Security and compliance

Self-hosted network reconnaissance and attack surface management

Outpost Ledger · Your own attack surface map, built from your scans, kept on your servers

WatchingDraft scoreMature market · since 2009 · AI estimate

30PWAS score

Confidence

Based on 9 of 9 factors

Overview

AIThis description was written by a model from public signals. The facts behind it are listed under Evidence.

Problem: Organizations need to discover, map, and monitor external network assets and attack surfaces, but commercial services like Shodan, ZoomEye, Censys, and GreyNoise are expensive closed-source platforms that create vendor lock-in and privacy concerns around centralized data storage.
Solution concept: A self-hosted, open-source alternative that lets organizations build and operate their own network reconnaissance infrastructure without vendor lock-in. It would aggregate data from multiple scanning tools (Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools) into a unified platform for network discovery, passive DNS, and external attack surface management, giving full control and privacy over sensitive network intelligence data.
Who has it: Security teams, penetration testers, and infrastructure engineers at organizations of all sizes who need network reconnaissance, threat intelligence, and external attack surface management capabilities.
How they handle it today: Currently, they use commercial hosted services (Shodan, ZoomEye, Censys, GreyNoise) for passive DNS, network scanning results analysis, and external attack surface monitoring. These are typically subscription-based SaaS platforms.
Why now: Not stated in the source.
How it could charge: Inference: Support and professional services around deployment and integration; managed hosting options for organizations that prefer not to self-host; enterprise add-ons for advanced analytics, automation, and threat intelligence enrichment; or consulting for custom implementations tailored to specific organizational needs.

Verdict

Computed from the factor scores below, never written by a model. It decides nothing on its own: only the gate makes an opportunity a build candidate.

Score breakdown

A model sorted each factor into a rubric bucket; code turned buckets into numbers. Unknown factors are left out of the score and lower confidence instead.

Market validation

Confidence 70 · 3 evidence · Multiple established commercial competitors (Shodan, Censys, ZoomEye, GreyNoise) operate in this space, and evidence shows organizations repeatedly express the need for integrated network reconnaissance capabilities.

Revenue evidence

Confidence 95 · 3 evidence · Competitors have substantial proven revenue: Censys raised $70M in funding and offers tiered paid plans; Shodan lists four monthly paid plans ranging from $69–$1,099 plus enterprise pricing.

Growth

Confidence 95 · 1 evidence · The open-source project shows steady, modest growth: 4,167 stars accumulated over 4,409 days equals approximately 0.95 stars per day, indicating consistent interest but not breakout momentum.

Problem severity

Confidence 70 · 2 evidence · Organizations face recurring friction and costs: expensive commercial platforms create vendor lock-in and require ongoing subscription fees, and sensitive network intelligence data stored centrally poses compliance and privacy risks.

Economic proximity

Confidence 30 · Judged from the description · The product directly enables cost reduction by replacing expensive subscriptions and supports lead generation and threat detection within security operations.

Distribution

Confidence 30 · Judged from the description · A self-hosted network reconnaissance tool operates as a private internal security infrastructure; its outputs do not naturally expose the product to non-users outside the organization.

Buildability

Confidence 30 · Judged from the description · Building a credible version requires integrating multiple scanning tools (Nmap, Masscan, Zeek, p0f, ProjectDiscovery), aggregating their output, and building a unified interface—complex work beyond a commodity stack.

Differentiation

Confidence 70 · 2 evidence · Users explicitly name a clear gap: they want self-hosted control, privacy over sensitive data, and freedom from vendor lock-in—capabilities that commercial closed-source competitors deliberately do not offer.

Retention and timing

Confidence 30 · Judged from the description · Network reconnaissance and attack surface monitoring are recurring operational needs within security teams; the shift toward in-house tools and privacy regulation creates a favorable timing tailwind.

Risk penalties

Heavy regulationNetwork reconnaissance and vulnerability scanning sit at the border of security research and regulation; unauthorized network scanning can violate computer fraud laws in some jurisdictions depending on scope and intent.−9
Questionable data accessThe product relies on aggregating data from multiple external scanning sources and open network information; some data sources or enrichment integrations may raise questions about data rights or terms of service.−9
Extreme competitionFour well-funded, established commercial competitors (Shodan, Censys with $70M funding, GreyNoise, ZoomEye) dominate the market with entrenched customer relationships and superior data collection infrastructure.−10

Score history

42 · confidence 50 · config v1First score · 8 Oct 2026
30 · confidence 57 · config v1Evidence changed · 9 Oct 2026

Evidence · 10 items

Market validation

Organizations want to build self-hosted alternatives to expensive commercial network reconnaissance platforms.
Public claim
Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise
GitHubRetrieved 8 Oct 2026
Multiple commercial platforms serve this market: Shodan, ZoomEye, Censys, and GreyNoise.
Public claim
alternatives to Shodan / ZoomEye / Censys and GreyNoise
GitHubRetrieved 8 Oct 2026
The open-source project has significant adoption with over 4,000 stars on GitHub.
AI inference
The model stated this without a quote found in the source.
GitHubRetrieved 8 Oct 2026
Users need integrated network reconnaissance capabilities including passive DNS and network scanning.
Public claim
run your Passive DNS service
GitHubRetrieved 8 Oct 2026

Revenue evidence

Censys sells paid plans with prices on request, on its own pricing page, plus a free plan and prices on request for larger customers
Verified
Core For security analysts who need visibility into IPs, services, domains, and certificates to triage alerts. Contact sales · Adversary Investigation For threat hunting and CTI teams looking to proactively hunt, track, and engineer detections for adversary campaigns and infrastructure. Contact sales · Security Operations For enterprises that want to leverage Censys data across alert triage, IR, threat intel, and detection engineering. Contact sales
censys.comRetrieved 9 Oct 2026
Censys states on its own website: Raised $70 million in strategic funding
Public claim
Censys Raises $70 Million in Strategic Funding to Expand Its Internet Intelligence Platform
censys.comRetrieved 9 Oct 2026
Shodan's pricing page lists 4 paid plans, from $69 to $1,099 a month, plus prices on request for larger customers
Verified
Membership Freelancer Small Business Corporate Enterprise Price $49 (one-time) · Freelancer $69 /month · Small Business $359 /month · Corporate $1099 /month · Enterprise Access Want a local copy of the Shodan database? Our enterprise product provides full access to the Shodan platform including bulk data, real-time firehose, Internet scanning and more.
shodan.ioRetrieved 9 Oct 2026

Growth

GitHub repository gained 4167 stars in 4409 days
Verified
GitHubRetrieved 8 Oct 2026

Differentiation

Users want to run their own external attack surface management tools rather than rely on commercial vendors.
Public claim
build your taylor-made EASM tool, collect and analyse network intelligence from your sensors
GitHubRetrieved 8 Oct 2026
Organizations want control and privacy over network intelligence data instead of sending it to third-party services.
Public claim
self-hosted and fully-controlled alternatives
GitHubRetrieved 8 Oct 2026

Self-hosted network reconnaissance and attack surface management

Overview

Verdict

Build this business

Score breakdown

Risk penalties

Score history

Validation gate

Evidence · 10 items

Market validation

Revenue evidence

Growth

Differentiation

Market

Existing products

Build

Legal reconstruction check

Community