Skip to main content
{ Attack Surface Management / Reporting and Compliance }

Censys Attack Surface Posture Report

Delivers a weekly report on the organization's attack surface in Censys, with new hosts and services, risks opened and closed, seed coverage, and anything that needs attention.

What this agent does

This read-only agent reports every week on the attack surface Censys attributes to the organization. It counts the hosts, services, domains, and certificates in the inventory and the risks by severity. It reads the Logbook for the hosts and services that appeared and disappeared since last week and the risks opened and closed. It checks that the seeds cover every public network range and domain the organization owns. It flags anything that needs an admin, such as a risk open for more than 30 days or a domain with no seed.

The challenge

The attack surface changes every day and the Logbook in Censys is long. A new service appears on a Friday and stays open for a month before anyone reads the entry. A new cloud account adds a network range that no seed covers, so Censys never attributes its hosts. Risks accumulate because each one needs an owner before it moves. The Logbook records all of it and nobody reads it end to end.

The solution

The agent reads the inventory, the Logbook, the risks, and the seeds in one pass each week and compares them with the previous week. It lists what changed and what someone needs to act on, with the fix for each item. Provides a weekly briefing an attack surface owner reads in a few minutes.

Workflow

  1. 01

    Read the inventory

    Count the hosts, services, domains, and certificates Censys attributes to the organization, and read the Logbook since last week.

  2. 02

    Read risks

    Read the open risks by severity and type, the risks opened and closed since last week, and the age of each open risk.

  3. 03

    Check seeds

    Compare the seeds with the public network ranges and domains in the cloud accounts I connect, and list the ranges and domains with no seed.

  4. 04

    Report

    Publish what changed and what needs action, with the fix for each item.

Agent template 

# Censys Attack Surface Posture Report

## Measurable outcomes

Every week, the attack surface owner knows what appeared, what disappeared, which risks are open and for how long, and which network ranges and domains Censys does not cover. Track the host, service, and open risk counts and the open action items on every run.

## Procedure

Once a week, count the hosts, services, domains, and certificates Censys attributes to the organization. Read the Logbook since the last report and list the hosts and services added and removed, grouped by port and software for services. Flag any new service on a database, remote access, or management port. Read the open risks by severity and type, and list the risks opened and closed since last week. List the open risks older than 30 days, unless I set another window, with the asset and the owner from the cloud owner tag when the asset matches a cloud resource. Read the seeds. When I grant read-only access to the cloud accounts, list the public network ranges, the elastic and reserved public addresses, and the DNS zones they hold, and list each range and domain that no seed covers. List the certificates in the inventory that expire within 30 days. Compare everything with last week's report, and lead with what changed. Give every action item the specific fix, such as add a seed, assign an owner, or close a service. Report a check it cannot run as not checked, never as fine.

## Requirements

It needs a Censys API key with read access to the organization's attack surface inventory, Logbook, risks, and seeds, and optional read-only access to the cloud accounts for the seed comparison, and nothing more. It never changes seeds, risks, or any asset. Reports show ports, software, risk types, and counts. Addresses and hostnames appear as stable pseudonyms in the summary and in full in the ticket for each action item.