Censys is a security service and company that provides internet intelligence based on perpetual scanning of the internet. As of 2023, it had 350,000 users. It was first created in 2015 at the University of Michigan.
Background
Censys began in 2015 in a computer science lab at the University of Michigan. It was created by Zakir Durumeric in professor Alex Halderman's computer lab as an extension of the "ZMap" open-source project Durumeric had previously developed in 2013. It started as an academic project, but rights in the technology were transferred to Halderman to commercialize the technology.
The first product, Censys Search, was released in 2017. In 2018, it raised $2.6 million in seed funding. Censys pivoted to attack surface management, and in 2019 added exposure management, whereby it identifies security risks related to an organization's internet-connected devices. In 2020, Censys raised another $15.5 million series A funding. This was followed by another $70 million in financing in 2026. By 2026, it raised $149 million in total.
Features
Censys is based on the open-source project ZMap and was created by the same founders. Censys sends an "application-layer handshake" to every device connected to the internet with an IP address. Then, it obtains information about the device and its software, such as whether the device has an unpatched vulnerability, a list of protocols the device uses, and its network ports. Censys imports data on about three billion IP addresses each day. Censys itself is commercial software, but is free to non-commercial users, like security researchers.
Security researchers use it to determine how many devices could be affected by a new security vulnerability. For example, a security firm called Duo Security (now part of Cisco) used Censys to learn that a water plant in Kentucky was affected by a security vulnerability in Dell computers in circa 2015, prompting the U.S. Department of Homeland Security to get involved in fixing the vulnerability. In 2024, Censys researchers identified almost 400 water treatment control systems were unintentionally connected to the internet and worked with the US Environment Protection Agency to resolve the security issue.
For commercial users, Censys has tools to find vulnerabilities or indications of a security breach, based on an analysis of data from large scans of the internet, combined with logic and context information. Censys consists of three main areas. The first, "Internet Intelligence", refers to a search engine for information about internet connected systems. The second is External Attack Surface Management (EASM), which refers to filtering and analyzing data about internet-connected systems to identify security problems, which are assigned a "severity score". The third is External Threat Intelligence, which refers to collecting information about potential or active security threats.
The Censys API is used to send data to other security software tools. In circa 2023, it introduced an AI chatbot, initially as a beta feature. Instead of a traditional search with filters, the user can type in sentences telling the software what internet-connected devices the user is looking for, such as asking for a list of FTP services in a country.
