Bitdefender, a global cybersecurity leader, released joint research with NETGEAR titled the 2026 IoT Security Landscape Report, an in-depth look at how threats to connected homes are evolving. The research details how the growing Internet of Things (IoT) ecosystem, from smart TVs and streaming boxes to routers and cameras, has expanded consumer exposure to automated cyberattacks and large-scale exploitation. It also finds that these devices are now more than targets, serving as proxies, sensors, and footholds inside the home.
“The increase in connected devices has turned homes into complex digital ecosystems, and every addition gives attackers another doorway in,” said Ciprian Istrate, senior vice president of operations at Bitdefender Consumer Solutions Group. “Cybercriminals are using AI to speed attacks on newly discovered vulnerabilities from days to a matter of hours, putting families at far greater risk. Our research with NETGEAR shows that router-level protection is now critical for defending against malware, identity theft, and increasingly sophisticated scams.”
The 2026 IoT Security Landscape Report draws on telemetry from roughly 10.4 million smart homes globally, collected from January through September 2026. Bitdefender researchers analyzed 5.4 billion security events and 1.2 billion vulnerability observations. The report also examines the year’s landmark incidents, including the dismantling of four IoT botnets by the U.S. Department of Justice and the discovery of proxy software bundled into smart TV apps, which can turn televisions into relays for third-party traffic.
Key findings from the 2026 IoT Security Landscape Report include:
- One device, four attack opportunities – The same vulnerable device can be a target for direct attack, a proxy that relays third-party traffic, a sensor that gathers information, or a foothold into the wider network. Smart TVs, where all four roles converge, led all categories with 270.3 million vulnerability observations, showing how an ordinary product can create risks beyond itself.
- Connected device counts climb as reconnaissance leads attack types – The average household now has 24 connected devices, up from 22 last year. Reconnaissance made up 90.1% of detected attack activity, with automated scans identifying weakly secured networks and devices for larger attacks or botnet recruitment.
- Televisions, plugs, and storage are most exposed – Smart TVs (22.7%), smart plugs (22.4%), and network-attached storage (22%) account for 67.1% of vulnerability observations. Compared with 2025, when streaming devices (25.9%) and smart TVs (21.3%) led the list, the findings signal that long-lived devices that are rarely replaced and often remain online beyond their update and support windows carry the greatest vulnerability burden.
- Nearly all observed device vulnerabilities are publicly known – Flaws cataloged as Common Vulnerabilities and Exposures (CVEs) account for 99.97% of the total, while weak passwords and plaintext authentication make up a fraction of one percent. This finding reinforces the need for timely patching and better device management.
- Phones and TVs top the list of connected devices – Mobile phones account for 20.4% of the devices identified on home networks, followed by TVs (10.6%), computers (10.0%), network equipment (6.2%), and streaming devices (5.4%, down from 7.3% in 2025). Tablets (4.8%) and IP cameras (4.1%) follow.
- Memory errors and service disruption lead potential attack outcomes – Overflow errors account for about 54%, followed by denial-of-service (about 18%) and memory corruption (about 17%), which point to weak memory safety and input validation in device software. The most serious outcomes, giving attackers control of a device or its data, are far less common: privilege escalation (5.3%), code execution (3.8%), and obtaining information (1.2%), about 10.3% combined.
“A connected home depends on more than speed, coverage, and reliability. It also depends on the visibility and protection that services such as NETGEAR Armor™ powered by Bitdefender® bring to activity across the network, plus security at the router level,” said Chandan Nandakumaraiah, head of product and cybersecurity at NETGEAR and member of the CVE Board. “As enterprises get better at protecting their digital infrastructure, cybercriminals are turning to connected home devices. These devices are increasingly smart and powerful, which makes them an ideal foothold: always on, reliable, and rarely monitored. Once inside, criminals can stay hidden and move laterally across the home network. Monitoring, detecting, and blocking these threats is more important than ever.”
