date. All of that is worth having. The one thing an attestation cannot do is attest to its own completeness.

The browser allowlists domains

A content policy names the origins a page is permitted to use. An integrity attribute confirms that one specific file has not changed. Both do real work and both should be applied. Neither says anything about who operates an allowlisted origin, and a domain on an allowlist is a name rather than a party.

Posture is scored from the outside

Outside-in rating gives a company a number derived from observable signals. It is a reasonable proxy for hygiene, it is contested as a predictor of anything, and it begins with a company you can already name. Ownership, control, and the jurisdiction governing your data are not what it sets out to measure.

Infrastructure is discovered from the outside

This is the closest neighbour, and the honest one to name. Continuous external discovery finds assets and infrastructure without asking anyone for a list, which is the same instinct that drives this method. It stops at the operator: this asset belongs to that organization. Who owns that organization is not a question it was built to ask.

Ownership is resolved from a name

Beneficial ownership work is a mature discipline with serious data behind it, resolving parents, controllers, and sanctions exposure for a company. It begins with a company name. It has no way to begin with a host observed in a session, which is the only starting point available when the party was never disclosed to you.

The Gap

This work joins two disciplines that have never been joined

Set out that way the gap is narrow and specific. External discovery ends at the operator. Ownership resolution begins at a company name. Between them sits the step almost nobody takes: carrying an observed host through to the company behind the operator, and on to its owners and the law that governs what it does with your data.

Observing an application rather than trusting its vendor list is the founding premise of an entire category of tooling, and has been for years. The contribution here is what happens after the observation, and even that is borrowed rather than invented: the same know-your-customer and beneficial ownership tradecraft that regulated firms run every day, applied to a starting point that discipline has never used.

Ownership and jurisdiction answer a specific set of questions. How concentrated a dependency really is, once separate names collapse into common owners. Whether a provider sits under a legal regime that changes what your data is exposed to. Whether any party in the chain carries sanctions or control exposure you would not knowingly have accepted. They are not a prediction of whether a provider will be breached, and a method that claimed otherwise would deserve the skepticism such claims usually attract.

Vocabulary

These four terms are routinely used loosely

Loose use is not a matter of pedantry here. Concentration counted in vendors rather than in owners, or an attestation treated as provenance, produces a wrong answer rather than an imprecise one.

Nth-party

First party is you. Second is the supplier you contracted with. Third is the supplier they contracted with, and nth is however far the chain runs past that. Most programs are scoped to the second party and stop there. Most of the exposure is further down, which is the whole reason this work exists.

Concentration

Not an event but a structural condition: how much of what you depend on resolves back to the same small number of parties. It is invisible at the contract layer, where twenty suppliers look exactly like twenty suppliers, and it only appears once ownership has been resolved.

Substitutability

What concentration actually costs. A dependency you could replace inside a week is a sourcing question. The same dependency with nothing available to replace it is a decision about the business. The difference has nothing to do with how well the provider scores on anything.

Provenance and attestation

Provenance is the record of where something came from. An attestation is a signed claim made about it. The two are used interchangeably and they are not the same thing: a claim can be perfectly verifiable, cryptographically sound, and made by a party you should never have trusted.

An undisclosed provider is usually not a concealed one

Reconciliation produces gaps, and how those gaps are read matters. Disclosure across this industry is incomplete as a matter of course rather than as a matter of intent. One 2026 review of 2,400 technology vendors found that 63.6% did not disclose sub-processing by AI providers in their own assessments; a 2026 survey of bill-of-materials adoption found that 78% of organizations never or rarely receive one from a commercial supplier at all. Against that baseline, a provider that appears in the evidence but not in the paperwork is far more often a gap in the disclosure than an act of concealment. What the finding establishes is that the exposure is unreviewed, which is worth acting on either way. Reporting it as bad faith would be unfair, and in most cases simply wrong.

The method starts where these tools stop

Capture what an application actually reaches, resolve each host to an operator and each operator to a company, attribute the owners and the jurisdiction, and set all of it against what was declared. The write-up includes how a host is resolved, and what happens on the ones that never resolve past the infrastructure in front of them.

Read the method