Tool profile
Censys: cost, fit and limits
Censys is an internet intelligence and attack surface management service made by Censys, Inc. of Ann Arbor, Michigan, that scans the public internet and lets security teams search hosts, certificates and exposures through a web app and API.
What to know first
Censys sells access to its Internet Map in three published plans, Core, Adversary Investigation and Security Operations, plus a separate Attack Surface Management product and a government offering. Every paid plan says contact sales, and starter plans begin at 500 credits. A free account exists for basic visibility. Natural-language search and an AI assistant come on all plans, and API access is included on every tier.
Censys at a glance
| Maker | Censys, Inc., United States |
|---|---|
| Free plan | Yes |
| Entry price | Quote only; free account available |
| API access | Yes |
| Category | Best AI Attack Surface Management Software in 2026, rank 7 of 10 |
| Website | censys.com |
Who Censys is best for
Threat hunters and investigators
Adversary Investigation adds fully searchable threat data, reputation scores and CensEye pivoting between related assets, which helps analysts follow infrastructure behind an attack.
SOC teams that enrich alerts
Security Operations lifts the enrichment API to unlimited calls and gives 12 or more months of data history, useful for looking back at when a host first appeared.
Teams that build their own tooling
API access is on every tier and the vendor lists integrations with SIEM, SOAR and threat intelligence platforms, so an engineer can wire it into detection pipelines.
Censys plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Core | Contact sales | 5 or more users, 20K enrichment API calls a day, 1 or more months of data history, 15 or more collections, with threat data viewable only. |
| Adversary Investigation | Contact sales | Core plus fully searchable threat data, reputation scores, CensEye related-asset pivoting and 3 or more months of data history. |
| Security Operations | Contact sales | Unlimited users, unlimited enrichment API calls and collections, and 12 or more months of data history. |
| Free account | Free | Basic visibility into standard ports and services; starter plans begin at 500 credits on the paid side. |
Checked November 2026.
What Censys does
- Internet Map search
- Users query an internet-wide dataset of hosts and services. The pricing table shows CVE and vulnerability data on every plan, so a query can start from a vulnerability and list exposed hosts.
- Natural-language search
- An AI assistant answers plain-language questions using Internet Map data, and the pricing table lists it for Core, Adversary Investigation and Security Operations alike. Analysts can ask about hosts, certificates or software without learning the query syntax first.
- CensEye pivoting
- CensEye finds assets related to one you already know about, and it is available from Adversary Investigation upward. It supports tracing infrastructure rather than inventorying your own.
- Attack Surface Management
- A separate product offers daily updates, asset inventory search, tailored alerts and CVE context, with cloud connectors for AWS, Azure and GCP and links to ITSM and SIEM tools.
- Government offering
- A distinct plan lists unlimited result pages, raw JSON data, SAML login, Gold support and 10 users per account, priced by contact. Government accounts also receive one or more months of host history and API access.
How Censys handles your data
The privacy policy names Censys, Inc., 116 South Main Street, Ann Arbor, Michigan, and says the services are hosted and operated in the United States, with data possibly transferred to other countries. It lists GDPR representatives in Hamburg and London. Stripe and Google Analytics are named providers, and no full subprocessor list is given. Aggregated or anonymized data may be used to analyze and improve the services. The policy does not address AI model training, and the pricing page names no certifications, so the vendor's policy was not checked for this.
Where Censys falls short in practice
- No prices on any plan. Every plan says contact sales, so a buyer cannot compare Censys with a printed-price tool until a conversation takes place. Budget approval therefore waits on a sales conversation and a credit estimate.
- Short history on the entry plan. Core offers one or more months of data history and caps enrichment at 20K calls a day, which limits retrospective hunting. Unlimited calls need an add-on or the top plan.
- Investigation first, inventory second. The core product searches the whole internet, so mapping your own estate with ownership tags relies on the separate Attack Surface Management product. Teams that want ownership tags and remediation tickets should ask for a demo of that product.
Works with
Alternatives to Censys
Censys: common questions
Does Censys have a free tier?
Yes. A free account gives basic visibility into standard ports and services. Paid plans are Core, Adversary Investigation and Security Operations, each with a contact sales button, and starter plans begin at 500 credits. Free accounts will not give you API enrichment at scale, so use them for evaluation and occasional lookups.
What does the Censys AI assistant do?
It answers natural-language questions using Censys Internet Map data and is listed on all three plans. The pricing page gives no detail on the underlying model or on how queries are stored, so ask for that in a security review.
Which Censys plan includes threat data?
Threat data is view-only on Core and fully searchable on Adversary Investigation and Security Operations. Reputation scores are limited on Core, and CensEye pivoting is not available on Core at all. Teams that hunt for adversary infrastructure should therefore start at the middle tier.
Where does Censys store data?
The privacy policy says the services are hosted and operated in the United States. EU buyers should read the transfer terms and ask whether any regional option exists, since the pages we read mention none. A buyer with strict data residency rules should therefore request written terms before sending seed domains.
Can Censys connect to cloud accounts?
The Attack Surface Management product lists cloud connectors for AWS, Azure and GCP, plus integrations with ITSM and SIEM tools. The core search plans provide an API on every tier for custom connections. SAML single sign-on is listed for Enterprise and Government users, with Okta, OneLogin and Azure AD as examples.