Censys released its fifth annual State of the Internet Report, the definitive industry report on the changing Internet, revealing that exposed AI infrastructure grew 63% in nine months. The report also identified roughly 134,000 Internet-exposed hosts running industrial control systems (ICS), with approximately 70% found on consumer and mobile networks, complicating efforts to identify their owners and address exposure.
The findings reveal a vast and volatile Internet, where AI infrastructure is expanding rapidly, industrial exposures persist, and software maintenance progresses unevenly. Distinct geographic patterns in threat infrastructure further illustrate how different parts of the Internet support different types of attacker activity.
Key Findings from the State of the Internet Report
For this year’s report, the Censys Advanced Research Collective (ARC) analyzed historical and real-time data from the Censys Internet Map, which continuously monitors global Internet infrastructure, to track how the Internet is changing. Key findings include:
- AI global infrastructure is exploding: Internet-facing AI tools grew 63% in nine months, reaching nearly 268,000 systems. This includes not just chatbots, but also the behind-the-scenes tools that connect AI to data, applications, and user accounts.
- n8n is the most widely exposed AI product: n8n, a workflow automation platform, is by far the most commonly exposed at nearly 114,000 hosts, followed by OpenClaw (~54,000), a personal AI agent assistant. The U.S. (62,687), China (42,511) and Germany (31,222) account for just over half of all exposed AI infrastructure.
- North America continues to lead in ICS exposures: As of 2026, roughly 38% of the exposed global ICS landscape is in North America, followed by Europe (32%) and Asia (25%). Roughly 70% of hosts running ICS devices and services globally are consistently found exposed on consumer and mobile networks.
- China and the U.S. host a plurality of observed threat infrastructure: China is home to 36.6% of malicious host-level infrastructure like C2s and remote access tooling in contrast to the U.S.’s 16.8%. The U.S., conversely, hosts 45.5% of web-based threats like phishing and other deceptive pages, while China hosts only 20.9% of web-based threats observed by Censys.
- Organizations are patching, but the oldest software versions linger: Across all four products studied, Progress Telerik Report Server, Jenkins, Cleo MFT, and Microsoft SharePoint Server, organizations adopted newer software versions. However, the oldest versions remained largely unchanged throughout the study.
“The Internet is constantly changing, and understanding how it changes is critical to modern cybersecurity,” said Zakir Durumeric, Co-Founder and CEO of Censys. “New technologies such as AI introduce new layers of infrastructure. Identifying and continuously monitoring Internet-facing systems is essential to realizing AI’s value without introducing unmanaged risk.”
Availability
The Censys 2026 State of the Internet Report is available for download now.
