ONYPHE
French internet-scanning company selling a cyber defense search engine for attack surface management, attack surface discovery and threat intelligence data.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
ONYPHE SAS is a French company registered in 2017 (RCS Brest) and led by president Patrice Auffret. Its registered office is in Cléder, Brittany, after a 2025 transfer from Nantes. The company runs internet-wide scanners in Europe, the United States and Asia and has been collecting IP and URL scan data since 2017. It markets the result as a “cyber defense search engine”.
The offering is organised into three use cases. The ASM Edition provides asset tracking, alerting, Vulnscan and Riskscan with up to four years of history. CTISCAN is a weekly-refreshed scan dataset with passive DNS and infrastructure pivots for threat intelligence. Attack Surface Discovery (ASD) maps an organisation’s and its supply chain’s internet exposure. Access is through a REST API, the ONYPHE Query Language (OQLv2), bulk exports and raw data feeds, and a Python client (pyonyphe) is published on PyPI.
According to ONYPHE’s 2025 retrospective, its monthly data collection grew from 21TB to 125TB. Over the same period it went from scanning 1,300+ to 2,600+ ports weekly, began scanning IPv6 in the ASM Edition, and launched the ASD APIs in beta. Its 2026 roadmap includes 10,000-port CTISCAN coverage, more UDP and IPv6 scanning, and inventory and tagging APIs. The website shows logos for Groupe La Poste, Crédit Agricole, EDF, EssilorLuxottica, Telefónica, CERT Santé and M-CERT, but it does not describe those relationships.
Innovation Matrix Assessment
Its 2025 retrospective reports steady releases: CTISCAN maturity, new fingerprints (HHHash, JA4S), IPv6 in the ASM Edition, production-ready OQLv2 and beta ASD APIs. It also publishes a concrete 2026 roadmap.
It provides practical external-exposure data for SOC, CERT and CTI teams through an API, a query language, bulk exports and a Python client. It is a data and search product rather than a full remediation workflow.
No funding rounds are publicly reported, and the company is small: its 2026 job ads cover a handful of roles. Recognisable French customer logos appear on its site, but traction outside France is not evidenced.
It competes in the established internet-scan search engine category alongside Shodan, Censys and others. Its differentiation is a European data source and CTI pivots, not a new category.
The data volumes it reports (8B+ banners per month, 7B+ FQDNs) and its CERT/CSIRT customer logos suggest real operational use. There are no independent tests or analyst evaluations.
Internet exposure intelligence remains core to ASM and CTI, and a France-based provider has sovereignty appeal for European public and critical-sector buyers.
Why CISOs Should Care
It gives European security teams a sovereign source of internet-scan, passive DNS and vulnerability-exposure data for monitoring their own and their suppliers' attack surface.
What Makes It Different
It is a France-based, self-operated scanning infrastructure with CTI-oriented pivots (favicon, HHHash, JA3S/JA4S) and a long history of data retained for the ASM Edition.
The Matrix Verdict
55/100 — INCREMENTAL INNOVATOR
ONYPHE scores 33/60 (55/100), which places it in the Incremental Innovator tier. It is a capable, steadily improving European internet-scan data provider, but it is small, has no disclosed funding, and works in a crowded category without independent efficacy validation.
Editorial Note: Claims vs. Verified Findings
The scan-volume growth figures, roadmap and customer logos come from ONYPHE's own blog and website. The only independently verifiable facts are its company registration (SAS, 2017, Cléder registered office) and its public PyPI client.
Sources
Alternatives to ONYPHE
watchTowr
Singapore-based platform combining external attack surface management with continuous automated red teaming to validate whether exposures are actually…
CyCognito
Agentless attack surface management platform that maps organizations' entire external footprint, including subsidiaries and shadow assets, using graph-based…
Armis (a ServiceNow company)
Agentless asset intelligence platform discovering and assessing every connected IT, OT, IoT and medical device, now part of…
CybelAngel
External attack surface management and digital risk protection platform that scans the open, deep, and dark web for…
Zafran Security
New York and Tel Aviv-founded exposure management company that maps attack paths across existing security tools to focus…
Axonius
New York-based CAASM pioneer that aggregates data from hundreds of existing tools to build a unified, agentless asset…