Its opportunity is to supply fresh external context directly to security workflows. An observed service or certificate is evidence to investigate, not proof that a host is malicious.
See it taking shape ↓
Supply first-party external infrastructure evidence.
NOS selected Censys ASM and Search to aggregate infrastructure and investigate threat actors.
Portugal’s NOS faced expanding cloud, IoT and 5G infrastructure and noisy alerts from existing tools.
Censys’s NOS case study; the 65% average comparison describes the vendor’s broader claim.
At-Bay uses Censys data in its technology stack to understand risk and automate insurance processes. Its CTO says it chose Censys over other tools because of its reliability.
At-Bay insures companies against the financial and reputational cost of cyber attacks and data breaches, and aims to make informed underwriting decisions in less than two minutes. That needs accurate outside data on every company it insures.
Company case study summary. The outcome is the customer's own description of how it uses the data.
Illustrative workflow: an analyst must establish whether an unfamiliar host belongs to the company or to an adversary.
The internet map records externally visible hosts, services and certificates. Exposure management connects relevant assets to an organization for review.
Search exposes service characteristics and relationships. Analysts use that context to identify vulnerable or unexpected infrastructure.
The Enrichment API adds internet context to existing triage workflows. This lets the SOC investigate more than the few alerts analysts can manually search.
Owners patch or remove exposed services after validating the finding. Repeated observations help check whether the external condition changed.
Censys starts from a gap that most security teams recognize. Companies have spent years on tools that watch their own networks, from SIEM and endpoint detection to cloud, identity and threat intelligence. In June 2026 Censys argued that these systems remain essential, but that the outside context teams rely on is sometimes outdated or incomplete, making risk assessment harder. An attacker starts from exactly that outside view. Censys calls internet infrastructure the top attack vector into organizations, and says remediation windows are shrinking as adversaries use AI. The company's answer is to measure the outside itself.
quality and timeliness of the data available to it
Zakir Durumeric · Founder and CEO, Censys · Series D funding announcement · 2026-03-31
The belief behind the company comes from where it started. Its founders created fast internet scanning at the University of Michigan and released the open source ZMap scanner, developed in 2013. In 2015 they launched Censys to share scan data with researchers, and in 2017 the project became a company. Censys says it was founded by researchers and practitioners frustrated by the lack of trustworthy internet intelligence in their own investigations, and that "we move fast and obsess about data quality." Its own ten year retrospective says none of the commercial uses were planned when Censys was first built. That origin explains the bet: measure the whole internet directly, keep measuring, and sell the result as evidence that a customer can check.
Why now has two parts. The first is scale. Censys reports seeing nearly 794 million IPv4 services in 2025, against 275 million in 2015. The second is AI. The chief revenue officer says AI is automating every stage of an attack, and the founder says the next few years of security operations will be defined by how well defenders automate security decisions, which needs an understanding of the internet infrastructure that adversaries use. If machines triage alerts, every alert needs outside context, not only the few an analyst has time to search by hand.
Take an illustrative case. An alert in a security operations center points to traffic with an unfamiliar IP address. In the first step, Discover, the question is whether the host belongs to the company. The Internet Map records the hosts, services and certificates visible from outside, and the exposure product attributes assets to an organization for review. In the second step, Inspect, an analyst reads what the host reveals: which ports answer, which certificate it presents, which other assets it connects to and how its services changed over time. Censys singles out relationship mapping and historical analysis as what its map adds.
In the third step, Enrich, the same lookup happens without a person. The Enrichment API adds Censys context to alerts inside existing triage workflows, and since July 2026 a credit-free Enrichment option returns a compact profile for any IPv4 or IPv6 address. In the last step, Act, the owner patches or removes the service, and later scans show whether the outside picture changed. Judgement stays with people at two points. Someone must confirm ownership, and someone must decide what an observation means: a service seen from outside is evidence to investigate, not proof that a host is malicious.
For a solutions engineer in Seoul, the product is easy to demonstrate and harder to prove. A search result appears in seconds. What a Korean telecom operator or agency needs to see takes longer: that Censys finds assets its current tools miss, that the ownership calls are right, and that the data fits the SIEM and SOAR tools the team already runs. The Korea posting asks the hire to do exactly that, from discovery to a proof of value against incumbent tools.
Censys sells one data asset, the Internet Map, through three products. The Censys Platform is the search and investigation tool. Analysts look up hosts, services, certificates and domains, follow the relationships between them and look back through their history. The pricing page lists three paid tiers: Core, for analysts who triage alerts; Adversary Investigation, for threat hunting and threat intelligence teams that track attacker infrastructure; and Security Operations, for enterprises that use Censys data across triage, incident response, threat intelligence and detection engineering. A free account gives basic visibility into standard ports and services.
Underneath sits the scan engine. Censys says it probes more than 200 protocols across all 65K ports from several vantage points, and pairs exhaustive scans with models that predict where services are likely to be. The research team, named Censys ARC in March 2026, writes the annual State of the Internet report from the same data and, in the founder's words, strengthens "the insights embedded in our platform." For a seller, that research is part of the product: it is a reason a security buyer trusts the map.
Attack Surface Management turns the map toward one organization. It discovers and monitors the company's internet-facing assets, including cloud environments and unmanaged services, and flags risks to fix. Workspaces split the attack surface by owner. The supplier’s Swiss Life testimonial describes workspaces as a way to connect each newly found risk with the person responsible for fixing it. The buyer here is an exposure management or vulnerability team rather than a threat hunter.
The Enrichment API brings the map into the tools a security team already runs. It is one lightweight endpoint: an IP address goes in, a fixed JSON profile comes out. Censys built it for high-volume automated lookups in SIEM, SOAR and AI SOC pipelines and integrates with SIEM, SOAR and threat intelligence platforms. In July 2026 it introduced Unlimited Enrichment, a host lookup that does not draw down credits, and named consumption-metered tools such as VirusTotal as the habit it wants to break: in its argument, teams that pay per lookup enrich late, and only a fraction of alerts.
The best documented named customer is NOS, a Portuguese telecom operator that manages about 2 million IP addresses and critical infrastructure. Before Censys, its cloud, IoT and 5G footprint was growing and existing tools produced noisy alerts. NOS evaluated several vendors, including Palo Alto Xpanse and Shodan, and chose Censys ASM and Search. On onboarding, Censys pulled together data across NOS's three major cloud providers and revealed previously unknown assets connected to its attack surface, along with assets running outside security controls such as firewalls. Its head of cybersecurity describes broader visibility into attacker infrastructure. A team lead says Censys let them narrow down the vulnerable OpenSSH services before the CVE was released.
Other named uses show how wide the buyer base runs. At-Bay, a cyber insurer that aims to make underwriting decisions in under two minutes, uses Censys data to automate insurance processes, and its CTO says it chose Censys over other tools because of its reliability. Citizen Lab at the University of Toronto used Censys data, which Censys gives free to researchers and non-profits, to trace infrastructure of the spyware vendor Candiru. In March 2026 Censys said organizations representing over 50% of the Fortune 500 use it, and in October 2025 it counted 40+ national intelligence and defense agencies.
The customer stories are published by Censys and largely describe how customers use the product. Its NOS document also prints a claim of 65% more attack surface on average than competitors. That is the supplier’s general comparison, while the NOS-specific evidence concerns cloud aggregation and previously unknown assets. The company’s summary of a commissioned Forrester study reports a 70% reduction in false positives and 30% asset-discovery and assessment efficiency improvement for a composite organization modeled from customer interviews, assessed over three years. Treat those as scoped sponsored evidence. Signet’s reading: a Korean proof of value should agree on its own asset set, baseline and success criteria, then compare the results with the customer’s existing process.
The company's own count of security practitioners worldwide who trust Censys, as stated in its Series D announcement. It counts people, not paying customer organizations.
| Date | Value | Basis |
|---|---|---|
| 2026-03-31 | 300,000+ practitioners | Series D announcement: Censys is trusted by more than 300,000 security practitioners worldwide. |
Censys
Censys announced $40M equity and $30M debt for product and geographic expansion.
Censys introduced workflows and Enrichment API support for security operations.
Censys reported APAC ARR growth of 115% and more than 200 global partners.
Censys earns money from subscriptions to its data and tools, sold mostly by quote. The three Platform tiers, Core, Adversary Investigation and Security Operations, all say "Contact sales" on the pricing page, and Attack Surface Management and government plans are sold separately. A credit system runs alongside: credits pay for metered use of Platform capabilities, and credit packages start as low as $100. API access is included in every tier. The Enrichment API has a 20K-call daily base on Core and Adversary Investigation with unlimited use as an add-on; Security Operations lists unlimited use. The buyers are enterprises, governments and critical infrastructure providers, and its stated sales strategy emphasizes distributors and resellers, since Censys calls itself channel-first.
Signet's reading of the pricing: Censys now removes the per-lookup credit charge through a credit-free Enrichment option, subject to tier allowances and add-ons, so that its data sits under every alert, and charges for the investigation and exposure layers on top. That is how a company prices when it wants to become infrastructure that a security team stops thinking about.
Censys is private and reports growth as rates. For the first half of 2026 it reported 400% year-over-year growth in the number of customers generating more than $1 million in annual recurring revenue (ARR, the yearly value of subscriptions in force); 115% growth in Censys Platform customers; 106% growth in Adversary Investigations customers; ARR growth of 115% in Asia-Pacific and 82% in EMEA; and 186% growth in partner-sourced bookings. These are rates of change. They measure speed, and a fast rate on a small base looks the same as one on a large base, so none of them reads as company-wide ARR or revenue. The older size markers are dated: in October 2023 Censys had over 180 paying customers and 134 employees.
| Date | Number | What it measures | Basis |
|---|---|---|---|
| Aug 2020 | $15.5M | Series A funding | press-reported |
| Jan 2022 | $35M | Series B funding, led by Intel Capital | press-reported |
| Oct 2023 | $50M + $25M debt | Series C equity and debt, led by Decibel; $128.1M raised in total including debt | press-reported |
| Oct 2023 | 180+ | Paying customers; 350,000 users on the free service | company-disclosed, via press |
| Mar 2026 | $40M + $30M debt | Series D equity and debt, led by Morgan Stanley Expansion Capital | company-disclosed |
| H1 2026 | 400% | Growth in customers above $1 million ARR, year over year | company-disclosed |
| H1 2026 | 115% / 82% | ARR growth in Asia-Pacific / EMEA | company-disclosed |
| H1 2026 | 186% | Growth in partner-sourced bookings | company-disclosed |
Censys competes on two fronts. In internet scanning data it measures itself against Shodan, Fofa, ZoomEye and Netlas, and its own 2025 paper claims more accurate data than those rivals. In exposure management, NOS put it against Palo Alto Xpanse and Shodan before choosing it. In Korea, a column in security trade press groups Shodan, Censys and the Korean product Criminal IP, describes Censys as the view that links certificates, domains and cloud infrastructure, and argues that competition is moving from collection scale to interpretation. That column is one practitioner's view, but it matches what Censys itself is doing with research, risk scores and security operations workflows.
Three risks matter for someone selling Censys in Korea. Scan data has many sellers, so if buyers see it as interchangeable, prices come under pressure. Evidence can be misread: a service seen from outside is a lead, not proof of ownership or malice, and a wrong call lands on the vendor. And Korea’s official distributor also carries other vendors and reports two telecom deployments, making the coordination and renewal process a useful interview topic.
In an interview, say "ARR in Asia-Pacific grew 115%" when you cite that number, never "revenue grew 115%", and say "customers above $1 million ARR grew 400%", not "revenue grew 400%". Then ask how much of the Asia-Pacific growth came from Korea, and how partner-sourced bookings are counted when a distributor brings the deal.
Durumeric developed internet scanning research at Michigan, holds a computer-science PhD and teaches at Stanford.
He is directing investment toward internet intelligence that feeds automated security decisions.
“quality and timeliness of the data available to it”
Zakir Durumeric · Series D funding announcement · 2026-03-31
Zakir Durumeric is the founder and chief executive. He built fast internet scanning research at the University of Michigan, where he earned a PhD in computer science and engineering, and he is an assistant professor of computer science at Stanford. His research has earned a Sloan Research Fellowship and a USENIX Security Test of Time award, and in 2015 MIT Technology Review named him one of its 35 Innovators Under 35 for fast internet scanning. The company's shape follows from that background: it sells measurement, and it still publishes research on the same data it sells.
Four decisions explain the company today. First, research stays inside: in March 2026 Censys gave its research team a name, Censys ARC, and credits it with work such as finding more than 400 exposed human-machine interfaces at U.S. water facilities and working with the U.S. Environmental Protection Agency to secure 96%+ of exposed systems. Second, data keeps flowing to researchers for free. Third, an outside operator was brought in for the next growth phase: in January 2022, with a $35M Series B, Censys named Brad Brooks, a former OneLogin chief executive, as CEO, and in October 2023 Durumeric was described as the company's chief scientist. By March 2026 its announcements name Durumeric as founder and CEO. Fourth, the product moved from exposure management into the security operations center, where the 2026 launches point.
Sarah Ashburn, the chief revenue officer, leads global revenue strategy and oversees sales, marketing, customer success and operations; the Korea posting sits in the sales department. Before Censys she was senior vice president of sales and customer success at Attivo Networks. Anil Gupta, the chief technology officer, leads product and engineering and came from product roles at VMware, Sumo Logic and startups. Michael Schwartz, vice president of research, security and IT, speaks for the research team on its ARC Flash webcasts. Jeff Hackett joined as chief financial officer on 6 October 2026 and reports to Durumeric; he helped scale Armis to more than $340 million in annual recurring revenue. Celestine Jahren, vice president of strategic alliances and channels, leads the side of Censys that Korea's distributor works with.
AI without context is just automation
Sarah Ashburn · Chief Revenue Officer, Censys · Global channel program announcement · 2026-09-22
The careers page lists four values. Two describe the pace and the purpose: "We are relentless," about tackling the toughest challenges, and "We are stewards of a safer internet." A third says its people "don't shy away from accountability" and "lead with sincerity." The about page adds the habit behind the product: "we move fast and obsess about data quality."
The hiring process is explicit about identity. The Korea posting requires cameras on during video interviews, says a candidate may have to meet a Censys employee in person and says new hires may be invited to Ann Arbor, Michigan for onboarding. Everyone receiving an offer is asked to complete identity verification through CLEAR. Censys research has investigated North Korean fraudulent employment infrastructure. Signet’s reading: this provides relevant context for the emphasis on identity, while a causal connection between particular research findings and this policy is a question to discuss with the recruiter. Ask the recruiter about the actual interview sequence and any travel arrangement.
For a Korea hire, the posting establishes the APJ technical-services director as manager and explicitly calls for cooperation across sales, customer success, product and engineering. The CRO’s global responsibilities and the channel leadership describe the wider company, without establishing every reporting link. Signet’s reading: an interview can connect Durumeric’s research-led product story with a concrete customer investigation and the local partner’s adoption work.
The engineer works with prospects, partners, sales and product teams to achieve a technical win and support adoption.
The diagram groups duties in the current Korea Solutions Engineer posting; it is a view of work, not reporting lines or headcount.
Censys's own statements and Korean press give three reasons. First, the sales model: Censys calls itself channel-first, and a sole distributor let it sell in Korea from June 2025 through a local partner. Second, regional demand: Censys reported 115% ARR growth in Asia-Pacific in the first half of 2026, driven by enterprises and governments, after going to market in Australia, Singapore and Japan in 2024. Third, the buyer: the Korean customers its distributor reports are large telecom operators, the same kind of buyer as NOS, its best documented case, and Censys's 2025 research located 51.6% of the active devices in one botnet it measured in South Korea. Signet's reading is that Korea has the exposed infrastructure and the network operators that an outside-in map serves, and that Censys is now adding its own technical hire to a partner-led market.
Ncurity announced that it had signed as Censys's only official distributor in Korea, to supply ASM, Search, threat detection and API integration to companies and public agencies, with technical support, training and integration consulting.
The two companies signed a strategic distribution partnership at Ncurity's headquarters covering Censys's full product line, followed by meetings and training for Korean partners. A Censys vice president spoke about expanding the company's position in Korea.
Ncurity began selling Censys together with Qualys as a continuous threat exposure management offer, and said Censys ASM had won a large domestic customer.
Ncurity ran a two-day hands-on Censys threat hunting seminar for security staff at its Seongnam headquarters and gave attendees two weeks of free platform access.
Ncurity said it had taken part in Censys's Series D as a strategic investor. Censys's own announcement names its lead and four other investors, followed by "and others."
Ncurity said it had added a telecom customer for Censys in August 2026, after supplying a large telecom operator in 2025, and named public and financial sectors as its next targets.
At the CONCERT autumn workshop in Jeju, Ncurity presented Censys as a core tool for a modern security operations center and said public and investigative agencies, large telecoms and enterprises in Korea use it.
Censys entered Korea through a partner. In June 2025 Ncurity (엔큐리티), a security distributor based in Seongnam that also carries Akamai and Proofpoint, announced that it had signed as Censys's only official distributor in Korea. It would supply ASM, Search, threat detection and API integration to companies and public agencies, with technical support, training and integration consulting. In September 2025 the two companies signed a strategic distribution partnership at Ncurity's headquarters covering the full Censys product line, followed by meetings and training for Korean partners.
Why Korea, and why this way? The sources give three reasons. The first is the sales model: Censys calls itself a channel-first organization and reports 186% growth in partner-sourced bookings in the first half of 2026. The distributor agreement was announced in June 2025, and the current Korea job was published in August 2026. The second is regional demand: Censys reported 115% ARR growth in Asia-Pacific in the same period, driven by enterprises and governments, and had already gone to market in Australia, Singapore and Japan in 2024. The third is the buyer. The Korean customers the distributor reports are large telecom operators, the same kind of buyer as NOS, Censys's best documented case, and Censys's own 2025 research located 51.6% of the nearly 40,000 active devices in one botnet it measured in South Korea. Signet's reading: Korea has the exposed infrastructure and the large network operators that an outside-in map serves.
The relationship deepened within a year. By February 2026 Ncurity was selling Censys as the exposure discovery half of a continuous threat exposure management offer paired with Qualys, and said Censys ASM had won a large domestic customer. In March it ran a two-day hands-on threat hunting seminar at its headquarters and gave every attendee two weeks of free access. In April Ncurity said it had joined Censys's Series D as a strategic investor; Censys's own announcement names its lead and four other investors, followed by "and others." In August Ncurity said it had added a second telecom customer, after supplying a large telecom operator in 2025, and named public and financial sectors as the next targets.
Korean reporting identifies Ncurity’s CEO Kim Dong-uk and its Censys business lead Choi Hong-jun as distributor leaders. Their company is a partner, distinct from Censys’s own staff. The Censys posting names the Director, Technical Services, APJ as the hire’s manager and lists collaboration with sales, customer success, product and engineering. Sarah Ashburn’s public global revenue remit and the channel organization provide company context. Signet’s reading: ask which contacts own the proof of value, the contract and the support handover on an actual Korean account.
The current Korea posting, checked on 8 October 2026, is Solutions Engineer, Korea. It places the engineer in every phase of a sales opportunity: discovery, demonstrations and technical briefings, then a proof of value in which the engineer helps prospects test supported integrations and compares Censys with incumbent tools. After purchase, the same role assists with onboarding, ticket management, communication and product feedback. Korean and conversational English are requested alongside a technical and consulting background; comprehensive SOC and AI understanding is highly desirable. The named reporting line is Director, Technical Services, APJ. Signet’s reading: this is a technical sale that continues into adoption, so ask how pre-sales evaluation and support work are scheduled and handed over.
Is Seoul a satellite that could close? The evidence points both ways. For staying power: a sole distributor that says it put its own money into the Series D, two telecom customers, seminars and workshops for Korean security teams, and an open Censys engineering role with a reporting line into the APJ team. For caution: Censys lists its offices in Ann Arbor, Los Altos, Kirkland and Tysons Corner, the Seoul engineer works remotely, and Korean sales run through one partner. A candidate should ask how the Korea plan is measured and who owns the distributor relationship.
Current Signet catalog · 2026-10-19
Prepare a customer evaluation that continues through onboarding and support.
Censys announced $40M equity and $30M debt for product and geographic expansion.
Censys introduced workflows and Enrichment API support for security operations.
Censys reported APAC ARR growth of 115% and more than 200 global partners.
Read against the thesis, the last twelve months have three threads. The first is money and management. In March 2026 Censys raised a $40M Series D and $30M of debt, led by Morgan Stanley Expansion Capital with Decibel Partners, Greylock Partners, GV and Intel Capital, to build AI-driven tools for security operations. On 6 October 2026 it named Jeff Hackett, formerly of Armis, as chief financial officer, and Durumeric said that day that "our customer growth shows that the market is ready."
our customer growth shows that the market is ready
Zakir Durumeric · Co-founder and CEO, Censys · Announcement of the new chief financial officer · 2026-10-06
The second thread is product. In March Censys formalized its research team as Censys ARC. In June it announced its expansion into security operations, putting internet intelligence into alert triage and investigation. In July it launched Unlimited Enrichment and reported first-half results that listed a first strategic partnership with Tanium, combining internet intelligence with endpoint visibility, and new scanners for AI services such as exposed MCP and Ollama servers.
The third thread is the channel. In September Censys expanded its global channel partner program, called itself channel-first, and added regional channel account managers to support partners in local markets. For Korea, where the selling runs through one distributor, that program sets the rules of the game.
A Korea hire joins as Censys turns research data into an everyday input for security operations centers. The three threads give you three interview questions: how growth will be reported now that a CFO is in place, which SOC integrations Korean customers ask for first, and how the distributor and Censys split the work on a Korean deal.
Censys continually observes internet infrastructure and turns those observations into search, exposure management and threat-investigation tools. Defenders can discover forgotten services and investigate the infrastructure behind an alert.
The engineer works with prospects, partners, sales and product teams to achieve a technical win and support adoption.
Employer postings were checked on 2026-10-08. Availability can change. Mock applications request a review from Signet.
Follow the company from its vision through products, evidence and people to the Korea team and current roles. Use the table of contents to move within the page, and expand the sections for more context.