Censys Explained: Internet-Wide Scanning, Attack Surface Management from Seeds, and the 2026 Platform Move

Attackers find exposed services by scanning the internet. Censys does the same scanning so defenders can see their own organisation from the outside, often finding forgotten test servers, exposed admin panels and old acquisitions that no internal inventory knew about.

What it is

Censys runs internet-wide scans and offers two things on top of the data:

• Search of hosts, certificates and web properties. This now lives on the Censys Platform, queried with the Censys Query Language (CenQL).
• Attack surface management (ASM), which works out which internet-facing assets belong to your organisation and flags risks on them.

Censys is privately owned and raised $70 million in March 2026. CyCognito is a frequently compared vendor. It starts from an organisation's name and public footprint rather than confirmed seeds, and adds automated testing to validate whether exposures can be exploited.

How it works

Scanning. Censys says it continuously scans all 65,535 ports from several vantage points, with automatic service detection, and uses predictive scanning to find services on non-standard ports. It collects information only and never tries to log in. Organisations can opt out by dropping traffic from Censys's published ranges, though existing results are not deleted.

Attribution. ASM starts from seeds, the assets you confirm you own. Censys can suggest seeds from registration data. From the seeds it discovers related hosts, certificates, domains and cloud assets, and every asset shows a discovery path explaining the attribution. You control which subsidiaries and seeds are in or out of scope.

Query language. CenQL uses field and value syntax with dataset prefixes such as host., cert. and web., plus operators for substring matches, regular expressions and ranges.

How to use it

Day one: seed carefully

Start with the domains, IP ranges and autonomous systems you know you own, including those of subsidiaries and recent acquisitions. Review suggested seeds before accepting them, because a wrong seed pulls in someone else's assets.

Week one: review the unknowns

1. Sort by "not in our inventory". Assets that ASM found and your CMDB does not know are the main value of the exercise.
2. Check each discovery path. If you cannot explain why an asset is yours, find out before acting on it.
3. Triage exposures: administrative interfaces, databases and dashboards open to the internet, end-of-life software, expired or mismatched certificates, and dangling DNS records pointing at resources you no longer control.

Every day: own, fix and confirm

Assign each internet-facing asset an owner, fix or decommission risky exposures, and confirm the change on the next scan. Feed new assets into vulnerability scanning so they get the same internal coverage as everything else. If you used the Legacy Search API in automation, move it to the Censys Platform API.

Where it stops

• Outside-in only. It sees what is reachable from the internet, not internal hosts or what an authenticated user sees.
• Attribution can be wrong. Shared hosting, CDNs and cloud IP reuse make ownership ambiguous; never test an asset you have not confirmed is yours.
• Point-in-time services. Short-lived exposures can appear and disappear between scans.
• Finding is not owning. The hard part is getting someone to accept responsibility for a forgotten server.

How it comes up in interviews

• "How would you find every internet-facing asset a company owns?" Seeds, certificates, DNS, cloud accounts, acquisitions, and verification of ownership.
• "Attack surface management found a staging server with an open admin panel that nobody owns. What next?" Confirm ownership, restrict access, find the owner or decommission, then work out how it escaped inventory.
• "Why would a defender use the same scanning data attackers use?" Because it shows what attackers can see first.

Sources

Checked on 13 November 2026: Censys documentation (scanning FAQ, seeding the attack surface, using Censys to find seeds, Censys Platform syntax differences); Censys blog posts on predictive scanning and on Legacy Search deprecation (25 February 2026); Morgan Stanley press release on Censys's funding (31 March 2026); CyCognito external exposure management page.