Bitdefender and NETGEAR published their 2026 IoT Security Landscape Report on 28 October 2026. It is based on telemetry from roughly 10.4 million home routers protected by the two companies, collected from January to September 2026: 5.4 billion security events and about 1.2 billion vulnerability observations.

Who is exposed

The average home in the data set now has 24 connected devices, up from 22 a year earlier. Three device types lead the vulnerability observations, and together they account for 67.1% of them:

  • TVs: 22.7% (270.3 million)
  • smart plugs: 22.4% (266.7 million)
  • NAS drives: 22.0% (261.6 million)

A year ago streaming devices (25.9%) and TVs (21.3%) were at the top. Smart plugs are the notable newcomer near the top of the list.

Bitdefender's Bogdan Botezatu stresses how to read the numbers. An observation is a match between a device and a known vulnerability, not a unique device and not a successful attack. Almost all of them (99.97%) concern known CVEs, and Cybersecurity Dive notes that patches are available for virtually all of these exposures. Weak passwords and unencrypted logins make up a fraction of one percent, so the problem the data points to is unpatched firmware rather than passwords.

The likely outcomes of exploiting these flaws are mostly overflows (about 54%), denial of service (about 18%) and memory corruption (about 17%). Privilege escalation, code execution and information disclosure together account for about 10%.

What attackers do

Reconnaissance dominates: 4.85 billion port scans out of about 5.38 billion attack events, or 90.1%. Brute-force attempts reached 466.6 million, of which 455 million targeted Windows Remote Desktop.

The report also describes a single device playing four roles: a target, a proxy for someone else's traffic, a sensor that leaks data about the home, and a foothold for moving into the rest of the network. As examples it points to four IoT botnets dismantled by the US Department of Justice and to residential proxy software found inside smart TV apps. Cybersecurity Dive, covering the report, pointed to the business angle: a compromised device at an employee's home, or a forgotten TV in a conference room, can be a way into a company network.

Practical takeaways

The recommendations are simple, and most of them apply equally to a home with Home Assistant and a few dozen Wi-Fi plugs:

  • before buying, check how long the maker promises firmware updates
  • turn on automatic updates and retire devices that no longer get them
  • use unique passwords for each device and account
  • turn off UPnP and port forwarding you do not need, and keep device admin panels off the internet
  • remove TV apps you do not use

For smart plugs there is one more option the report does not mention: plugs that can run local firmware or work over Zigbee or Thread do not need to talk to the internet at all.

Keep in mind that the data comes from routers running the two companies' security products (NETGEAR Armor), so it describes their customers' homes, not every home.