SIDE BY SIDE · FACTS ONLY

Censys vs runZero: asset inventory facts side by side

SHORT ANSWER

Censys describes 2 of the five approaches on the pages we read and runZero describes 3; they differ on CAASM aggregation, Agent-based inventory, External attack surface management, CMDB-centred inventory and Exposure management. On collection, Censys works without new agents and runZero works without new agents. Many estates run two of these approaches together, so the question is often which pair, not which one; we do not score either.

By The Inventory Desk · CAASM Finder · Published 2026-10-11

Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.

How do their approaches compare?

Top bar: Censys ASM
Lower bar, lighter: runZero

Full bar: described on the vendor's pages we read
Hatched bar: described with a condition (another product, a higher tier, or part of the approach)
Stub: not in our sources (it may exist; we did not find it)

The bars show what each vendor's own pages describe, or how your answers weigh the five approaches. They are not a measure of how well a product works.

What are the facts, side by side?

From each vendor's own pages. Differs marks rows where the recorded status or check value differs.
Fact	Censys ASM	runZero
Positioning	Censys's external exposure management product, built on first-party scanning of all 65K ports and the Censys Internet Map.	An asset discovery platform that runZero describes as CAASM: active scanning, passive discovery for fragile OT networks and integrations, with each asset profiled against nearly 1,000 attributes.
Deployment	Discovery expands from seeds the customer adds in the console or through the API; assets found beyond the seeds appear under a Found by Censys tab. Source: Censys docs: seed your attack surface · Read 27 Sep 2026	SaaS or on-premises, including air-gapped environments; no agents, authentication or appliances required. Source: runZero platform · Read 27 Sep 2026
CAASM aggregationDiffers	Not in our sources Not described on the pages we read.	Described Describes itself as CAASM: integrations with ServiceNow, CrowdStrike, Intune, AWS, Azure, Google Cloud, Entra ID, Tenable, Rapid7, Qualys and others combine with its own scan data. Source: runZero integrations · Read 27 Sep 2026
Agent-based inventoryDiffers	Not in our sources Not described on the pages we read.	With a condition Collects its own data by active scanning and passive discovery, without agents. Source: runZero platform · Read 27 Sep 2026
External attack surface managementDiffers	Described First-party scanning across all 65K ports finds services on nonstandard ports, starting from seeds you supply. Source: Censys external exposure management · Read 27 Sep 2026	Not in our sources Not described on the pages we read.
CMDB-centred inventoryDiffers	Not in our sources Not described on the pages we read.	With a condition Enriches a ServiceNow CMDB rather than acting as one. Source: runZero integrations · Read 27 Sep 2026
Exposure managementDiffers	With a condition Applies EPSS and KEV to external findings, confirms reachability and routes remediation tasks; internal assets are not described. Source: Censys external exposure management · Read 27 Sep 2026	Not in our sources Not described on the pages we read.
Servers and network devicesDiffers	Not in our sources	Matches Active scanning of IT, OT, IoT, cloud, mobile and remote assets. Source: runZero platform · Read 27 Sep 2026
Cloud workloads	Matches Names AWS, Google Cloud and Azure among its integrations. Source: Censys integrations · Read 27 Sep 2026	Matches Cloud assets, with AWS, Azure and Google Cloud integrations. Source: runZero integrations · Read 27 Sep 2026
SaaS applications	Not in our sources	Not in our sources
Identities as assetsDiffers	Not in our sources	Partly Entra ID is a listed integration; identities are not described as an asset class. Source: runZero integrations · Read 27 Sep 2026
Off-network laptopsDiffers	Not in our sources	Matches Remote assets are a listed class. Source: runZero platform · Read 27 Sep 2026
OT and IoT devicesDiffers	Not in our sources	Matches Passive discovery for OT. Source: runZero platform · Read 27 Sep 2026
Internet-facing discoveryDiffers	Matches First-party scanning of all 65K ports. Source: Censys external exposure management · Read 27 Sep 2026	Not in our sources
Offers its own agentDiffers	Not in our sources	Not in our sources
Works without new agents	Matches Discovery runs from the internet, starting from seeds added in the console or through the API. Source: Censys docs: seed your attack surface · Read 27 Sep 2026	Matches No agents, authentication or appliances. Source: runZero platform · Read 27 Sep 2026
Merges records from several sourcesDiffers	Not in our sources	Matches Profiles each asset against nearly 1,000 attributes. Source: runZero homepage · Read 27 Sep 2026
Feeds or updates a CMDB	Matches ServiceNow CMDB is a named integration. Source: Censys integrations · Read 27 Sep 2026	Matches ServiceNow integration for CMDB enrichment. Source: runZero integrations · Read 27 Sep 2026
Cross-source queries and reportsDiffers	Not in our sources	Partly AI-assisted reporting on the Platform plan. Source: runZero pricing · Read 27 Sep 2026
Workflows, tickets or actionsDiffers	Matches Auto-creates, routes and tracks remediation tasks. Source: Censys external exposure management · Read 27 Sep 2026	Not in our sources
Price or pricing basis publishedDiffers	Partly ASM is contact sales; a free platform account exists and credits start at $100. Source: Censys pricing · Read 27 Sep 2026	Matches Community Edition free for 100 or fewer assets; runZero Platform starts at $5,000. Source: runZero pricing · Read 27 Sep 2026
Free tier or trialDiffers	Partly A free Censys platform account exists; ASM itself is sold through sales. Source: Censys pricing · Read 27 Sep 2026	Matches Free, full-featured 21-day trial. Source: runZero pricing · Read 27 Sep 2026
Platform it is part of	None	None
Integrations	Webex, Slack, Jira, ServiceNow ITSM, Tenable VM, Google Security Operations, Microsoft Sentinel, ServiceNow CMDB, Axonius, Brinqa, AWS, Google Cloud and Azure. Source: Censys integrations · Read 27 Sep 2026	ServiceNow, CrowdStrike, Intune, AWS, Azure, Google Cloud, Entra ID, Tenable, Rapid7, Qualys, VMware, Wiz, SentinelOne, Tanium and Splunk, plus a custom integration SDK. Source: runZero integrations · Read 27 Sep 2026
Price	ASM: contact sales. A free Censys platform account exists, and credits start at $100. Source: Censys pricing · Read 27 Sep 2026	Published: Community Edition free for 100 or fewer assets with 30-day retention; runZero Platform starts at $5,000 with 3-year retention; free 21-day trial. Source: runZero pricing · Read 27 Sep 2026

Where do they differ?

CAASM aggregation: Censys is not in our sources; runZero describes it.
Agent-based inventory: Censys is not in our sources; runZero describes it with a condition.
External attack surface management: Censys describes it; runZero is not in our sources.
CMDB-centred inventory: Censys is not in our sources; runZero describes it with a condition.
Exposure management: Censys describes it with a condition; runZero is not in our sources.
Servers and network devices: Censys is not in our sources; runZero matches.
Identities as assets: Censys is not in our sources; runZero partly matches.
Off-network laptops: Censys is not in our sources; runZero matches.
OT and IoT devices: Censys is not in our sources; runZero matches.
Internet-facing discovery: Censys matches; runZero is not in our sources.
Merges records from several sources: Censys is not in our sources; runZero matches.
Cross-source queries and reports: Censys is not in our sources; runZero partly matches.
Workflows, tickets or actions: Censys matches; runZero is not in our sources.
Price or pricing basis published: Censys partly matches; runZero matches.
Free tier or trial: Censys partly matches; runZero matches.

Can they work together?

Neither vendor's pages we read name the other as an integration. That does not mean they cannot work together; ask both vendors.

Choose Censys if

Your biggest unknown is what you expose to the internet
You want external findings to land in ServiceNow CMDB or an aggregation tool you already run

Choose runZero if

You need to find unmanaged devices on the network, including OT, without agents
You want a published price and a free tier to start

Which limits should you check?

Censys

An external view only: internal devices, SaaS apps and identities are not covered.
Discovery starts from seeds you supply, and ASM pricing goes through sales.

runZero

SaaS applications are not covered on the pages we read.
No workflow or enforcement actions of its own are described; action happens in ServiceNow or other tools.
Ownership changed in September 2026 (Dragos acquisition); roadmap effects are not yet published.

Put Censys and runZero in the asset census with others Run the finder

Questions people ask

Is Censys or runZero better?

Neither is scored on this site. Censys describes 2 of five approaches and runZero 3 on the pages we read, and they differ on 15 recorded facts. Which fits depends on where your assets live, whether you can install agents, your CMDB and your tools; the finder checks those.

Do Censys and runZero work with a CMDB?

Censys: Matches. ServiceNow CMDB is a named integration. runZero: Matches. ServiceNow integration for CMDB enrichment.

Do Censys or runZero publish prices?

Censys: ASM: contact sales. A free Censys platform account exists, and credits start at $100. runZero: Published: Community Edition free for 100 or fewer assets with 30-day retention; runZero Platform starts at $5,000 with 3-year retention; free 21-day trial.