Ory Kratos is an API-first identity system, so its public surface may not look like a conventional login portal. A small external count can still be useful, provided the analyst does not use it to estimate adoption or risk. Sparse observations require more caution, not less.

The selected count-only query for title="Ory Kratos" used scope all, page 1, and one result on 2026-11-03. It returned two matches. The application fingerprint query returned zero in the same run. That combination is a weak external signal. It tells us that a title keyword produced a very small candidate set, not that only two Kratos deployments exist.

Why the sample stays small

Kratos can be deployed headless, behind a custom frontend, or under a product or tenant name that does not include "Ory Kratos" in the page title. A title search therefore misses most deployments by design. Some APIs return JSON or minimal responses rather than pages with titles. A small count is evidence about the query, not a statement about the product's global footprint.

Use the two candidates only as leads. Confirm ownership and product identity through an authorized endpoint or inventory. Do not scan for API paths or test authentication behavior without permission. The fact that an identity service has a public API does not make it safe to probe arbitrary tenants.

Review identity configuration

If the service is owned, review tenant isolation, public API routes, CORS settings, session and cookie configuration, and the exposure of administrative functions. Confirm the identity schema and recovery flows match the business policy. Check logs for unexpected account creation, recovery attempts, and session anomalies.

Identity systems also need version and migration discipline. A small sample can hide that a deployment is behind on security updates or uses a custom frontend with a different control surface. Keep version evidence and configuration ownership separate from an external title count.

Report the evidence plainly

Write the query, scope, page, timestamp, and count. Say "two title matches were observed" rather than "two Kratos services were found." Record the zero-result application query as part of the method. That context prevents a reader from treating a sparse dataset as a complete census.

ZoomEye is useful here as a reminder to check an identity system's external population and to compare it with internal inventory, even when the public count is small. The next step is an owner-led configuration review. For a service that handles authentication, a small number of unknown hosts can still deserve prompt attention.

References