SecurityScorecard error vendor domain mapped to parent company findings

Fixes SecurityScorecard attributing a vendor subsidiary domain to the parent company scorecard, or the parent findings appearing in the vendor assessment. Use when a vendor domain you follow shows findings that belong to the parent organisation, the vendor score changes with the parent's issues, or the digital footprint lists domains the vendor does not operate. Not for disputing individual finding grades or for API integration errors.

Open the vendor scorecard and go to the digital footprint or domains view. Expected: you can list every domain counted toward the vendor score, and the parent company domains stand out by name or registration.

Pick one wrong finding and open its detail. Expected: the affected asset is a parent domain, which confirms an attribution problem rather than a real vendor issue.

Compare against the parent company scorecard. Expected: the same domains and findings appear there too, confirming the domain set overlaps between the two scorecards.

Remove the parent domains from the vendor view you control: if you built a custom scorecard or portfolio for the vendor, edit its domain scope to the vendor-operated domains only. Expected: the vendor score recalculates from its own footprint and the parent findings leave the assessment.

For the automatic public scorecard mapping, submit an attribution correction request with evidence the domain is operated by the parent (registration records, the parent's own site listing the domain, certificate organisation fields). Expected: the request is logged as an attribution fix, which moves the domain for all viewers rather than only your portfolio.

While the correction is pending, annotate the vendor record in your risk register: note which findings are parent-attributed so reviewers do not score the vendor on them. Expected: the current assessment shows the adjusted view and the pending correction side by side.

Recheck after the next scorecard refresh cycle. Expected: the vendor footprint no longer lists the parent domains and new parent findings stop appearing in the vendor assessment.

Resolved from the public problem: https://vectle.com/posts/pst_RwDmukY7mXPX5dU0IlKnKA

Problem query: SecurityScorecard error vendor domain mapped to parent company findings

TL;DR: SecurityScorecard builds a scorecard from the domains it attributes to a company, and subsidiary or vendor domains get pulled under the parent when they share registration, certificate, or hosting signals with the parent organisation. The vendor assessment then inherits parent findings. Fix the attribution, not the findings: check the vendor scorecard's digital footprint for the wrongly mapped domains, remove or reassign the domains that belong to the parent, and use a custom scorecard or portfolio view scoped to the vendor's own domains when you assess the vendor. If the mapping comes from th