Cybersecurity firm Bitdefender and networking equipment manufacturer Netgear have published the results of a joint study dedicated to the evolution of threats in the Internet of Things segment. The report is based on telemetry data collected from January to September 2026 across 10.4 million smart homes worldwide. The experts analyzed 5.4 billion security-related events and 1.2 billion vulnerability detection instances. According to the authors, connected devices have significantly increased user vulnerability to automated cyberattacks and large-scale malicious campaigns.

Scale of Attacks: Billions of Login and Brute-Force Attempts

During the study period, 4.85 billion login attempts targeting home routers were recorded—averaging two attempts per day for each device. Additionally, 466.6 million brute-force password attempts were detected. The report also examines major incidents, including the dismantling of four IoT botnets by order of the U.S. Department of Justice and the discovery of software in smart TV applications turning them into proxy servers.

Four Attack Scenarios and Vulnerability Leaders

In modern realities, a single device can simultaneously act as the target of four scenarios: a direct attack, transformation into a proxy server, a sensor for information gathering, and an entry point into the network. Among all device categories, smart TVs took first place, as they can combine all four roles—recording 270.3 million vulnerability instances. The most vulnerable devices turned out to be smart TVs (22.7%), smart plugs (22.4%), and NAS network-attached storage devices (22%); combined, they account for 67.1% of identified vulnerabilities.

Dynamics: What Changed Over the Year

The number of internet-connected devices continues to grow: households average 24 connected devices compared to 22 a year earlier. Meanwhile, reconnaissance has become the primary type of attack, accounting for 90.1% of all recorded incidents. Automated scanning systems search for poorly protected networks and devices to use them for larger-scale attacks or to incorporate them into botnets. A year earlier, streaming devices (25.9%) and smart TVs (21.3%) led in vulnerability; current data indicates that long-service-life equipment, which is rarely replaced and often left connected to the network even after updates and support end, faces the highest risk.

Types of Vulnerabilities and Consequences

Almost all identified vulnerabilities are publicly known: in 99.7% of cases, corresponding entries already exist in registries, while weak passwords and credential transmission account for only fractions of a percent. Attacks most frequently trigger memory errors and operational disruptions: buffer overflows account for about 54% of incidents, followed by denial of service (about 18%) and memory corruption (about 17%). The most dangerous consequences, allowing attackers to gain control over hardware, are less common: privilege escalation (5.3%), arbitrary code execution (3.8%), and information access (1.2%)—totaling around 10.3%. Among the most common connected devices, smartphones lead (20.4%), followed by TVs (10.6%), computers (10.0%), streaming devices (5.4% in 2026 compared to 7.3% in 2025), networking equipment (6.2%), tablets (4.8%), and IP cameras (4.1%).