For most of the last decade, the IoT security question was simple: can this device be hacked? The 2026 IoT Security Landscape Report from Bitdefender and NETGEAR argues that question is now too small.
Built on January–September 2026 telemetry from roughly 10.4 million routers protected by Bitdefender smart-home technology (sold as NETGEAR Armor), the report logs 5.4 billion security events against the devices sitting behind those routers. It then asks a sharper set of questions: What can this device see? What network position does it hold? And what can an adversary do with the trust, bandwidth, or sensors attached to it?
The answer is a four-part model that every enterprise defender should borrow:
Target – The device is scanned, brute-forced, exploited, or knocked offline. The classic model.
Proxy – Its residential IP address and bandwidth get rented out to relay someone else's traffic.
Sensor – It sees or hears the physical world, and that observation has buyers.
Foothold – It holds a persistent, trusted position, and whoever controls it controls what sits behind it.
The report's punchline: the smart TV is the one device where all four roles converge in a single chassis.
The ambient pressure on home networks is relentless, and almost entirely automated.
24 connected devices per household, up from 22 in last year's edition
4.85 billion port scans, or 90.1% of attack-category events. That works out to roughly two scans per router, every day, for nine months.
466.6 million brute-force attempts (8.7% of the stream). Of those, 455.0 million, or 97.8%, targeted RDP. SSH, FTP, HTTP, SMB, Telnet, and Kerberos split the leftovers.
91,846 matched exploit patterns, a rounding error at 0.002% of the stream
The report is careful to note that an event is a detection record, not proof of compromise. Most of what it counts is industrial scanning machinery probing anything that answers.
The vulnerability data are where the real story sits. Known CVEs account for 99.97% of vulnerability observations. Weak passwords and plaintext HTTP Basic Auth together make up a few hundredths of a percent. Nearly half of all observations (46.9%) score exactly CVSS 7.8, which the researchers read as the fingerprint of a handful of common consumer firmware baselines, scored once and inherited everywhere.
By flaw type, overflow errors dominate at about 54%, followed by denial of service (~18%) and memory corruption (~17%). The categories that map most directly to attacker objectives—namely privilege escalation (5.3%), code execution (3.8%), and information disclosure (1.2%)—total about 10.3%. Small share, outsized consequence.
Three device classes absorb 67.1% of all CVE observations:
Smart TVs: 22.7% (270.3 million observations, the largest of any class)
Smart plugs: 22.4% (266.7 million)
NAS devices: 22% (261.6 million)
That's a shift from 2025, when streaming devices (25.9%) and smart TVs (21.3%) led, according to the companies' press release.
The concentrations are striking. A single model label, the 2020 LG OLED C-series, still appears 29.1 million times six years after release. LG-branded labels together carry 197.4 million observations, 16.6% of the rollup, though the report explicitly cautions this reflects how common these sets are in its dataset, not a ranking of LG's security practices. On the storage side, WD MyCloud (153.8M), Synology (48.5M), and QNAP (23.3M) together hold 18.7% of everything, and the National Vulnerability Database logged 48 QNAP CVEs and 13 Synology CVEs in 2026 through late September.
What unites these devices isn't chipset or vendor; it's arithmetic. The report pins the problem on replacement cycles of five to 10 years running against support windows of two to four. Smart plugs are the purest case: the cheapest networked computer a household will ever buy, with margins that leave no room for a patch pipeline. End of sale usually means end of support, and the plug stays in the wall for years.
The most consequential finding for enterprise security teams may be the least technical.
In July 2026, security firm Spur documented SDKs bundled into free smart-TV apps that open a local proxy listener on the television. The household's broadband then carries third-party traffic, marketed as AI web scraping, ad verification, and market research. Users click through a EULA at install; providers call it consented infrastructure.
The report draws a direct line to BADBOX 2.0, the Android TV box botnet the FBI warned in June 2025 had compromised more than a million devices. The mechanisms differ: BADBOX stole the connection, while the SDK model buys it cheaply from users who may not know what a residential proxy is. But as the report puts it, to the network, the two exits look identical.
That matters well beyond the living room. Residential exit nodes exist because household IP addresses inherit trust that data-center addresses never get. Every credential-stuffing run, scraping campaign, or account-takeover attempt routed through a television in a suburban home arrives at your login page looking like a customer. The report's first 2027 prediction is that proxy operators will move toward cheap Android TV boxes, sideloaded apps, and alternative app stores as major TV platforms tighten enforcement.
Drawing on reporting from Gamers Nexus, the report describes LG TVs that may collect voice recordings, details of other devices on the local network, location, and nearby wireless networks, with collection potentially continuing while the set appears to be off. Underneath sits Automatic Content Recognition (ACR), which fingerprints what's on screen to feed advertising. Gamers Nexus cited footage of LG executives saying "we own the glass" and estimated roughly 216 million devices may behave this way, a figure Bitdefender says it has not independently verified.
The report frames this as a consent story, not a hack, and notes that Gamers Nexus expects other manufacturers to behave similarly. For enterprise defenders, the distinction is academic. As Cybersecurity Dive's Eric Geller pointed out in his coverage, many businesses mount TVs in conference rooms and then largely ignore them. A microphone-equipped device that maps its network and phones home is a sensor in your boardroom, regardless of whether a criminal or an ad platform is on the other end.
Two of the year's public incidents show what happens when IoT sensors sit inside critical infrastructure.
In August 2026, Slovakia's National Security Authority (NBÚ) issued an advisory on NERO R-ONE road-enforcement cameras, Chinese-origin hardware imported through a European reseller. Analysis found an SMS-triggered remote shell through the cellular module, hardcoded credentials for an unauthenticated root account, a default module password permitting FTP and HTTP access, and Secure Boot disabled. Of 861 units planned nationwide, 279 had been delivered and analyzed; the advisory references roughly 13,000 similar cameras across EU member states. Slovak authorities warned the devices "could be exploited to surveil critical infrastructure, record traffic, or be activated en masse," and recommended keeping them off operational networks until remediated.
The report also cites Financial Times reporting that Tehran's traffic cameras had reportedly been compromised for years ahead of the February 2026 strike that killed Iran's Supreme Leader, with feeds used to build a "pattern of life" around the leadership. The report is careful here: the cameras were one intelligence stream among many, and much remains classified. Its takeaway is narrower and more useful: the camera was never the decision maker; it was the persistent, well-placed sensor that made everyone else's information timely.
Rounding out the year: researchers found a factory-shipped backdoor in 20 Zbtlink router models, and the U.S. Department of Justice dismantled four IoT botnets: Aisuru, Kimwolf, JackSkid, and Mossad.
Bitdefender's Ciprian Istrate, SVP of Operations for the company's Consumer Solutions Group, said in the launch announcement that attackers are using AI to compress exploitation of newly-disclosed vulnerabilities from days to hours, and that the research shows router-level protection is now critical.
NETGEAR's Chandan Nandakumaraiah, head of product and cybersecurity and a member of the CVE Board, made the enterprise connection explicitly: as companies harden their own infrastructure, criminals are pivoting to home devices because they're "always on, reliable, and rarely monitored." Once inside, he said, attackers can stay hidden and move laterally across the home network.
Two caveats are worth holding onto. First, the report carries its own disclosure: Bitdefender powers NETGEAR Armor and has a commercial interest in its distribution, so the router-centric remedy is not a neutral recommendation. Second, there's a tension between the AI-speed narrative and the report's own data. If 99.97% of exposure is known, already-cataloged CVEs and matched exploit attempts are 0.002% of traffic, the binding constraint isn't how fast attackers move; it's how long devices outlive the attention of the companies that built them.
The report is written for consumers, but its findings map cleanly onto enterprise risk:
The executive home network is a perimeter. The NAS holding the family photo archive sits on the same LAN as the laptop holding board materials. Nandakumaraiah's lateral-movement warning applies to anyone who works from home.
Your enterprise has the same three rooms. Conference-room displays, digital signage, smart plugs in facilities, and NAS boxes in branch offices follow the same five-to-10-year replacement cycle against the same two-to-four-year support window.
IP reputation is eroding as a control. If televisions and plugs are exit nodes, fraud and bot defenses that lean on "residential equals trustworthy" are working from a stale assumption.
Firmware is a shared supply chain. The report's second 2027 prediction is more multi-vendor disclosures driven by shared firmware components, connectivity libraries, and hardware platforms, followed by uneven patch availability that leaves some products exposed after others are fixed.
Privacy scrutiny is coming. The report's third prediction is that regulators and researchers will trace how TV viewing data, device activity, and linked accounts combine into household profiles, a concern that extends to any connected display on a corporate network.
Inventory and segment every display, plug, camera, and NAS. Put them on isolated VLANs, with no internet-facing admin panels and UPnP disabled at the edge.
Make end-of-support a retirement trigger. Track vendor support dates in asset management, not just purchase dates. The report's rule for plugs works for most cheap IoT: if the vendor app is gone, the device should be too.
Lock down managed TVs. Restrict app installs, strip unused apps, and turn ACR and voice features off wherever the business doesn't need them.
Watch for proxy behavior. Unexpected outbound volume or persistent connections from displays and streaming devices deserve the same scrutiny as a workstation beaconing out.
Extend executive protection to the home router. Scheduled firmware updates, default credentials killed, NAS kept LAN-only.
Raise the procurement bar. Slovakia's experience is a procurement lesson as much as a security one. Verify Secure Boot, test for hardcoded credentials, and demand firmware provenance before devices touch operational networks.
The headline numbers in this report are big: 10.4 million households, 5.4 billion events, billions of scans. But the most important figure is the smallest-looking one: 99.97%. Nearly all the exposure Bitdefender and NETGEAR measured is already known, already cataloged, and in most cases, already fixed somewhere upstream.
Attackers aren't out-innovating the smart home; they're out-waiting it. The device on the wall keeps working long after anyone stops watching it, and in 2026, that makes it a target, a proxy, a sensor, and a foothold all at once.