ASSET DISCOVERY & BASELINE SYSTEM
Automated discovery of what runs on your network.
Continuous infrastructure inventory, dependency mapping, host security posture, and NIS2 and DORA controls measured on collected data — with two sentinels, Dobermann and Honeypot, watching what an inventory alone cannot see. No inbound ports required.
REGISTER TO TRIAL
Why inventories go stale
Not for lack of trying: the inventory was done once, by hand, and the estate kept moving from that day on.
“The asset spreadsheet is two years old.”
A manual inventory is accurate on the day it is closed.
“We don’t know what stops if that server goes down.”
The gap is dependencies, not assets.
“We pay licences for machines that no longer exist.”
The asset register no longer matches reality.
“We’ve been asked to demonstrate NIS2 compliance.”
The directive requires knowing what you have before protecting it.
Four capabilities usually bought separately
One platform collects the inventory automatically and on a schedule, reconstructs dependencies, and builds the rest on top.
CMDB
What is deployed, how it is configured, how it changed, what depends on what — with history, because the real question is what changed.
Asset and capacity register
Owner, cost centre, value, contracts and warranties approaching expiry — and how much headroom is left.
Traffic
What talks to what, and what the network exposes.
Security, compliance and active defence
Host posture, NIS2 and DORA on the same data — plus Dobermann and Honeypot.
And an audit trail underneath all of it: who signed in, and who changed what. It is the first line an auditor asks for.
Three components, one direction of traffic
outbound only · HTTPS + mTLS
The probe
Runs inside your network and performs the scans. It exposes nothing and accepts no connections.
The control plane
Receives, normalises, reconciles and stores. It never initiates a connection towards your network.
The console
Where the data is reviewed, scans are planned, and the result is taken into a meeting.
No inbound ports to open. No VPN into your network. Multiple probes per customer, with automatic job failover: if one stops, the work moves to another.
Everyone shows a green percentage
Censo declares what it could not measure. It is not a footnote: it is a product decision, enforced in four separate places.
“Not applicable” is not “not assessable”
Backup is not required of a printer. Missing data is a different thing — and the reason states how to obtain it.
CVEs with the denominator
No vulnerabilities across 4 recognised of 380 and none across 380 of 380 read identically without that number.
The fact, not the verdict
Not “Telnet is enabled”, but telnet listening — port 23, observed 06/09. Ten seconds to verify.
A truncated list says so
In a security context, “nothing found” quickly becomes “nothing there”.
Four outcomes, not three
A real card: four controls on one host, each with its reason next to it and the denominator at the bottom. The not assessable row is the one no other product shows, because it lowers the score.
NIS2 · srv-erp-01
06/09 · 04:12
Supported operating system
Ubuntu 22.04 LTS · end of support 04/2027
compliant
Cleartext services
telnet listening — port 23, observed 06/09
critical
Service encryption
no check performed — run “Assess and check services”
not assessable
Software within lifecycle
2 packages past end of support
partial
No known vulnerabilities across 4 recognised packages of 380.
Sources, one console
The list is not the argument. The argument is that they sit in one place: bought separately, they end up in four consoles that do not talk to each other.
Network
SNMP v1/v2c/v3, sweep and deep scan
L2 topology
CDP and LLDP — what is on which port
MAC table
what sits behind a silent port
Servers
SSH, WMI over DCOM, remote registry
Closed machines
inventory agent, signed installer
Virtualisation
VMware, Nutanix, Sangfor, Proxmox, ZStack
Cloud
AWS, Azure, GCP, Oracle Cloud
Directory
Active Directory over LDAP
Power continuity
UPS-MIB and vendor MIBs
Device configurations
scheduled device backup
Traffic
NetFlow, IPFIX, sFlow; ntopng
Agentless by default. The agent exists only for machines that cannot be reached any other way — vendors who sell agents have to ask you to put one on everything.
Run a trial on a single site
We call you back within one business day and agree which site to use. You provide a machine on the network and a read-only SNMP community: we handle the rest.