Bitdefender and NETGEAR’s 2026 IoT Security Landscape Report examines the security exposure of everyday connected devices and the growing value of household networks to third parties.

A television, a smart plug and a box holding the family photo archive have very different jobs. In our latest research, they share a striking distinction: together, these three device categories account for roughly two-thirds of all vulnerability observations.

The new 2026 IoT Security Landscape Report from Bitdefender and NETGEAR draws on security events sampled from roughly 10.4 million protected home routers between January and September 2026. Across that period, sensors logged 5.4 billion security events and approximately 1.20 billion vulnerability observations.

The findings put familiar household equipment at the center of the IoT security discussion. Alongside the telemetry, the report examines another question: how can connected devices serve the interests of someone other than their owners?

The equipment we keep is part of the exposure

Televisions generated 270.3 million vulnerability observations, the largest count of any device category. Smart plugs followed with 266.7 million, while network-attached storage, or NAS, accounted for 261.6 million.

These figures describe recorded matches between devices and known vulnerabilities. They are not counts of unique vulnerable products or successful attacks. One device can contribute multiple observations.

For consumers, the practical issue is support. A television can remain useful long after its manufacturer stops issuing security updates. A smart plug can stay behind a cupboard for years without anyone checking its firmware. A NAS may hold irreplaceable files while running services and software its owner rarely reviews.

Before buying connected equipment, the support period deserves attention alongside the price and features. For equipment already in the home, knowing whether updates are still available is part of knowing whether it should stay connected.

Most network activity is automated reconnaissance

The report recorded 4.85 billion port scans, accounting for 90.1% of approximately 5.38 billion attack-category events. A port scan checks which services answer at an internet address. It can help an attacker identify potential targets, but it is not evidence that a device was compromised.

Password bruteforcing was the next-largest category, with 466.6 million brute-force events. Of those, 455 million targeted Windows Remote Desktop Protocol, or RDP, a service used to access computers remotely.

A household network connects personal computers, storage systems, entertainment devices and other equipment. Activity recorded at the router can target any exposed service behind it. The RDP finding underlines why remote-access services should not be left openly reachable from the internet.

A device can serve someone else’s business

Security is also about what an app is authorized to do. The report discusses independent research into residential proxy software embedded in smart-TV apps. This software can relay third-party internet traffic through a household’s connection, making requests appear to originate from that home.

Some providers offer participation as an alternative to advertising and say they require consent and restrict customer use. The question for the owner is whether the agreement makes the consequences clear: who uses the connection, what they can do with it, and how participation can be stopped.

These commercial arrangements differ from malware that secretly recruits devices into a botnet. Both, however, show why the household’s internet address and bandwidth can have value to other people.

Protect the whole network

Start by checking which devices are connected and which still receive updates. Enable automatic firmware updates where available and retire equipment whose security support has ended. Use unique passwords and remove default credentials.

Review remote-access settings on computers, routers and NAS devices. Disable unnecessary port forwarding and UPnP if you do not need it. Keep administration interfaces off the public internet, and maintain a separate backup of important files.

For TVs and streaming devices, remove unused apps and review privacy, viewing-data and connection-sharing settings. An app’s usefulness should not obscure what it asks to do in the background.

Network-level protection, including NETGEAR Armor powered by Bitdefender, can help households identify connected devices and detect threats across equipment that cannot run conventional endpoint security software. It complements updates, careful configuration and informed choices about the services a device enables.

Download the 2026 IoT Security Landscape Report for the full findings and guidance.