A new 2026 IoT Security Landscape Report from Bitdefender and NETGEAR analyzed 5.4 billion security events across approximately 10.4 million connected homes, finding that smart TVs, smart plugs and network storage devices account for 67.1% of observed device vulnerabilities.
The average household now has 24 connected devices, up from 22 last year.
Researchers found that 90.1% of detected attack activity involved reconnaissance, as automated tools scanned networks for vulnerable devices. Smart TVs accounted for 22.7% of vulnerability observations, followed by smart plugs (22.4%) and network-attached storage (22%).
The report also found that 99.97% of observed device vulnerabilities involved publicly documented CVEs.
Researchers warned that compromised IoT devices can serve as proxies for malicious traffic, collect sensitive information or provide attackers with access to other devices on home networks.
Denis Calderone, Principal / CTO, Suzu Labs:
“I like how the Bitdefender report reframes devices as proxies, sensors, and footholds, and not just targets. The old question was whether your smart TV could get hacked. The better question is what an attacker can do with the trust, bandwidth, and sensors attached to it. Your television is always on, always connected, and holds a trusted residential IP address, that helps to support an underground economy that is increasingly renting out residential infrastructure for a fee.
“The enterprise CISO has to rethink the network perimeter now. When employees work from home, corporate devices and traffic are now on the same network as the smart plug that no one has, or ever will, patch and a TV that’s already in the business of watching you. Automatic content recognition software samples what you watch and feeds it to advertisers, and researchers this year found proxy SDKs bundled into free TV apps that rent out your home IP address to third parties. The average home now has 24 connected devices, most with little device update support, if any. Smart TVs alone accounted for 270 million vulnerability observations in this report.
“If you’re reading this, the prescription is straightforward enough. Update your router firmware, change default admin credentials, turn off UPnP, enable whatever built-in security features your edge device offers, and put IoT devices on a guest network. But let’s be honest. Most home users are never going to do any of that. They’re not reading cybersecurity trade press, and they’re not logging into a router admin panel on a Saturday afternoon. The burden has to shift to two places. First, the ISPs. They manage the edge device in most deployments, and they should be shipping routers with security enabled by default, auto-updating firmware, and alerting customers when a device on their network starts behaving like a proxy node. Second, enterprise security training. This is a threat that many users and CISOs have not yet aligned on, and if your awareness program doesn’t cover home network hygiene for remote workers, you’re leaving the perimeter undefended. The consumer shouldn’t have to be the security operations center for their own house, but right now nobody else is doing it for them.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“This article looks at the attack surface for home IoT devices. I really feel like we need a similar study for small to medium sized businesses. I think we’d see much the same spread of vulnerabilities across those devices.
“One thing that concerns me is the immense variety of IP cameras and security systems in these businesses. They get installed, almost become part of the building, and then they’re there forever.
“This is definitely eye opening. But I think the broader context matters. Home IoT is just one slice of the problem, and I suspect a similar study of business devices would tell a very familiar story.”
I am getting ready to do an inventory of all my smart devices and lock down anything and everything from speaking to the outside world unless they have a pressing need to do so.
Related
This entry was posted on November 4, 2026 at 7:10 am and is filed under Commentary with tags Bitdefender, Netgear. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Report finds billions of IoT security threats across 10.4 million homes
A new 2026 IoT Security Landscape Report from Bitdefender and NETGEAR analyzed 5.4 billion security events across approximately 10.4 million connected homes, finding that smart TVs, smart plugs and network storage devices account for 67.1% of observed device vulnerabilities.
The average household now has 24 connected devices, up from 22 last year.
Researchers found that 90.1% of detected attack activity involved reconnaissance, as automated tools scanned networks for vulnerable devices. Smart TVs accounted for 22.7% of vulnerability observations, followed by smart plugs (22.4%) and network-attached storage (22%).
The report also found that 99.97% of observed device vulnerabilities involved publicly documented CVEs.
Researchers warned that compromised IoT devices can serve as proxies for malicious traffic, collect sensitive information or provide attackers with access to other devices on home networks.
Denis Calderone, Principal / CTO, Suzu Labs:
“I like how the Bitdefender report reframes devices as proxies, sensors, and footholds, and not just targets. The old question was whether your smart TV could get hacked. The better question is what an attacker can do with the trust, bandwidth, and sensors attached to it. Your television is always on, always connected, and holds a trusted residential IP address, that helps to support an underground economy that is increasingly renting out residential infrastructure for a fee.
“The enterprise CISO has to rethink the network perimeter now. When employees work from home, corporate devices and traffic are now on the same network as the smart plug that no one has, or ever will, patch and a TV that’s already in the business of watching you. Automatic content recognition software samples what you watch and feeds it to advertisers, and researchers this year found proxy SDKs bundled into free TV apps that rent out your home IP address to third parties. The average home now has 24 connected devices, most with little device update support, if any. Smart TVs alone accounted for 270 million vulnerability observations in this report.
“If you’re reading this, the prescription is straightforward enough. Update your router firmware, change default admin credentials, turn off UPnP, enable whatever built-in security features your edge device offers, and put IoT devices on a guest network. But let’s be honest. Most home users are never going to do any of that. They’re not reading cybersecurity trade press, and they’re not logging into a router admin panel on a Saturday afternoon. The burden has to shift to two places. First, the ISPs. They manage the edge device in most deployments, and they should be shipping routers with security enabled by default, auto-updating firmware, and alerting customers when a device on their network starts behaving like a proxy node. Second, enterprise security training. This is a threat that many users and CISOs have not yet aligned on, and if your awareness program doesn’t cover home network hygiene for remote workers, you’re leaving the perimeter undefended. The consumer shouldn’t have to be the security operations center for their own house, but right now nobody else is doing it for them.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“This article looks at the attack surface for home IoT devices. I really feel like we need a similar study for small to medium sized businesses. I think we’d see much the same spread of vulnerabilities across those devices.
“One thing that concerns me is the immense variety of IP cameras and security systems in these businesses. They get installed, almost become part of the building, and then they’re there forever.
“This is definitely eye opening. But I think the broader context matters. Home IoT is just one slice of the problem, and I suspect a similar study of business devices would tell a very familiar story.”
I am getting ready to do an inventory of all my smart devices and lock down anything and everything from speaking to the outside world unless they have a pressing need to do so.
Share this:
Like this:
Related
This entry was posted on November 4, 2026 at 7:10 am and is filed under Commentary with tags Bitdefender, Netgear. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.