"Can't I just use Shodan for this?" is a fair question — both Shodan and Censys are excellent, widely respected tools, and security teams should know how to use them. The answer is that a search engine and a monitor are different instruments, the way Google is not an uptime checker.
What Shodan and Censys actually are
Shodan continuously scans the public internet and indexes what answers: open ports, service banners, device types, certificates. You query it like a search engine — "everything with port 9200 open in this ASN" — and it is the canonical tool for understanding internet-wide exposure. Censys does the same with a stronger emphasis on certificates and structured data, having grown out of academic internet-measurement work (the ZMap project). Both offer APIs and paid monitoring products aimed mainly at researchers and enterprise security teams.
Where the search-engine model falls short as monitoring
- Coverage is IP-first, not domain-first. Internet-wide scanners see hosts and ports. Your risk is organized around domains: DNS records, email authentication, security headers on named vhosts, certificate coverage for specific hostnames. Much of that is invisible to an IP-space crawl.
- Freshness is whenever the crawler last came by. Internet-wide scans revisit hosts on the crawler's schedule, not yours. A port that opened this morning may not be indexed for days.
- Nobody is watching for you. The data is there, but a human has to remember to query it, interpret raw banners, and diff against last time. That job silently stops happening after the second sprint.
- No remediation framing. A banner dump tells you what answered; it does not say which of it matters, what the severity is, or what change fixes it.
What a dedicated monitor does instead
Bastion inverts the model. You register a domain, prove you own it with a DNS TXT record, and from then on the checks run on a schedule against that domain specifically: TLS and certificate health, HTTP security headers, SPF/DMARC/CAA, subdomain discovery from certificate transparency logs, lookalike-domain registrations, registration expiry, and TCP connect checks of common ports. Results are scored 0–100, every finding carries evidence and a fix, and — the part a search engine cannot do for you — changes generate alerts: critical ones immediately, the rest in a weekly digest.
Head to head
| Bastion | Shodan / Censys | |
|---|---|---|
| Scope | Domains you have verified you own | The entire public internet |
| Model | Scheduled monitoring + change alerts | Query an index; monitoring products extra |
| Sees DNS, email auth, headers | Yes — core checks | Partially (certs and banners, mainly) |
| Alerting on change | Built in, per domain | Available on paid tiers, IP/query-based |
| Audience | Teams responsible for specific domains | Researchers, threat intel, SOCs |
| Consent model | DNS ownership proof required | Scans everyone, by design |
Use both, differently
Keep a Shodan or Censys account — they are superb for one-off investigations ("what else is on this IP?", "is anything of ours in this vulnerable-device search?"), and their internet-wide view answers questions a domain monitor cannot. But make the recurring, boring, essential check — did anything about our domains change this week? — someone's automated job rather than an occasional manual search. That is what a monitor is for.
Frequently asked questions
Is Bastion built on Shodan or Censys data?
No. Bastion performs its own passive checks directly against domains their owners have verified: HTTP requests, TLS handshakes, public DNS queries, certificate transparency log lookups and TCP connect checks. It does not scan the wider internet and does not index third-party hosts.
Can Shodan alerts replace an attack surface monitor?
Shodan's paid monitoring can alert on changes for IPs and search queries, and for port-exposure tracking it is genuinely useful. It does not, however, evaluate DNS records, email authentication (SPF/DMARC), HTTP security headers, certificate expiry timelines or lookalike domains — most of a small organization's real drift happens in exactly those layers.
Is it legal to look up my company on Shodan or Censys?
Yes — querying an existing index is not scanning. Both services scanned the internet themselves and publish what answered. Using them to research your own footprint is a standard, legitimate security practice.