Bitdefender’s 2026 IoT security report draws on nine months of telemetry from roughly 10.4 million protected home routers and finds the internet’s background noise unchanged: relentless, automated, aimed at whatever answers.
Smart plugs came second among weak device families at 22.4%, behind televisions at 22.7% of vulnerability observations. Both share a structural problem, since units run five to ten years, yet firmware support closes after two or four, so these devices stay online carrying holes that will never be fixed.
Automated port scanning made up 90.1% of detected attack events, around 4.85 billion attempts between January and September. Probe traffic hunts for reachable remote desktop, remote login and admin interfaces; an open one gives an intruder a place to start, though no scan proves a break-in.
Password guessing ran at 8.7% of events, 466.6 million tries, roughly 455 million of them against Remote Desktop Protocol, the cheapest door into a home network.
Security firm Spur contributed research on free smart TV apps. Bundled software can turn a television into a residential proxy once a viewer accepts the consent terms, so the home’s broadband carries someone else’s traffic for uses marketed as web scraping, ad verification and market research, with each destination seeing the home’s public address as consent gets given without comprehension. LG sets, per Gamers Nexus, gathered what people watched, voice recordings, location, the other devices on the local network and nearby wireless networks, while Automatic Content Recognition matched content samples against a reference database to support targeted ads.
These totals are router-level detections, stopped scans and blocked exploit patterns, not a count of homes breached, and one device can act as target, proxy, sensor or foothold. Chandan Nandakumaraiah, head of product and cybersecurity at NETGEAR, added that, once inside, criminals stay hidden and cross the home network sideways.
