What is Censys?
Censys is an Internet intelligence platform built on its own continuously updated map of the Internet. It records IP addresses, ports and services, TLS certificates, websites and DNS, and lets you search that data to see what is exposed, how a host has changed over time and which assets share the same attributes.
It is aimed at security operations, threat hunting and exposure management. The platform includes Censys Search, an Attack Surface Management product, adversary investigation tools and the Censys ARC research team, which publishes advisories on new threats. Censys says it is used by leading cybersecurity companies, banks and more than 119 government organisations, and researchers such as Citizen Lab use it to uncover attack infrastructure.
Main Features
- Searchable map of IPs, ports, services, certificates, websites and DNS
- Host history showing how services and certificates changed over time
- CVE and vulnerability context, including VulnCheck exploit intelligence
- Natural language search and an AI assistant on current plans
- CensEye pivots to find related infrastructure sharing key attributes
- Collections that track the results of a query over time
- API access on all tiers plus integrations with SIEM, SOAR and TIP tools
- Attack Surface Management with cloud connectors for AWS, Azure and GCP
How to Get Started with Censys
- Create a free account from censys.com to get basic visibility into standard ports and services.
- Search for an IP address, domain, certificate or service to see what Censys has recorded.
- Open a host to review its services, certificates and history, then pivot to related assets.
- Contact sales if you need a paid plan with more history, more users or the Enterprise Enrichment API.
Censys Pricing
Censys offers a free account with basic visibility into standard ports and services. Paid platform plans (Core, Adversary Investigation and Security Operations) are sold through sales, with Core and Adversary Investigation starting at 5 users and Security Operations offering unlimited users. Some actions consume Censys Credits, and Censys says credit packages start at $100. Attack Surface Management and government plans are also priced on request.
Who Should Use It?
- SOC analysts triaging alerts with Internet context
- Threat hunters and CTI teams tracking adversary infrastructure
- Exposure management teams finding unknown Internet-facing assets
- Researchers investigating attack campaigns
- Cyber insurers and risk teams assessing third-party exposure
Censys Alternatives
- Shodan: a search engine for Internet-connected devices with a free account and low-cost membership.
- urlscan.io: a sandbox that scans websites and records everything a page loads.
- VirusTotal: a free service that checks files, URLs, domains and IPs against dozens of security engines.
Frequently Asked Questions
Is Censys free?
Censys has a free account that gives basic visibility into standard ports and services. The full platform plans, with longer host history and more users, are priced through the Censys sales team.
Is it legal to search Censys?
Censys collects data that hosts publicly expose on the Internet, and searching it is a standard defensive and research practice. Using what you find to access systems without permission is illegal, so keep your work to assets you own or are authorised to assess.
How is Censys different from Shodan?
Both map Internet-connected hosts. Censys focuses on enterprise security teams, with certificate and DNS data, host history, threat data and integrations sold through sales, while Shodan is better known for its device search and low-cost self-serve plans.