Attaxion, Censys, CyCognito and Hadrian

About Censys

Censys supports investigations with real-time Internet infrastructure visibility and historical context. Censys supports tracking attacker infrastructure and uncovering related assets. Censys supports discovering unknown assets, identifying critical risks and protecting an external attack surface. Censys supports identifying third-party risk by continuously monitoring supplier Internet exposure. Censys names Global 2000 enterprises and governments as the organizations that choose it for Security Operations and Exposure Management. Censys ARC publishes original research covering emerging threats, attacker infrastructure, vulnerabilities and Internet-wide exposure.^[8][10]

Censys ASM reveals Internet-facing assets, services and exposures across all 65,535 ports, using the Censys Internet Map. Censys maps the global internet across all 65K ports to show what attackers, customers and regulators can see. Censys ASM uses first-party scanning to find Internet-exposed assets, including services on nonstandard ports, self-signed certificates, hosts in residential networks and dangling DNS records. Censys maps the JavaScript libraries, web technologies and plugins running across an environment, then detects and flags the vulnerabilities and risks present.^[8][16]

Censys ASM monitors a surface continuously and sends alerts on changes such as new hosts and services, open ports and reissued certificates. Censys ranks risks by severity, category and affected asset. Censys ASM integrates with ticketing, SIEM, vulnerability management and other tooling to auto-create, route and track remediation tasks. The Censys Assistant takes plain-language questions about an inventory, such as which CVEs affect it or which cloud providers are in use, and generates executive-ready reports on demand.^[8]

Censys Platform has API endpoints for integrating Platform functionality with a customer tech stack. Censys Platform uses a language called Censys Query Language. Censys Platform includes a web property dataset covering name-based assets on the internet, including websites, APIs and web-based applications. Collections let users track and monitor the results of a Censys query over time. The Adversary Investigation module is an add-on to the Censys Platform for organizations to detect, analyze and track threat infrastructure. Censys offers CensEye for automated pivoting jobs that find assets related to an IP, web property or certificate. Censys offers the cencli command line tool for running search queries, looking up assets and performing aggregations.^{[4][9][17][18][19][20]}

Censys Platform data can enrich IPs, web properties and certificates in Google SecOps. Censys has an Attack Surface Management (ASM) integration with Google SecOps. Censys integrates natively with many SIEM, SOAR, TIP and other security tools. API access is included across all Censys tiers.^[19]

Censys Credits power searches, lookups and other actions within the Censys Platform. Censys sets Starter plans to begin at 500 credits, and Enterprise customers use credits only for API usage. Censys Platform access is organised in Censys Free, Censys Starter, Censys Search and Censys Core tiers. Censys describes a plan for threat hunting and CTI teams looking to hunt, track and engineer detections for adversary campaigns and infrastructure. Censys describes a further plan for enterprises that want to use Censys data across alert triage, IR, threat intel and detection engineering. Censys offers Single Sign-On through a SAML-based integration to Enterprise and Government users. Censys offers purpose-built internet intelligence with specialized datasets for government specific investigations and exposure management requirements.^[20]

Censys created fast Internet scanning at the University of Michigan and released the ZMap open source scanner. Censys introduced Censys Search and data downloads, initially scanning 16 popular Internet protocols. Censys evolved from a research project into a free-standing company. Censys architected a new scan engine with proprietary scanning technology. Censys goes to market in Nordics, France, Australia, Singapore, Japan and more. Censys says it empowers private and public sector security teams.^{[4][5][8][9][10][11][16]}

About CyCognito

CyCognito sells a platform for external attack surface management that identifies and validates exposures across an organization's internet-facing assets.^[4]

CyCognito says its platform continuously identifies and validates critical exposures so that security teams can act where it matters most.^[4]

On discovery, CyCognito says it maps every asset through deep black-box discovery and keeps running reconnaissance as the attack surface changes. CyCognito states that its discovery requires zero input, zero seeds, zero configuration and zero onboarding. The company says it auto-attributes each asset to its owner, the business function it serves and the data it holds, and fingerprints the tech stack the asset runs.^[4][5]

On testing, CyCognito says it runs active security tests across the entire external footprint. CyCognito states that it runs more than 100,000 security tests across more than 30 exposure categories, including OWASP application weaknesses, authentication bypass, exposed data and injection vulnerabilities. CyCognito says it uses unauthenticated black-box techniques designed not to disrupt live traffic, modify data or require downtime. The company also says it tests whether WAF, API security controls, CSPM policies and authentication surfaces are present and behaving as expected.^[6]

CyCognito says it uses Target Graph to map business, security and stack context across all exposed assets, and that agents use it to orchestrate pentesting campaigns that chain attacks, deliver proof and adjust as the surface changes.^[6]

On prioritization, CyCognito says its prioritization considers asset attractiveness to attackers, business context, targeted threat intelligence and results from 100,000+ tests. CyCognito says its remediation validation feature automatically checks if a remediation attempt has been successful, and that its Remediation Planner tool builds remediation plans for organizations and their subsidiaries.^[5][6]

On customers, CyCognito publishes a case study on Asklepios, a healthcare conglomerate, which the page describes as operating a hospital network with 50,000 employees.^[7]

CyCognito's CEO and Co-Founder is Rob Gurzeev, who the company says has led the development of offensive security solutions for both the private sector and intelligence agencies.^{[1][2][4][5][8]}

About Hadrian

Hadrian is an agentic AI offensive security platform that continuously discovers an organization's external attack surface and tests it for exploitable exposures. Hadrian's Atlas and Nova products run on one platform, so exposures, pentests and evidence sit in one place. Atlas gives breadth across everything a company exposes, and Nova gives depth in the application that matters. Hadrian runs from the cloud and is ready in minutes.^[1][3][4][7]

Atlas continuously maps a company's external attack surface and validates exposures. Atlas discovers assets, technologies and service points, then uses agentic AI to confirm which exposures are actually exploitable. Atlas discovers every domain, DNS record, IP, certificate, cloud service and app a company exposes, then tests all of it the way an attacker would. Atlas maps outward from the organization: subsidiaries and acquisitions, the domains each one registered, then every subdomain, IP, certificate and cloud host under them. Atlas starts from a few apex domains, maps how everything connects, flags what changed and proves which exposures are real. Atlas runs passive scans every hour, and event-driven testing starts automatically when a new asset or change is detected. Atlas matches a new CVE to the assets running the affected version, tests every one of them, and tells the customer which are really exposed.^[7]

Hadrian's Orchestrator AI uses machine learning and pattern recognition to scan the internet for exposed assets tied to an organization, including Shadow IT. Hadrian continuously scans the internet to find forgotten subdomains, cloud instances and legacy servers that belong to an organization but are not in its official inventory. Hadrian's platform safely simulates real-world attack techniques to validate if a vulnerability is actually exploitable in the customer's specific environment. Hadrian only flags verified risks that have a confirmed path to compromise. Hadrian's agents safely test what they find and only raise what holds up, with the request, the response and the fix, and they check the fix when a risk is closed.^[7][8]

Nova is an agentic penetration test powered by AI that performs the same techniques a skilled human pentester would, including reconnaissance, exploitation and lateral movement. Nova's agents sign in as every role, learn how an app's business logic works and chain small steps into real impact. Nova's testing stays within the scope the customer sets, at the pace the customer chooses, without changing a single record. Nova customers receive access to the Hadrian platform to see results and get a compliance-ready pdf report. Atlas's asset discovery and exposure mapping feeds directly into Nova, so penetration tests are automatically scoped against the real attack surface.^[4][9]

Hadrian's hacker agents test the external attack surface continuously, chain what they find into attack paths, and report only the paths they can prove. Hadrian does not replace a scoped red team exercise, and internal networks, social engineering and physical access stay with the customer's human red team.^[10]

Hadrian maps the external attack surface of every company in a group, including new acquisitions and legacy infrastructure, and starts testing it as soon as the deal closes. Hadrian uses ownership signals from DNS, certificates and registration records, and a customer's team can confirm or correct attribution in the platform. Role-based access lets each subsidiary or business unit see and act on its own assets, while the group security team keeps the full view. Hadrian connects to multiple cloud environments with a few clicks, providing a centralized view of exposed assets. Hadrian identifies exposed cloud assets and misconfigurations that could enable lateral movement and privilege escalation. Hadrian's ML algorithms prioritize risks based on business relevance, asset attractiveness, discoverability, impact and exploitation ease.^[12]

Hadrian allows teams to assign leads, share risk details with third parties, track remediation progress and collaborate in a shared space. Hadrian's risk details include severity, impact, proof of concept and remediation steps.^{[1][3][9][13]}