Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How CISOs Map Adversary Infrastructure with Censys
Transcript
- Lucas: So there's a tool called Censys that most CISOs I talk to have heard of but very few are actually using in their daily ops. And I think that's a mistake. Luna: Censys — that's the internet-wide scanning engine, right? Like Shodan but more focused on certificates and protocol handshakes? Lucas: Exactly. Shodan is the better-known name, but Censys was spun out of the University of Michigan's research on scanning the entire IPv4 address space. What it does is continuously map every device on the internet — the services they expose, the TLS certificates they present, the software versions running. Luna: And the use case for defenders is that attackers have to expose infrastructure too. command and control servers, phishing landing pages, payload hosts — they all have certificates, IPs, open ports. Lucas: Right. So the idea is: you flip the reconnaissance advantage. Attackers scan the internet to find vulnerable targets. Defenders can scan the internet to find adversary infrastructure before it hits them. Luna: I've heard that called 'pre-breach adversary reconnaissance.' Is that the term? Lucas: That's exactly the term. And I want to walk through a real case a CISO at a Fortune 500 retailer shared with me. They were preparing for a critical patch Tuesday — a remote code execution in a widely used VPN appliance. The CISO's team deployed the patch across their estate, but then they did something extra. They used Censys to search for devices that matched the vulnerable version's TLS certificate fingerprint on the public internet. Luna: To see who else was vulnerable? Lucas: Partly, but the real win came when they filtered for IPs in their own netblock range. They found a server with the exact same certificate fingerprint that wasn't in their asset inventory. It was a staging box — some team had spun it up for testing and forgotten about it. Exposed SSH on port 22, running the vulnerable version. Luna: Shadow IT. Classic. So Censys let them discover an asset they didn't know they owned, before an attacker could. Lucas: Exactly. But the more impressive move came a few weeks later. They started getting alerts from their threat intel team about a new malware variant that used a specific pattern of SSL certificates for its command and control traffic. The CISO's team wrote a Censys query to find any certificates matching that pattern across all cloud providers. They found five servers — three on AWS, one on DigitalOcean, one on Hetzner. Luna: And then what? They can't just take those servers down. Lucas: They can't take them down, but they can block them. They pulled the IPs and fed them into their network perimeter and their peering partner's BGP blackhole. The CISO told me they effectively cut off the C2 channel for five adversary servers within four hours of the first intel alert. Luna: That's a pretty concrete outcome. Most threat intel programs struggle to show value that fast. Lucas: Yeah, and that's the whole point. Censys is part of a broader category called attack surface management. The market is growing at about 35 percent year-over-year. Gartner calls it external attack surface management, or EASM. You've got vendors like CrowdStrike with Falcon Surface, Palo Alto with Cortex XSIAM's attack surface module, and then standalone players like Censys, Shodan, GreyNoise. Luna: GreyNoise is a different approach, right? They collect noise from internet scanners and filter it out so defenders can focus on actual threats. Lucas: Right. GreyNoise is more about reducing false positives. Censys and Shodan are about discovering what's out there. But the interesting thing is how these tools are converging. Censys just released a feature called 'Adversary Infrastructure Search' that pre-builds queries for known threat actor patterns — APT29 using specific certificate issuers, that kind of thing. Luna: So it's becoming more curated. That lowers the skill bar for the SOC analyst who might not have written a Censys query before. Lucas: Exactly. And that matters because the talent shortage is real. The other driver is regulation. The SEC's new cyber incident disclosure rules, which started taking effect last year, require public companies to disclose material incidents within four business days. But more importantly, they also require companies to describe their processes for assessing, identifying, and managing material risks from cybersecurity threats. Luna: And having a tool that says 'we actively scan the internet for infrastructure targeting our organization' is a pretty strong process description. Lucas: Exactly. It's audit-friendly. The CISO I mentioned told me their external auditor specifically asked about external attack surface visibility. Being able to show a dashboard with adversary infrastructure blocks was a big plus. Luna: Let's talk about the technical side for a minute. How does Censys actually work? I know it scans the whole IPv4 space, but that's a lot of addresses. How often does it update? Lucas: They scan the full IPv4 space daily for common ports — 80, 443, 22, 3389, that kind of thing. For less common ports, they scan on a rolling basis. The data is stored in a searchable index. You can query by IP, by domain, by certificate fingerprint, by ASN, by geographic location. They also have a certificate transparency log search, which is huge for phishing investigations. Luna: Because phishing sites use TLS certificates that are publicly logged in certificate transparency. So if you see a certificate issued to 'paypa1-security.com,' you can find it before the phishing site even gets traffic. Lucas: Exactly. And Censys indexes those logs in near real-time. There's a whole subcategory of tools that do certificate intelligence — Censys, CertSpotter, Google's own Certificate Transparency search. But Censys is the most comprehensive because it combines certificate data with host data. Luna: Are there any downsides? I imagine running a scan that touches every IP on the internet could trigger a lot of IDS alerts. Lucas: Yeah, Censys's scanners are well-known. If you have a firewall, you're going to see Censys IPs in your logs. That's actually a feature — you can identify Censys traffic and tag it as known good. But some organizations block scanning altogether, which means their own IPs won't show up in Censys results. So there's a blind spot if you're relying on it for asset discovery. Luna: Okay, but for adversary infrastructure, the blind spot is on the adversary's side. They can't easily hide their C2 server from a full internet scan because the server has to be reachable. Lucas: That's the key insight. Adversaries can use fast-flux networks, bulletproof hosting, or domain fronting, but at the end of the day, their server has an IP and a TLS certificate. Unless they use a non-standard port or a custom protocol that doesn't respond to a standard handshake, Censys will find it. Luna: There's been some pushback from privacy advocates about these scanning engines. The argument is that they give attackers an equally powerful tool to find vulnerable services. Lucas: That's a fair concern. Shodan has been criticized for making it easy to find exposed industrial control systems and unsecured databases. But the counterargument is that the information is already public — any attacker can run their own scan. The difference is that defenders now have a low-cost way to do the same thing. It's a democratization of reconnaissance. Luna: And it's not just about finding your own assets. The proactive use case — finding adversary infrastructure — is what separates a mature program from a reactive one. Lucas: Right. And that's the angle I want to push. If you're a security leader and you're not doing internet-wide scanning as part of your threat intel workflow, you're leaving a tool on the table. It's not expensive — Censys has a free tier and a paid enterprise tier that's a few thousand dollars a year. Compared to the cost of a breach, it's trivial. Luna: I think this is one of those episodes where listeners could walk away and try something today. Just go to Censys, search for their own netblock, and see what turns up. Lucas: Absolutely. And if they find something they didn't know about, that's a win. If they find adversary infrastructure targeting their industry, that's an even bigger win. Luna: Speaking of wins — if today's conversation was actually useful to you, the reason we can do deep dives like this without ads is listener support. It's a small thing, but if you buy me a coffee dot com slash fexingo, that keeps the show independent. Lucas: Yeah, we don't have sponsors, we don't have tracking, we don't run ad breaks. It's just us talking about what actually works in security. And if a few people chip in, it stays that way. Luna: Alright. Back to the scanning side. I want to talk about one more use case that came up in my research — how some teams use Censys for mergers and acquisitions due diligence. Lucas: Oh, that's a good one. So when Company A acquires Company B, they inherit all of Company B's digital assets. And Company B might not have a complete inventory. The acquiring team can run a Censys scan on Company B's known IP ranges and discover shadow IT, exposed databases, unpatched services — all before the deal closes. Luna: And that can actually affect the valuation. If you find a critical exposure, you can negotiate a remediation clause or a price adjustment. Lucas: Exactly. I've heard of a case where a private equity firm used Censys during due diligence on a mid-size SaaS company. They found an exposed Elasticsearch cluster with customer data that wasn't even in the company's asset register. The PE firm demanded a 10 percent holdback until it was fixed. Luna: That's a concrete dollar figure tied to a scanning query. That's the kind of story that gets CFOs to pay attention to attack surface management. Lucas: Yeah. And I think that's the trajectory we're seeing — these tools moving from the security team's niche project to a board-level discussion item. The SEC rules, the M&A due diligence use case, the proactive threat hunting — it all adds up. Luna: I'm curious about what's next. Do you see Censys or similar tools adding more automated response capabilities? Like if you find a C2 server, can you automatically trigger a block? Lucas: They already have API integrations with SOAR platforms and firewall vendors. So technically, yes. But the challenge is false positives. If you auto-block an IP that's actually a legitimate service, you can cause an outage. So most teams still review before blocking. Luna: So human-in-the-loop for now. That feels right for this stage of the market. Lucas: Yeah. And as the queries get more curated and the threat intel feeds get better, the false positive rate will drop. We're probably two or three years away from a fully automated 'detect and block' loop for adversary infrastructure. Luna: Something to watch. For now, the takeaway is: go scan your own netblock. See what's out there. And if you're feeling ambitious, start searching for the infrastructure of the threat actors in your sector. Lucas: That's the move. Thanks, Luna. And thanks to everyone listening. We'll be back next week with another angle on the tools that actually move the needle in enterprise security.