Censys is partnering with Tanium to bring Internet intelligence into AI-driven Autonomous IT workflows. Real-time, trusted Internet visibility, and verified context to remediate faster than ever before. https://bit.ly/3PySi2S

Censys Reputation Score: Real-time visibility into global infrastructure, from a single, trusted source of Internet intelligence embedded directly within SOC workflows. Read the full blog here: https://bit.ly/4nVUrCm

Many organizations are adopting AI faster than they are securing it. Censys scanned the internet and found 12,520 exposed MCP servers across 8,758 IPs. No credentials required to connect. New research from ARC researcher Mark Ellzey on the risk. https://bit.ly/4fLcUzo #AISecurity #CensysARC

New guest blog from Nadav Shai Kanon, Solution Architect | Cortex, @paloaltonetworks.com on why AI SOCs need real-time Internet data context. https://bit.ly/3ReoetR Censys integrations are now live in the Palo Alto Networks marketplace: https://cortex.marketplace.pan.dev/marketplace/details/Censys/

AI is only as strong as the data behind it.

4 straight years powering the Verizon #DBIR w/ Censys Internet intelligence. The 2026 report reinforces a growing reality: Internet visibility has become foundational for defenders amid vulnerability exploitation, AI-enabled attacks & rapidly shifting infrastructure. https://bit.ly/4uYZPXD #DBIR

From @cnn.com- Officials suspect Iranian hackers are behind breaches of automatic tank gauge (ATG) systems that monitor fuel at gas stations. Censys found 6,502 ATG services on 6,057 hosts across 65+ countries. CNN story: https://cnn.it/4uuKm1u Our full SITREP: https://bit.ly/4ny2ftE

Officials suspect Iranian threat actors are exploiting ATGs at gas stations, per a CNN report. ATGs have no access control, and many are directly Internet-facing. Censys found 6,502 ATG services on 6,057 hosts across 65+ countries. Read our full situation report https://bit.ly/4ny2ftE #CensysARC

Censys Internet intelligence is now integrated with @paloaltonetworks.com Cortex XSIAM and XSOAR. Investigate with ground truth from across the Internet, right where your SOC operates. Learn more here: Cortex XSIAM ▶️ https://bit.ly/4eADniG Cortex XSOAR ▶️ https://bit.ly/4nmgpOH

Censys ARC is seeing exposed AI tooling across the Internet. Watch the full episode to learn more: https://bit.ly/4djLYVG #CensysARC

DetEng keeps expanding beyond “write a SIEM rule.” Censys Collections belong in the detection engineer toolbox. https://bit.ly/4npPkKs

Your SOC has all the alerts. But do they have the right Internet context?

On #WorldPasswordDay while everyone talks about password hygiene, Censys ARC mapped something different: the Internet infrastructure behind password managers themselves. New research: https://bit.ly/49tDybZ #CensysARC

Still pivoting across tools in your SOC to monitor exposure and investigate alerts? The Censys integration with Google SecOps brings our Internet intelligence & external exposure context directly into Google SecOps SIEM and SOAR in one workflow. Faster triage. Less friction. https://bit.ly/4tnhoPX

Happy 10th anniversary to our partner @vertexproject.bsky.social! As proud technology partners, we're thrilled to celebrate this milestone. Censys & Synapse: Internet intelligence, seamlessly in analysts' workflows. See how it works: bit.ly/4u7fjZ6

Ever wonder how Internet data reveals hidden threats? Here’s what Censys ARC uncovered about Iranian cyber activity: https://bit.ly/4djLYVG #CensysARC

Multiple threat actors actively exploit cPanel vulnerability (CVE-2026-41940) 📖 Read more: www.helpnetsecurity.com/2026/05/04/m... #cybersecurity #cybersecuritynews #cPanel #CVE #botnet #cyberespionage #malware #ransomware #webhosting @shadowserver.bsky.social @censys.bsky.social

🌌 Like the galaxy, the Internet has a dark side too. We scan the Internet. 🔭 You stay secure. Happy #MayThe4th https://bit.ly/4emZitC

Identity and access alerts aren’t just about identity. They’re about the Internet infrastructure behind them. We break down 3 IAM alerts and how Internet context changes the decision: https://bit.ly/4ukH3cO

Identity and access alerts aren’t just about identity. They’re about the Internet infrastructure behind them. We break down 3 IAM alerts and how Internet context changes the decision: https://bit.ly/4vYuZzJ

What if you could see your external exposure in one place? Clear context that helps the SOC triage faster. Request a demo to see the difference. https://bit.ly/4cT6YBl

🚨 CVE-2026-41940 (9.8) Pre-auth bypass allows remote admin access (cPanel/WHM). Patch now. ▶️ Full advisory: https://bit.ly/48xsquo

Starting in a few hours. The first Censys ARC Flash goes live at 11 AM ET, covering 𝘐𝘳𝘢𝘯, 𝘈𝘐, 𝘢𝘯𝘥 𝘵𝘩𝘦 𝘖𝘱𝘦𝘯 𝘐𝘯𝘵𝘦𝘳𝘯𝘦𝘵. Thousands of exposed systems are tied to Iran-linked activity targeting critical infrastructure. Live Q&A only for attendees. Register here: https://info.censys.com/arc-webcast

Censys has teamed up with Microsoft Sentinel to bring Censys Internet intelligence directly into Sentinel’s cloud-native SIEM/SOAR workflows to support both attack surface monitoring and SOC investigation. Less pivoting. Faster triage and investigation. See how → https://bit.ly/42oNr70

New from Censys ARC™ researcher @exraritas.bsky.social: “OLUOMO” an AiTM phishing cluster harvesting Microsoft credentials and session tokens. Compromised sites: Azure & OAuth. Lure: US naturalization form https://censys.com/blog/oluomo-microsoft-oauth-aitm-phishing-using-a-naturalization-form-lure/

Tired of pivoting across tools just to understand one alert? With Censys & Splunk, enrichment happens automatically, pulling in external exposure data, certificates, services, and more. Less digging. More doing. See it in action → https://censys.com/resources/integration/cisco-splunk-platform/

​​Censys just announced new integrations across AI, SOAR, threat intelligence platforms. We’re bringing real-time Internet visibility directly into the tools teams already use, so they can move faster from triage to investigation and response. censys.com/blog/censys-...

Censys ARC researcher Silas Cutler on the limits of disrupting malware, and why the industry needs stronger collaboration when opportunities arise. https://censys.com/blog/rhadamanthys-private-sector-ops-limitations/

Just launched: 𝐂𝐞𝐧𝐬𝐲𝐬 𝐀𝐬𝐬𝐢𝐬𝐭𝐚𝐧𝐭 𝐢𝐧 𝐀𝐒𝐌 Ask it anything about your attack surface in natural language. Learn more: https://docs.censys.com/docs/asm-censys-assistant #AttackSurfaceManagement #CISO

As of April 2026, Censys observes nearly 6M Internet-facing FTP services. Many show no evidence of encryption. Intercepted traffic can expose usernames, PWs & sensitive data. Question worth asking your IT team: is FTP running, and if so, is it encrypted? https://censys.com/blog/ftp-exposure-brief/

What if you could ask researchers about threats in real time? Introducing Censys ARC Flash - short briefings & live Q&A Starts April 29 Secure your spot: https://bit.ly/4cmDWKc #CensysARC

Most SOCs rely on incomplete signals, leading to slower triage & missed risk. Censys Reputation Score changes that: • Built on real-time global Internet visibility • Clearer, defensible risk signal • Accelerated investigation ➡️ https://censys.com/blog/reputation-score-internet-map-risk-signal/

MSSP Alert covers how Censys is embedding real-time Internet context and risk scoring directly into SOC workflows—closing the visibility gap that slows investigations. Read the full article: https://bit.ly/422RYf5

Announcing new capabilities allowing SOCs to move faster. Real-time authoritative Internet context delivered directly into workflows with: ✔️Real-Time Internet Context ✔️Real-Time Adversary Infrastructure Intelligence ✔️Reputation-Based Risk Scoring ✔️Expanded Intelligence censys.com/blog/censys-...

Censys researchers warned that thousands of devices are exposed to the Iranian government’s campaign targeting energy, water, and U.S. government services and facilities. via @mattkapko.com www.youtube.com/watch?v=Qe87... | cyberscoop.com/iran-attacke...

🌐 In new research, Censys ARC Principal Security Researcher Andrew Northern shares a technique-based approach to hunting web-delivered malware. Read for Censys infrastructure analysis, indicators of compromise & practical defense guidance for security teams censys.com/blog/techniq...

Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework Censys censys.com/blog/under-c... @censys.bsky.social

Today, we announced $70m in Series D & debt financing to accelerate our Internet Intelligence platform and the next generation of AI-driven security workflows. We provide first-party, real-time visibility into global Internet infrastructure. censys.com/blog/70-mill...

⌨️ New from #CensysARC: Previously undocumented “𝗖𝗧𝗥𝗟” .NET access framework — combining phishing, keylogging, RDP hijacking, and reverse tunneling. Active infra. No public intel. censys.com/blog/under-c...

🚨CVE-2026-3055 (CVSS 9.3) Unauth OOB read in Citrix NetScaler (SAML IDP) 🔎 #CensysARC observes 173K exposed Web Properties ⚠️ Attackers could read sensitive memory contents 🛠️ Patch now https://censys.com/advisory/cve-2026-3055/

Cyberattacks on healthcare don’t just hit data - they disrupt operations. An attack on Stryker (claimed by Iran-linked group #Handala) impacted manufacturing and shipping. www.securityweek.com/iranian-hack... Protecting healthcare systems starts with visibility: www.censys.com/blog/state-o...

We have introduced additional fingerprints for various remote monitoring and management (RMM) tools, as well as enhanced protocol and application scanners. For more info, please visit: docs.censys.com/changelog Stay informed by subscribing to our updates via RSS: docs.censys.com/changelog.rss

🚨Critical: CVE-2026-22557 CVSS 10.0 unauthenticated remote path traversal vulnerability in Ubiquiti UniFi Network Application ⚠️ Attacker could access and manipulate system files w/potential for account takeover 🔎 Censys sees 87,196 exposed hosts 🛠️ Patches immediately censys.com/advisory/cve...

Critical vulnerability: CVE-2026-32746 is a pre-authentication remote code execution (RCE) in the telnet daemon 🛠️ Affects GNU Inetutils telnetd through version 2.7 🔎 Censys sees ~3,362 exposed hosts 🔴 Exploitation could grant an attacker control of the host censys.com/advisory/cve... #CVE202632746

New Censys ARC™ Exposure Brief examines cyberattack on Stryker attributed to the Iran-linked group #Handala. Censys observed ~2,000 internet-facing hosts tied to the company, including 150+ login interfaces — illustrating how complex enterprise attack surfaces can be. censys.com/blog/iranian...

If your SIEM runs on patchwork enrichment and stale Internet context, AI just produces faster delusions. First-party Internet visibility is the missing layer. Censys brings the Internet intelligence layer that helps your AI SOC succeed. More ➡️https://censys.com/blog/what-ai-is-missing-modern-soc/

Multiple US gov agencies have warned orgs to stay vigilant for potential Iran-affiliated cyber activity. We studied exposure of 4 vendors previously known to be of interest to IR-affiliated groups. Read more: censys.com/blog/ics-ira...

🔌 #Iran Internet #Outage Update ---- June 21 marked lowest visibility—but signs of recovery. 📉 Some networks (e.g., DATAK, HAMYAR-AS) remain unstable. 📈 Others (e.g., RESPINA-AS, MOBINNET-AS) are bouncing back strong. View at #Censys: censys.com/blog/irans-i...

🔍 We looked at the C2 server associated with the Flodrix botnet and used an internet-exposed RPC service to uncover a world-readable NFS mount and 745 compromised hosts! 👀 censys.com/blog/poking-...