Feature and Data Access Tiers
Censys offers tiered data and feature access solutions for a wide range of users, from hobbyists to enterprise security teams. All users have a Censys Free account that offers basic internet visibility, access to basic protocols and certificates, and limited web property data such as root endpoints.
To access more detailed data that provides deeper insights, you must upgrade to a higher tier account. Each tier builds upon comprehensive internet scanning data, offering progressively deeper scan results and context about assets and their importance to security workflows.
Censys offers four main tiers: Censys Free, Censys Starter, Censys Search, and Censys Enterprise. These tiers are often referred to as plans, levels, or entitlements.
Any Censys Free user may upgrade their account to the Censys Starter tier by purchasing Censys Credits. To gain access to Censys Search or Censys Enterprise-level data and features, contact the Censys sales team.
Additional modules and add-ons, like the Adversary Investigation module and the Critical Infrastructure module, are available to Censys Enterprise customers to address specific use cases.
If you encounter data with a lock icon next to it, you must upgrade or switch to an upgraded account to access it. Upgrading your account unlocks this data and provides enhanced security insights. You can see a list of data that is available and unavailable to you on the Data Definitions page in the Platform console.
You may also see the following image or a similar one when attempting to access a feature that is unavailable to your tier.
Overview
The following tables explain which data and features are available to each Platform tier.
Data access
| Data feature | Censys Free | Censys Starter | Censys Search | Censys Enterprise |
|---|---|---|---|---|
| Basic protocols and data (HTTP, RDP, SSH, telnet, and more - 41 protocols total) | Yes | Yes | Yes | Yes |
| Basic context data (software product and vendor information, and more) | Yes | Yes | Yes | Yes |
| Labels | Yes | Yes | Yes | Yes |
| Host DNS and WHOIS information | Yes | Yes | Yes | Yes |
| Advanced protocols and protocol data (MQTT, IPP, and more - over 140 protocols) | Visible on records but not searchable | Most protocol data is visible and searchable; some data is only available in higher tiers or additional modules | Almost all protocol data is visible and searchable; some data is only available in additional modules | Almost all protocol data is visible and searchable; some data is only available in additional modules |
| Additional context data (software and hardware and component CPE values, version data, life cycle information, and more) | No | No | Yes | Yes |
| Host history | No | 1 week | 30 days or more, depending on access level purchased | 30 days or more, depending on access level purchased |
| Certificate data including extensions, chains, ZLint data, and more | Certificate data is visible but not all is searchable | All certificate data is visible and searchable | All certificate data is visible and searchable | All certificate data is visible and searchable |
| Host and web property CVE and risk data (CVE IDs, KEV presence, and more) | No | No | No | Yes |
Root (/) and non-root (/account/login, /admin/login.html, for example) endpoint data | Yes | Yes | Yes | Yes |
| HTTP redirect chain data for host services and web properties | Visible but not searchable | Visible but not searchable | Visible and searchable | Visible and searchable |
| Deep application scan data for Cobalt Strike, Kubernetes, Elasticsearch, and more | No | No | Yes | Yes |
| Threat data | No | No | No | Censys Enterprise users can view some threat data on host and web property records; to search and pivot across threat data, users must have access to the Adversary Investigation module |
| Open directory data and threats | No | No | No | Yes - with Adversary Investigation module |
| JARM fingerprints and context hashes (JARM, JA4X, JA3S, and more) | No | No | No | Yes - with Adversary Investigation module |
| ICS protocols and screenshots | No | No | Yes - with Critical Infrastructure module | Yes - with Critical Infrastructure module |
| CVE vulnerability data | No | No | No | Yes |
Features
| Feature | Censys Free | Censys Starter | Censys Search | Censys Enterprise |
|---|---|---|---|---|
| API access | Yes - lookup endpoints only | Yes | Yes | Yes |
| Single sign-on (SSO) | No | No | Yes | Yes |
| Additional organization users | No | No | Yes | Yes |
| Regular expression in query syntax | No | Yes | Yes | Yes |
| Censys Assistant | Yes - assistant prompt responses may consume credits | Yes - assistant prompt responses may consume credits | Yes - assistant prompt responses may consume credits | Yes - assistant prompt responses may consume credits |
| Censys Query Assistant | Yes | Yes | Yes | Yes |
| Matched fields for search results | Yes | Yes | Yes | Yes |
| Download search results in CSV format | No | No | Yes | Yes |
| Pages of search results (100 per page) | 1 | 5 | Unlimited | Unlimited |
| Maximum concurrent actions | 1 | 1 | 10 | 10+ |
| Collections | 1 with a maximum of 100 assets | 2 | 10+ | 15+ |
| Webhooks | No | Yes | Yes | Yes |
| Live Rescan | No | No | Yes | Yes |
| Live Discovery | No | No | No | Yes - with Adversary Investigation module |
| Explore Threats page | No | No | No | Yes - with Adversary Investigation module |
| Investigation Manager | No | No | No | Yes - with Adversary Investigation module |
| CensEye automated pivoting tool | No | No | No | Yes - with Adversary Investigation module |
| Certificate history timeline | No | No | No | Yes - with Adversary Investigation module |
| Web screenshots (including extracted text data) | No | No | Yes | Yes |
| MCP Server | No | Yes | Yes | Yes |
| Suspicious Directory threat, open directory metadata, and open directory UI | No | No | No | Yes - with Adversary Investigation module |
Tier information
Censys Free
The Censys Free tier is designed for preliminary security investigations and is useful for testing Platform functionality. Users can search and view basic protocols and services, but some protocols and their attendant data are excluded.
Basic host, web property, and certificate information is searchable and viewable for Censys Free users. To search for additional certificate fields and view historical host data, you must upgrade to a paid tier. Censys Free users are limited to 1 page of 100 results.
Censys Starter
If you purchase credits through the Censys website, your account is upgraded to the Starter tier, granting you API access, additional internet visibility and actionable insights.
Starter tier accounts are limited to a maximum of 500 results per search query, with 100 results shown per page.
Censys Search and Censys Enterprise
Both of these tiers include all of the features of the Censys Starter tier.
Vulnerability data is not available to the Censys Search tier, but is available to the Censys Enterprise tier.
Both tiers offer full protocol data access and advanced internet visibility provided by deep application scanners. This allows you to search and view protocols, services, web applications, and view 30 days of host history, excluding industrial control system (ICS) protocols. Censys Enterprise search results include all CPE-based fields and provide access to unlimited paginated results.
Censys Enterprise customers may view some threat data, but cannot search and pivot off of it. To see complete threat data and search and pivot across it, you must have access to the Adversary Investigation module, which may be purchased by Censys Enterprise customers.
Threat data is not visible to Censys Search customers.
Censys Enterprise customers may purchase access to Critical Infrastructure data separately.
Updated 3 days ago