Attribution in the Supplier Risk Module

Attribution is how Censys decides which internet assets belong to an organization. Supplier Risk uses it to map the attack surface of your vendors. This page explains how Censys builds that map and how it decides what to include.

How attribution works

Attribution starts with seeds. Seeds are the assets and identifiers known to belong to an organization. Censys connects each seed to related assets, such as domains, hosts, certificates, and organizations, and builds a graph of those relationships. Every asset that passes the checks described below becomes part of the organization's attack surface.

Attribution aims to be:

• Accurate: the attack surface includes only assets the organization owns.
• Fresh: Censys rebuilds each attack surface every four to six hours.
• Scalable: the same process works for small organizations and for very large ones.

Seeds

Seeds are the starting point for building an organization's attack surface.

• Domains
• IP addresses
• CIDR ranges
• Autonomous system numbers (ASN)
• Certificates
• Web properties
• Organization name

For supplier attack surfaces, the supplier's organization name is the only seed used as a starting point.

How Censys builds the graph

Censys follows relationships between assets and records the type of each relationship. Examples include:

• A domain and its subdomains
• A domain and the organization that registers it
• An organization and its subsidiaries
• A domain and the hosts it resolves to
• A host and the certificates it presents

Censys draws on DNS, WHOIS, host, certificate, and web property data, along with business information about organizations and their subsidiaries.

Each relationship is a candidate connection. Censys adds the asset to the attack surface only if the evidence passes the checks in the next section.

How Censys decides what to include

When Censys finds a candidate asset, it checks the evidence in two stages.

1. Rules check the candidate first. Rules reject clear false matches, such as WHOIS records that use a privacy proxy. Rules accept clear matches, such as a registrant that matches a known name or subsidiary of the organization.
2. An AI model scores candidates that the rules cannot settle. The model reviews a profile of the organization and the related WHOIS records for the candidate, then returns a score and a written reason.

Censys adds a candidate only when its score meets the required confidence level. Rules and thresholds make the final accept or reject decision.

Discovery paths

A discovery path shows how Censys got from a seed to an asset. Each step names the asset and the relationship that connects it to the previous step. Up to three discovery paths for each asset are shown in the Platform web UI, so you can see more than one chain of evidence.

For example, Example Holdings provides www.example.com as a seed. A discovery path to one of its hosts reads like this:

What Censys leaves out

Attribution leaves out assets that look related but do not belong to the organization.

• Certificates that are not in use: an attack surface includes only certificates that hosts currently present, which keeps the inventory focused on what matters.
• Tenant infrastructure: when an organization hosts services for others, Censys does not count a customer's assets as the host's own. For example, a customer's host inside a telecom provider's IP space belongs to that customer, not to the provider. A hostname that a software-as-a-service (SaaS) vendor assigns to one of its customers belongs to that customer, not to the vendor.