Skip to content
HOMETECH DIRECTORYNEWS & DEVELOPMENTSRELOCATEEMPLOYERSNEIGHBORHOODSABOUTSchedule a Call

Censys: The U-M Internet Intelligence Spinout That Went Federal

Censys is a 2017 University of Michigan spinout at 116 S. Main Street that scans and indexes the internet for security teams and the US intelligence com...

A2Hub Editorial· Rusty Roof Media· Updated May 4, 2026

Censys

By A2Hub Editorial. Published 2026-04-22. Last updated: 2026-04-22.

At a glance

  • Founded: 2017
  • Founder: Zakir Durumeric (CEO)
  • HQ: 116 S. Main Street, Ann Arbor, Michigan
  • Employees: Mid-sized growth-stage; primary engineering footprint in Ann Arbor with a San Francisco satellite
  • Funding raised: ~$143M total, including a $40M Series D and $30M debt facility
  • Key investors: Morgan Stanley Expansion Capital, Greylock, GV, Intel Capital, Decibel Partners
  • Status: Operating. Multi-year contract with the Office of the Director of National Intelligence announced late 2024
  • Website: censys.com

The U-M internet-scanning spinout that went federal

Censys is the commercial embodiment of a piece of academic infrastructure called ZMap, the internet-wide scanner built at the University of Michigan in 2013. ZMap could scan every IPv4 address on the public internet in under an hour on a single server. That was a new thing. Security researchers had scanned the internet before, but not at that speed, not that completely, and not with a codebase that anyone could inspect. ZMap made large-scale internet measurement a practical, public tool for the first time.

Censys, founded in 2017 by Zakir Durumeric (the ZMap lead author and a current Stanford faculty member), took the academic scanner and built a commercial product around it: a continuously refreshed map of every exposed service, certificate, and host on the public internet, plus the tooling enterprises and governments need to reason over that map. The company has raised approximately $143M, operates from 116 S. Main Street in downtown Ann Arbor, and landed a multi-year contract with the Office of the Director of National Intelligence announced in late 2024. It is, alongside Duo Security, the downtown cybersecurity cluster's second pillar.

Founding story: from ZMap to a company

ZMap was released in 2013 out of Michigan's computer science and engineering department, with Durumeric as first author alongside Eric Wustrow and J. Alex Halderman. The project changed what was possible in internet measurement research. Follow-on work (Censys as an academic research tool, then a public certificate-transparency monitor) made the data continuously queryable by any researcher.

The commercial Censys entity spun out in 2017. The bet was that the same internet-visibility primitive that had become indispensable to academic security research would also become indispensable to enterprise attack-surface management and government cyber intelligence. Every organization now has a sprawl of cloud assets, subsidiaries, partner integrations, and shadow IT exposed to the public internet. Censys is positioned as the single place to see all of it.

By 2017 the Duo Security exit to Cisco was already widely anticipated in the Ann Arbor community, which gave a new U-M security founder credibility with the coastal investors who had been tracking the region. Censys set up HQ at 116 S. Main Street in downtown Ann Arbor, a block from where Duo operated at its peak. Early engineering hiring leaned on U-M graduates and on Duo alumni who wanted to go build something earlier stage.

Durumeric holds a joint role as Censys CEO and a Stanford faculty member. The bi-coastal founder arrangement is unusual but has not pulled the company's center of gravity away from Ann Arbor. The 116 S. Main Street office remains the HQ of record, engineering leadership is local, and the company's hiring posts cluster in Ann Arbor.

What they build

Censys operates three connected products, all sitting on top of the same continuously refreshed internet dataset.

Censys Search. The core query interface. Lets a security researcher ask questions like "show me every server in this ASN running an old OpenSSH version" or "show me every TLS certificate issued to this domain in the last 30 days." Search runs against a continuously refreshed dataset of every externally reachable host on the internet: HTTP servers, TLS certificates, open ports and their banners, DNS records, autonomous-system relationships.

Censys Attack Surface Management (ASM). The enterprise product built on top of the Internet Map. A customer brings a known seed (corporate domain, ASN, brand, or cloud-account identifier), Censys walks the graph outward to discover every asset reachable from that seed, and then monitors those assets for exposure changes, misconfiguration, and certificate drift. Used by security teams to find the "I didn't know we owned that subdomain" category of risk.

Censys Data and Threat Intelligence. The raw scan and certificate data, sold by license to threat intelligence teams, academic researchers, and government customers. This is the pipe that most directly monetizes the ZMap lineage. Customers track malware command-and-control infrastructure, phishing kits, and targeted-attack indicators as they stand up new servers.

Technically, the pipeline runs at a scale that is difficult to appreciate without context. Full IPv4 scans across hundreds of ports, plus IPv6 work where feasible, plus certificate transparency log ingestion, plus protocol-specific deep scans. It is closer to a search engine for the internet's exposed surface than to a traditional SaaS product.

Funding and growth

Censys has raised approximately $143M in total equity and debt. Headline rounds:

  • Series A (2019): $15.5M led by GV
  • Series B (2020): $35.6M led by Greylock and GV
  • Series C (2021): $35M led by Intel Capital with Decibel, Greylock, and GV participating
  • Series D (2024): $40M led by Morgan Stanley Expansion Capital, plus $30M debt financing

Two observations on the cap table. First, GV's participation in every priced round from Series A onward is unusual and signals long-horizon conviction. Second, the 2024 Series D led by Morgan Stanley Expansion Capital with a debt tranche is the pattern of a late-stage company positioning for either a large strategic acquisition or an eventual IPO path, not a company still burning toward product-market fit.

The ODNI contract announced in late 2024 is the most visible credential Censys has disclosed. The Office of the Director of National Intelligence licensed Censys data for multi-year use across the US intelligence community. This is the kind of procurement action that typically anchors follow-on federal spend for years and validates the data quality at a level beyond commercial customer logos.

Ann Arbor footprint

Censys is headquartered at 116 S. Main Street in downtown Ann Arbor, a block from Blumira and within easy walking distance of Duo Security at Liberty Square. The concentration of three serious cybersecurity companies inside six downtown blocks is not accidental. It is the Ann Arbor cybersecurity cluster, and Censys is one of its three pillars.

Engineering hiring is concentrated locally. The company posts roles in Ann Arbor, San Francisco (as a satellite), and remote, but the Ann Arbor office remains the mainline engineering and research location. The team profile skews academically rigorous because of the U-M lineage and the nature of the product. A lot of the hard work is distributed systems engineering and measurement work that feels closer to infrastructure research than to enterprise SaaS. Censys engineers publish at USENIX Security, IEEE S&P, and other top-tier academic venues, continuing the bridge from U-M research to production that the company was built on.

Locally, Censys is a visible sponsor of the scene: it shows up at a2Tech360, hosts open-source and security events, and has hired multiple generations of U-M computer science graduates directly out of the EECS program.

Why it matters

Censys is the second-wave Ann Arbor cybersecurity flagship. Duo proved that Ann Arbor could build a cybersecurity unicorn. Censys is proving that the pattern repeats: U-M research commercialized into a market that was not obvious to coastal investors, scaled from a downtown Ann Arbor office, funded by top-tier coastal VCs with local participation, and converted into federal cybersecurity contracts at scale.

The company also anchors the federal-cyber story in Ann Arbor. The ODNI deal was a noticeable milestone: a Michigan cybersecurity vendor winning a multi-year intelligence-community contract on the basis of its data, not on lobbying or on a prime-contractor relationship. That is the kind of procurement outcome that shifts where the next generation of federal-cyber startups decide to open. Censys shows it can be done from Ann Arbor.

Competitive framing. Censys's direct product competitors are Shodan (the original internet-exposed-host search engine, smaller company, different pricing model) and scanner-based threat intelligence vendors like BinaryEdge. Shodan is the cheaper, hobbyist-friendly default. Censys has positioned as the enterprise and government option. In attack surface management, Censys competes with CyCognito, IBM-acquired Randori, Palo Alto's Cortex Xpanse, and Microsoft's Defender EASM. The distinguishing feature is the depth of its underlying internet dataset; most ASM vendors rely on partners or lighter-touch scanning. Censys runs the scans itself.

Related

  • Duo Security is the downtown cybersecurity anchor, Cisco's $2.35B 2018 acquisition and the flagship exit that seeded today's Ann Arbor security cluster.
  • Blumira is the mid-market cloud SIEM and XDR Ann Arbor player with funding participation from Duo co-founder Jonathan Oberheide.
  • Arbor Networks is the legacy DDoS anchor, the NETSCOUT-owned line that traces back to Farnam Jahanian's U-M lab.
  • Ann Arbor cybersecurity companies is the category hub.
  • Ann Arbor tech companies is the master directory.

FAQ

Who founded Censys? Zakir Durumeric founded Censys in 2017. He was the first author on the 2013 ZMap paper at the University of Michigan, earned his PhD at U-M, and now holds a joint role as Censys CEO and a Stanford faculty member. The original ZMap team also included Eric Wustrow and J. Alex Halderman.

How much has Censys raised? Approximately $143M in total equity and debt. Priced rounds include a $15.5M Series A (GV), $35.6M Series B (Greylock, GV), $35M Series C (Intel Capital with Decibel, Greylock, GV), and $40M Series D (Morgan Stanley Expansion Capital) plus $30M in debt financing in 2024.

What does Censys do? Censys operates a continuously refreshed map of the public internet (every exposed host, service, port, and certificate), plus an Attack Surface Management product for enterprises and a data-licensing business for threat intelligence, research, and government customers.

Is Censys still based in Ann Arbor? Yes. Censys's headquarters is 116 S. Main Street in downtown Ann Arbor. Engineering hiring is concentrated locally with a San Francisco satellite and remote roles. The CEO, Zakir Durumeric, holds a bi-coastal arrangement with a Stanford faculty appointment, but the company's center of gravity remains Ann Arbor.

Does Censys have government contracts? Yes. Censys announced a multi-year contract with the Office of the Director of National Intelligence in late 2024 to license its internet scan data across the US intelligence community.

How does Censys compare to Shodan? Shodan is the older, more hobbyist-oriented internet host search engine. Censys positions as the enterprise and government option with broader coverage, more rigorous data engineering, and a product stack designed for security teams rather than individual researchers.