The first machine started getting attacked almost immediately. Andrew Morris, then a cybersecurity researcher with a fondness for strange data, had put an SSH honeypot on a bargain virtual server. The hosting company promised a server for life for something like $10 - an offer whose arithmetic looked less convincing the longer one stared at it. Morris bought about ten anyway, scattered them among data centers and watched strangers hammer at the doors.
At first, the attention felt specific. Then he centralized the logs in Splunk. The flattering theory collapsed. The same bots, probes and brute-force attempts were knocking on every server. Nobody had singled him out. He was watching the automated weather of the public internet.
That distinction became GreyNoise Intelligence. Founded in 2017, the Washington, D.C. company runs a distributed network of deception sensors that wait for scanners and attackers to arrive. GreyNoise captures what they do, classifies their infrastructure and behavior, and sends the context into the tools security analysts already use. The core question is not simply whether an IP address has done something malicious. It is whether that IP is spraying the same behavior across the internet or doing something peculiar to you.
“Most alerts are malicious. It’s just what we refer to as everywhere malicious - it’s not targeted.”Andrew Morris, founder and chief architect
A smoke alarm for the whole neighborhood
Security operations centers have spent years buying products that detect more. That made sense until detection became industrialized. A port scan, password spray or exploit attempt can be genuinely hostile and still be low priority because the sender is trying the same move on millions of addresses. Every alert costs an analyst attention. Enough accurate but unimportant alerts become their own operational failure.
GreyNoise works like a neighborhood watch with an unusually large street map. Its sensors see the knock elsewhere, record the hand that knocked and attach labels: benign scanner, malicious bot, suspected activity, known business service, exploit associated with a CVE. The company says its grid now includes more than 5,000 sensors across 80 countries and processes over 500 million sessions a day. It observes hundreds of thousands of unique IPs daily and applies thousands of behavioral descriptors.
The output appears in a Visualizer, an API, data feeds and integrations with SIEM, SOAR, firewall and threat-intelligence products. Analysts can look up one address, investigate a cluster with GreyNoise Query Language, monitor a vulnerability or automatically enrich every IP-based alert. A green or benign label can remove routine business scanning. A malicious classification with observed exploit behavior can justify blocking. An address absent from the dataset can be interesting for the opposite reason: perhaps it is not scanning everyone.
What broke first: the feeling of being special
Morris’s first failed assumption was the useful one: that attacks arriving at his server were about his server. Comparing several listening posts showed repetition instead. GreyNoise built the company around that disillusionment. In its early language, it called the product “anti-threat intelligence” because it often told a customer which alert not to chase.
Another assumption broke when the company tried charging by query volume. A smaller but highly automated customer might need 100,000 lookups to get the same practical value that another customer found with far fewer. Query count was tidy for the seller and arbitrary for the buyer. GreyNoise moved toward packaging based on platform capability, freshness, historical recall and intelligence modules. It is a good lesson hiding inside a niche security product: the easiest unit to meter is not necessarily the thing the customer values.
The current model combines a free community plan with quote-based Standard, Advanced and Elite tiers. Buyers add Triage, Investigate or Hunt modules, then specialized products such as Vulnerability Prioritization, Business Services Intelligence or C2 Detection. Paid plans include integrations without per-user licensing. Public dollar prices are not posted. The approximately $100 prototype is delightfully specific; today’s enterprise bill requires a sales conversation.
Subtraction has customers
The buyer is usually a security team with too much edge telemetry and too few people: a corporate SOC, managed security provider, incident-response group, threat-hunting team, cloud operator or government agency. Hurricane Labs faced the old choice between hiring more analysts and shrinking the queue. After using GreyNoise in its managed services workflow, it reported that triggered alerts fell 25 percent. A hospitality and food-service company said automated enrichment in Cortex XSOAR saved its four-person team about 40 analyst hours each month.
GreyNoise said in 2024 that more than 150 customers used the platform. Its current site claims more than 80,000 users, 400 government agencies, 11 U.S. federal agencies and reach into 60 percent of the Fortune 1000. Named users include Hurricane Labs and Expel. The U.S. Department of Defense awarded a production contract in 2021 with a $30 million ceiling. The company has raised roughly $21 million, most recently a $15 million Series A led by Radian Capital in 2022.
Those figures explain why the free tier matters. A lone researcher can perform basic lookups without procurement. GreyNoise explicitly treats community members as future customers who may carry the habit into their next job. Researchers can receive expanded access, contribute feedback and request new tags. The free product is not charity pasted onto the side of the sales machine. It is distribution, product testing and professional muscle memory.
The product grew past “ignore this IP”
Noise reduction remains the memorable hook, but the company now sells a wider view of the attack lifecycle. Vulnerability intelligence links CVEs to observed exploitation rather than severity scores alone. Teams can see when exploitation appeared, how many IPs are active and which botnets or behaviors are involved. That helps answer a patching question executives actually ask: is anyone using this vulnerability in the wild?
In 2025, GreyNoise released a Model Context Protocol server so compatible AI agents could query its data. The useful idea is not “AI for cyber” as decoration. An agent needs current evidence before deciding whether an IP should be dismissed, escalated or investigated. GreyNoise supplies that grounding through the same vocabulary its human users know.
In April 2026, C2 Detection pushed the company beyond inbound activity. Edge devices such as firewalls and VPN concentrators often cannot run endpoint-detection software. When compromised, their visible clue may be a quiet outbound connection. The module matches those callbacks to attacker infrastructure, adds malware hashes and separates stages of an attack. In GreyNoise terms, the product now hears both the knock at the door and the phone call made from inside the house.
Project Swarm opened another flank. Participants deploy lightweight deception sensors, keep access to their raw sessions and compare local traffic with GreyNoise’s global baseline. Tactics, released in July, maps qualifying post-compromise commands and actions to the MITRE ATT&CK framework. The private observation grid becomes a collective research project - and potentially a broader source of device profiles, detection rules and unusual attacker behavior.
Not Shodan with a different coat
GreyNoise is regularly grouped with Shodan, Censys, VirusTotal and large threat-intelligence platforms. The overlap is real, but the questions differ. Shodan and Censys actively scan and index what is exposed on the internet. VirusTotal aggregates judgments and artifacts across files, URLs, domains and IPs. Broad intelligence platforms correlate many kinds of indicators and adversaries. GreyNoise emphasizes what scanners and exploiters do when they arrive at controlled sensors.
| Tool type | The question it answers | Best use |
|---|---|---|
| GreyNoise | Is this source scanning everyone, and how? | Triage, edge threats, exploitation behavior |
| Asset search | What systems and services are exposed? | Discovery and attack-surface research |
| Broad threat intel | What is known about this indicator or actor? | Correlation, attribution and investigation |
A mature team may use all three. GreyNoise’s defensibility is less the interface than the accumulated, geographically distributed observation network and the classifiers built on it. The dashboard can be copied. Years of consistent attacks against thousands of believable decoys are harder to summon.
A founder changes seats, and the aperture widens
In February 2024, Morris handed the CEO role to Ash Devata, who had led product at Duo and later Cisco’s Duo and zero-trust businesses. Morris became chief architect, concentrating on product invention, adversary research and customer contact. The shift did not read as an exit. It looked like a founder admitting which work he was unusually good at and hiring for the part that had become a different profession.
Since then, GreyNoise has moved from a crisp anti-noise utility toward a platform for edge intelligence: vulnerability prioritization, integrations with Microsoft Copilot for Security, CrowdStrike and Google Security Operations, AI-agent access, outbound C2 signals and community sensors. The stated mission - “no attack works twice” - gives that expansion a boundary. Observe an attack at patient zero, turn the interaction into evidence and distribute protection before the technique reaches the next organization.
What a builder can copy
- Collect the negative space. Competitors catalog threats; GreyNoise began by cataloging what a team could dismiss.
- Centralize before theorizing. One honeypot felt targeted. Ten comparable logs revealed a system.
- Give the product away at the moment of curiosity. A free IP lookup creates a habit before a sales cycle exists.
- Integrate where the decision happens. Context inside a SIEM or firewall is more useful than another dashboard to remember.
- Price the outcome, not database motion. Query volume was measurable, but it did not track customer value.
Where the noise-canceling stops
The approach works best when an event contains an IP address and the actor behaves across enough of the internet to be observed. It is weaker against a patient adversary that targets one organization, uses infrastructure only briefly or never touches the sensor grid. Shared hosting, carrier-grade NAT, residential proxies and compromised consumer devices can muddy conclusions about who controls an address. A label is context, not a verdict.
An absent IP may be new, short-lived or specifically targeted. Unknowns often deserve more investigation, not less.
An opportunistic exploit can still succeed. Deprioritization depends on exposure, controls and local evidence.
Cloud hosts, VPNs and residential proxies change hands. Attribution requires more than a reputation label.
GreyNoise complements EDR, vulnerability management, logging and response. It does not replace them.
That caveat is also the product’s discipline. GreyNoise is useful because it does not pretend every malicious event deserves identical urgency. It gives defenders a comparative view and asks them to combine it with local facts. The payoff is not a world without alarms. It is a room quiet enough to hear the strange one.