TL;DR: Censys reports record first-half 2026 growth as enterprises adopted real-time Internet intelligence for exposure management, threat investigations and AI-enabled security workflows, with 115% growth in platform customers and 400% growth in customers above $1 million ARR. The underlying shift is from reactive detection to continuous visibility and automation across security operations.
At a glance
What this is: Censys says enterprise demand for real-time Internet intelligence accelerated in the first half of 2026, driven by exposure management, security operations and AI-enabled workflows.
Why it matters: For IAM and security teams, the important signal is that visibility is being treated as an operational control, not just a monitoring layer, especially where AI and internet-facing assets expand attack surface.
By the numbers:
- Censys Platform customers grew 115% in the first half of 2026.
- Customers generating more than $1 million in ARR grew 400% year-over-year.
Context
Internet intelligence is the practice of continuously mapping exposed assets, services and dependencies so security teams can understand what is reachable from the public internet. In this article, Censys frames that capability as a response to faster attack cycles, broader exposure and the operational need to turn discovery into action.
The governance problem is not just finding assets, but deciding how that visibility feeds triage, investigation and remediation workflows. That matters for identity-adjacent programmes too, because exposed services, tokens, APIs and administrative interfaces often sit close to credential and access risk.
Key questions
Q: How should security teams use internet intelligence in exposure management?
A: Use it as a continuous control input, not a periodic report. The goal is to keep an always-current view of exposed assets, prioritise the systems that matter most, and push findings directly into triage and remediation workflows. If the intelligence does not change a decision, it is just more data.
Q: Why do AI-enabled security workflows depend on trustworthy enrichment data?
A: Because automation speeds up whatever quality is already present in the pipeline. If context is stale, inconsistent or incomplete, AI will accelerate the wrong prioritisation. Teams should therefore validate data freshness, source quality and deduplication before relying on automated triage or investigation steps.
Q: What breaks when exposed services are not continuously tracked?
A: Attackers and scanners find them first, while defenders stay a step behind. Without continuous tracking, internet-facing assets drift out of inventory, exposure lasts longer than intended, and remediation becomes reactive instead of preventive. That gap is especially dangerous for services that sit near identity, secrets or administrative access.
Q: How do exposed AI services change governance for identity and access?
A: They extend governance beyond traditional applications to new externally reachable services that may hold credentials, tokens or privileged integrations. Teams need ownership, access boundaries and review processes that cover the service itself, not just the model or application layer. Otherwise the exposure problem becomes an identity problem as well.
Technical breakdown
How internet intelligence supports exposure management
Internet intelligence combines continuous scanning, protocol fingerprinting, DNS data and asset correlation to build a live view of what is exposed externally. In practice, the value is not raw enumeration but the ability to prioritise risky assets and feed those findings into operational workflows. When the inventory is always changing, security teams need data that is both current and actionable. That is why exposure management depends on freshness, coverage and deduplication rather than one-time asset discovery. See the Threat Intelligence Platform Buyer's Guide.
Practical implication: treat external asset discovery as an always-on control input, not a periodic audit exercise.
Why AI-enabled workflows change the value of threat intelligence
AI-enabled workflows reduce the time between detection, enrichment and analyst action by automating context assembly. The core mechanism is not replacing analysts, but moving more of the repetitive correlation work into the workflow so triage starts with better context. That makes intelligence more operational, but only if the underlying data is accurate enough to support automated decisions. Poor enrichment at machine speed simply accelerates bad judgments. See the AI SOC Guide.
Practical implication: validate data quality before automating enrichment or triage decisions with AI.
What exposed AI services mean for security teams
Exposed AI services such as MCP and Ollama servers create a new visibility problem because they can be reachable before they are intentionally governed. The issue is not only that the service exists, but that external exposure may allow unauthorized discovery, misuse or integration into broader attack paths. For defenders, the technical challenge is to identify these services quickly, classify them correctly and apply the right access and hardening controls before they become shadow AI entry points. See the AI Security Maturity Model.
Practical implication: inventory externally reachable AI services and tie them to ownership, approval and access controls.
Threat narrative
Attacker objective: The attacker aims to find and abuse exposed infrastructure before defenders can inventory, triage and contain it.
- Entry occurs through publicly reachable infrastructure, where attackers and automated scanners discover exposed services, assets or AI endpoints faster than manual teams can review them.
- Credential or access abuse follows when exposed interfaces, APIs or administrative services provide a path into higher-value systems or reveal enough context to support further intrusion.
- Escalation and impact emerge when defenders lack a continuous view of the attack surface, allowing exposed systems to remain available long enough for exploitation, investigation or remediation delay.
Breaches seen in the wild
- tj-actions/changed-files compromise 2025: A stolen bot token let attackers poison tj-actions/changed-files so pipelines printed their CI/CD secrets to public logs (CVE-2025-30066).
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Continuous exposure management is replacing periodic visibility checks as the default operating model. The article reflects a wider shift in security operations: teams no longer get value from a static asset list if attackers can discover and exploit changes in near real time. That makes discovery freshness, context and workflow integration the control problem, not just coverage. Practitioners should treat live attack-surface intelligence as a governance input, not a reporting output.
AI-native security workflows only work when the underlying intelligence is trustworthy enough to automate. Censys positions AI-enabled enrichment as a way to accelerate triage and investigations, but automation amplifies both good and bad data. That creates a new quality threshold for enrichment pipelines, especially where security teams are delegating first-pass judgment to machines. The practical conclusion is that automation without verified context becomes a liability, not a force multiplier.
Exposed AI services are becoming a new class of unmanaged attack surface. The mention of exposed MCP and Ollama servers shows that AI infrastructure is already joining the same exposure-management problem set as other internet-facing systems. AI security maturity matters here because AI services often appear before ownership, policy and access governance are mature. Teams should assume shadow AI discovery will become a routine operations task, not an edge case.
Internet intelligence is increasingly a control-plane issue for identity security as well as network defence. When external services, APIs and admin surfaces are visible, they often sit adjacent to secrets, tokens and service identities that can be abused downstream. That is why NHI governance and exposure management are converging in practice, even when the article is framed as broader security operations. The lesson for practitioners is to connect asset visibility to identity ownership and privilege boundaries.
The market signal is less about data collection and more about operationalisation. Partner growth, integrations and AI-native workflows all point to a category that is being pulled into day-to-day SOC and exposure-remediation work. That means buyers should evaluate how cleanly intelligence feeds triage, hunting and remediation paths rather than treating it as a separate intelligence silo. The category is moving toward embedded decision support, not standalone visibility.
What this signals
Exposed AI infrastructure is becoming part of the normal attack surface. Security programmes that still separate AI services from the rest of external asset management will miss how quickly these systems appear, change and get discovered. The practical response is to fold AI endpoints into the same exposure, ownership and remediation processes used for other internet-facing assets.
Operational visibility now has to reach the identity layer. When externally reachable systems are tied to service accounts, API keys and administrative paths, asset intelligence becomes only half the problem. Teams need to know who owns the service, what privilege it carries and how quickly access can be withdrawn when exposure is found.
For practitioners
- Instrument continuous external asset discovery Map internet-facing assets, services and AI endpoints continuously rather than on a schedule, then route the results into triage and exposure-management workflows.
- Validate AI enrichment quality before automation Test whether enrichment data is accurate, timely and consistent enough to support automated investigations before giving AI tools decision-making authority.
- Track exposed AI services as governed assets Assign owners, approval status and access boundaries to externally reachable AI services such as MCP and Ollama before they become unmanaged entry points.
- Connect exposure findings to identity controls Link exposed interfaces back to service identities, tokens and administrative access so remediation includes privilege review, not only asset cleanup.
Key takeaways
- The core issue is not simply more internet-facing infrastructure, but the need to turn discovery into governed remediation before exposure becomes exploitable.
- The article's growth figures show that buyers are adopting intelligence platforms as operational controls for SOC, threat hunting and exposure management.
- Teams that want to reduce risk should connect external asset visibility to ownership, privilege and workflow automation, not treat it as a standalone reporting layer.
Related NHI Mgmt Group resources: Threat Intelligence Platform Buyer's Guide · AI Security Maturity Model · AI SOC Guide · tj-actions/changed-files compromise 2025
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical Devices and Systems Inventory | The article centers on continuous visibility into exposed assets and infrastructure. |
| DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events | Censys is explicitly about real-time monitoring of internet exposure and attacks. | |
| Recommendation — Maintain a continuously updated inventory of internet-facing assets and feed it into exposure management. Use continuous monitoring to detect newly exposed services and risky changes faster. | ||
| MITRE ATT&CK | TA0007;TA0006 — Discovery; Credential Access | The article discusses discovery of exposed services and the downstream risk to access paths. |
| Recommendation — Map exposed-service discovery and downstream access abuse to ATT&CK and prioritise the highest-risk exposures. | ||
| OWASP Non-Human Identity Top 10 | NHI-06 — Insecure Cloud Deployment Configurations | Exposed AI services and internet-facing infrastructure create the deployment exposures the article highlights. |
| NHI-02 — Secret Leakage | The article links exposed systems to tokens, APIs and administrative interfaces that may reveal credentials. | |
| Recommendation — Audit exposed cloud and AI services for insecure deployment settings before they become reachable attack paths. Search exposed services for leaked secrets and revoke any credentials that can be reached externally. | ||
Key terms
- Internet Intelligence: Internet intelligence is the continuous collection and analysis of public internet signals to understand exposure, ownership, and risk. It combines scanning, attribution, and context so defenders can turn raw visibility into prioritised action across assets, vendors, and threat activity.
- Exposure management: Exposure management is the practice of identifying which assets are reachable by attackers and reducing that reach before exploitation occurs. For collaboration systems like SharePoint, it is not enough to know that a patch exists, because public accessibility changes the speed and likelihood of attack.
- AI-assisted security workflow: An AI-assisted security workflow is a security process where software helps people make decisions, automate steps, or summarize evidence. It uses machine learning or generative AI to support tasks such as alert triage, investigation, policy review, and response. Human oversight remains necessary because outputs can be incomplete, biased, or incorrect.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect identity controls to operational security decisions across modern environments.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org