The Results Are Clear:

Censys Finds New Services
Faster Than Shodan
You Can’t Protect What You Can’t See
Security teams need to be able to quickly identify new services that come online. Spotting
a suspicious server within hours, rather than weeks, can make a world of difference inincident response effectiveness. Similarly, threat hunters and researchers rely heavily
on precise temporal data to augment network logs and build accurate timelines ofinfrastructure.
Without the ability to quickly and accurately identify new services and potential threats,
security teams are essentially navigating in the dark. For these reasons and more, rapid
discovery of new services is an important gauge for evaluating any internet scanner or
intelligence source.

MEASURING RAPID DISCOVERY: CENSYS VS. SHODAN

Censys is committed to being the one place to understand everything on the internet.
But we want to do more than just claim it–we want to prove it and that comes throughrigorous research and benchmarking. The Censys Research Team set out to measure
how fast our scanning engine detects newly opened “common” ports on internetfacing hosts when compared to Shodan.

To do this, Censys deployed over 300 honeypots across various regions in Google Cloud
using a staggered activation schedule for the honeypots, starting them across differentdays of the week and times of day, to then measure how quickly Censys and Shodan
found those hosts.
The results were clear: Censys internet scanning detects new services faster than Shodan.

THE RESULTS ARE CLEAR:C E N S Y S F I N D S N E W S E R V I C E S F A S T E R T H A N S H O D A N • C ENSY S. C OM

1Censys Outperforms on Coverage &Time-to-Discovery
These results reveal that Censys outperforms Shodan in two key ways:
1. Coverage: Censys discovered 100% of all services within a week, outperforming
Shodan, which on average only detected 57% in the same timeframe.
2. Time to Discovery: Censys outpaced Shodan in discovery, uncovering new services
in nearly one-sixth of the time it took Shodan on average.

COVERAGE:CENSYS DISCOVERS MORE NEW SERVICES THAN SHODAN
On average, within the first 24 hours of a honeypot service going online, Censys foundover 80% of common services, while Shodan found only 12%, as shown in Figure 1.
212380

443

2222

3306

Censys

80.6%

80.3%

88.3%

90.2%

80.3%

84.4%

Shodan

8.9%

9.5%

14.9%

12.7%

16.5%

6.7%

Figure 1: Percentage of honeypots discovered by each scanner within 24 hours

Beyond the initial 24 hours, the results are similar. Censys discovered every single
honeypot service within a week, whereas on average, Shodan found only 57% of services.
When we analyze those numbers by ports again, Shodan discovered at most 71.1% ofhoneypot services on port 2222 (Figure 2).
212380443

22223306

Censys100%100%100%100%100%100%Shodan

49%

48.6%

63.2%

64.8%

71.1%

45.1%

Figure 2: Percentage of honeypots discovered by each scanner within 1 weekTHE RESULTS ARE CLEAR:C E N S Y S F I N D S N E W S E R V I C E S F A S T E R T H A N S H O D A N • C ENSY S. C OM

2

TIME-TO-DISCOVERY:CENSYS DISCOVERS SERVICES MORE QUICKLY THAN SHODAN
Censys discovered services in a fraction of the time that Shodan did. On average acrossall ports, Censys discovered new services in about 12.3 hours, while Shodan took roughly
70 hours – nearly six times longer.

Censys consistently detected new services in under 24 hours on average, whereas
Shodan’s fastest time (port 2222) was 66.3 hours, or approximately ~2.7 days.
212380

443

2222

3306

Censys

14.5

14.4

10.3

9.4

13.2

13.2

Shodan

69.5

76.8

69.2

68.9

66.3

72.4

Figure 3: Average hours to service discovery for the intersection of services found by both scanners

A more detailed look at the distribution of individual service discovery times for eachscanner further underscores this disparity. (Fig. 4).

Figure 4: Distribution of discovery times for the intersection of services found by both scanners

Censys discovery times are clustered toward the lower end of the time spectrum, with a
median of 8.9 hours, while Shodan’s are scattered across a wider range and centered at62.1 hours.
THE RESULTS ARE CLEAR:C E N S Y S F I N D S N E W S E R V I C E S F A S T E R T H A N S H O D A N • C ENSY S. C OM

3Censys: The Superior Choice forInternet Intelligence
In a digital landscape that’s constantly evolving, internet intelligence is only effective
if it can quickly adapt to those changes. Security teams can’t monitor or safeguard
assets they aren’t aware of – which makes rapid discovery not just a nice-to-have, but anecessity.
Our research demonstrates that for timely discovery of new assets, security teams canrely on Censys for unparalleled performance.

Censys discovers new services
6 times faster than Shodan.

The one place to understand everything on the internet.
Censys is the leading Internet Intelligence Platform for Threat Hunting and Exposure Management. We
provide governments, enterprises, and researchers with the most comprehensive, accurate, and up-todate map of the internet to defend attack surfaces and hunt for threats. Censys discovers new services
140% faster than the nearest competitor.
Founded by the creators of ZMap, trusted by the U.S. Government and over 50% of the Fortune 500, Censys’
mission is to be the one place to understand everything on the Internet.
censys.com