Security testing for group companies and multi-entity organisations
One security programme across every subsidiary, with per-entity isolation, consolidated findings, and a posture score you can compare between business units.
RedStrike is a continuous security testing and cloud posture platform for holding companies, groups, and organisations made of multiple operating entities. Each entity is a workspace with isolation enforced by PostgreSQL row-level security, while findings across entities are de-duplicated and ranked centrally. Cloud posture is scored per compliance framework, so a group can compare subsidiaries on the same scale instead of collecting incomparable reports from each.
The problem
Why group-level security reporting rarely adds up
Each subsidiary buys its own tools, runs its own tests, and reports in its own format. The group gets a stack of documents that cannot be compared.
Acquisitions arrive with unknown estates
A newly acquired company brings cloud accounts, domains, and applications nobody at group level has inventoried, and the integration plan rarely starts with a security baseline.
Every entity reports differently
Different tools, different severity scales, and different reporting cadences make a group-level view an exercise in manual reconciliation rather than a dashboard.
Isolation and oversight pull in opposite directions
Entities must not see each other's findings, but the group needs a consolidated view. Most tooling supports one of those, not both.
Regulatory scope varies across the group
One subsidiary is in NIS2 scope, another handles card data, a third is EU-only. A single framework applied everywhere is either too much for some or too little for others.
How RedStrike helps
Per-entity isolation with group-level consolidation
The multi-tenancy this needs is the platform's core architecture, not an add-on.
Workspace isolation per entity
Each subsidiary is a workspace with row-level security policies in PostgreSQL scoping every query, so one entity's users cannot reach another's findings, targets, or credentials.
Consolidated, de-duplicated findings
Findings are correlated and de-duplicated across tools and accounts, so a shared component's vulnerability appears once with the entities it affects rather than once per scan.
Per-framework posture scoring
Cloud posture is scored by compliance framework, giving a comparable number per entity instead of prose reports that resist comparison.
Attack surface discovery for new entities
Subdomain enumeration and service discovery build an inventory of what an acquired company actually exposes, which is usually more than its documentation says.
SAML, SCIM, and custom roles
Single sign-on with SAML, SCIM provisioning, and custom roles map platform access onto your group's identity model, with audit logging recording access.
Many cloud accounts, one view
Scoped read-only role delegation rolls out across an AWS Organization, multiple Azure subscriptions, or many GCP projects without collecting a single long-lived key.
Compliance coverage
Which frameworks this maps to — and exactly how far the mapping goes
Different entities can be scored against different frameworks. Cloud rulesets labelled to a framework run on AWS; Azure and GCP accounts are graded against CIS Foundations benchmarks.
| Framework | Edition mapped | Cloud coverage |
|---|---|---|
| ISO/IEC 27001ISO/IEC | 2022 | Native cloud-resource checks on AWS. Azure and GCP are graded against CIS benchmarks instead. |
| SOC 2AICPA | 2017 | Native cloud-resource checks on AWS. Azure and GCP are graded against CIS benchmarks instead. |
| NIS2European Union | 2022/2555 | Mapped on findings from application, API, and network testing. No native cloud-resource checks — pair with CIS benchmark grading for cloud evidence. |
| GDPREuropean Union | 2016/679 | Native cloud-resource checks on AWS. Azure and GCP are graded against CIS benchmarks instead. |
| PCI DSSPCI Security Standards Council | 4.0.1 | Native cloud-resource checks on AWS. Azure and GCP are graded against CIS benchmarks instead. |
| NIST SP 800-53NIST | r5 | Native cloud-resource checks on AWS. Azure and GCP are graded against CIS benchmarks instead. |
Every cloud account is graded against CIS Foundations benchmarks on AWS, Azure, GCP, and Kubernetes clusters against the CIS Kubernetes benchmark, regardless of which frameworks above apply to you. Evidence can be exported as a report or pushed into Vanta or Drata.
How it works
From connected to evidence in four steps
Define scope
Add the domains, APIs, and cloud accounts in scope, with rules of engagement recorded before any test runs.
Test continuously
Application, API, network, container, and cloud checks run on a schedule instead of once a year, so drift is caught within a scan cycle.
Verify & de-duplicate
Findings from multiple tools are correlated into one issue, evidence is collected, and severity is scored so the list you read is the list that matters.
Export evidence
Results are mapped to framework controls and exported as a report, or pushed into Vanta or Drata.
Outcomes
What changes once this is running
- Give every entity its own isolated workspace while the group keeps a consolidated view.
- Baseline an acquisition's real exposure in days rather than waiting for its next annual test.
- Compare subsidiaries on the same per-framework posture score instead of reconciling formats.
- Apply the frameworks each entity is actually in scope for, not a lowest common denominator.
- Roll out read-only cloud access across many accounts without distributing long-lived keys.
Related
Go deeper on the parts that matter to you
Continuous Pentesting
Always-on, verified offensive testing across apps, APIs, and network — not a once-a-year snapshot.
Learn more →Cloud Security (CSPM)
CIS-benchmarked posture across AWS, Azure, and GCP, with drift caught inside a scan cycle.
Learn more →Compliance
How findings become control-mapped audit evidence, and which editions are pinned to your engagement.
Learn more →FAQ
Frequently asked questions
Common questions about RedStrike for Group Companies.
How does RedStrike separate subsidiaries?
Each entity is a workspace inside an organisation, with PostgreSQL row-level security policies scoping every query by organisation. Isolation is enforced at the database layer rather than by application code, and cloud credentials are encrypted at rest with Fernet.
Can the group see across entities while entities cannot see each other?
Yes. That asymmetry is the point of the workspace model: entity-level users are scoped to their workspace, while group-level roles can be granted a consolidated view. Custom roles and audit logging are available on the Enterprise plan.
How quickly can we baseline an acquisition?
Attack surface discovery — subdomain enumeration, service fingerprinting, TLS testing — builds an inventory of exposed assets without needing cooperation from the acquired team, and cloud posture grading starts as soon as a read-only role is in place. That is usually days rather than the months an annual testing cycle implies.
Can different entities be scored against different frameworks?
Yes. Framework selection is per engagement, so an entity in NIS2 scope, one handling card data, and one needing only SOC 2 each get the mapping that applies to them, while the group still compares them on cloud posture score.
Does it work across an AWS Organization?
Yes. Scoped read-only roles are rolled out across accounts, subscriptions, or projects, and audits run with short-lived assumed credentials. Findings are consolidated and de-duplicated across all of them.
What are the plan limits for a group?
Targets, cloud accounts, and cloud resources are metered per plan, with the Enterprise plan unlimited on all three plus seats and retention. Which plan fits depends on how many entities and cloud accounts you run.
One security programme across every entity in the group
Isolated per subsidiary, consolidated for the group, comparable on one scale.