Summary
Censys announced on June 18 a major expansion into security operations, embedding its internet intelligence platform directly into SOC workflows through new integrations with leading SIEM, SOAR, and threat intelligence platforms. The expansion introduces risk scoring, adversary intelligence, AI-powered workflows, and a new Enrichment API designed for high-volume automated lookups.
New integrations include Google SecOps SOAR, Palo Alto Cortex XSOAR/XSIAM, Cisco Splunk SOAR and ES, Microsoft Sentinel, and several threat intelligence platforms including Cyware, EclecticIQ, and OpenCTI. A lightweight Host Enrichment API launched June 15 provides curated host data optimized for SOC automation, enabling real-time enrichment of alerts with internet exposure context.
The move follows Censys’s $70 million strategic funding round in March 2026, including a $40M Series D and $30M in debt financing. The company is positioning its internet scanning and attribution data as a critical layer for SOC modernization, particularly as AI-assisted attacks increase the speed at which exposed infrastructure is targeted.
Sources
- Censys Blog — Expanding Into Security Operations
- PR Newswire — Censys Expands Into Security Operations
Commentary
This is a smart strategic play by Censys. Their internet scanning data has always been gold for attack surface management and threat research, but it’s been largely siloed from day-to-day SOC operations. Embedding that intelligence directly into SIEM and SOAR platforms where analysts actually work eliminates the context-switching that slows down incident triage.
The real test will be whether SOC teams actually use it. Another enrichment feed sounds great in a product demo, but most analysts are already overwhelmed with data sources. Censys needs to prove that their enrichment meaningfully reduces time-to-decision on alerts rather than adding another tab to check. The Host Enrichment API is the right approach — lightweight, automated, and built for the scale that production SOCs demand. If they nail the integration UX, this could become a standard part of the SOC stack.