Bitdefender and NETGEAR 2026 IoT Report Reveals Growing Threat Exposure Throughout the Connected Home

Publicly cataloged flaws accounted for 99.97% of observed device vulnerabilities in the research.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

Global Analysis of 5.4 Billion Security Events Finds Homes Now Average 24 Connected Devices That Can Serve as Targets, Proxies, Sensors, and Footholds

BUCHAREST, Romania & SAN ANTONIO--(BUSINESS WIRE)-- Bitdefender, a global cybersecurity leader, today released joint research with NETGEAR titled the 2026 IoT Security Landscape Report, an in-depth look at how threats to connected homes are evolving. The research details how the growing Internet of Things (IoT) ecosystem, from smart TVs and streaming boxes to routers and cameras, has expanded consumer exposure to automated cyberattacks and large-scale exploitation. It also finds that these devices are now more than targets, serving as proxies, sensors, and footholds inside the home.

“The increase in connected devices has turned homes into complex digital ecosystems, and every addition gives attackers another doorway in,” said Ciprian Istrate, senior vice president of operations at Bitdefender Consumer Solutions Group. “Cybercriminals are using AI to speed attacks on newly discovered vulnerabilities from days to a matter of hours, putting families at far greater risk. Our research with NETGEAR shows that router-level protection is now critical for defending against malware, identity theft, and increasingly sophisticated scams.”

The 2026 IoT Security Landscape Report draws on telemetry from roughly 10.4 million smart homes globally, collected from January through September 2026. Bitdefender researchers analyzed 5.4 billion security events and 1.2 billion vulnerability observations. The report also examines the year’s landmark incidents, including the dismantling of four IoT botnets by the U.S. Department of Justice and the discovery of proxy software bundled into smart TV apps, which can turn televisions into relays for third-party traffic.

Key findings from the 2026 IoT Security Landscape Report include:

• One device, four attack opportunities - The same vulnerable device can be a target for direct attack, a proxy that relays third-party traffic, a sensor that gathers information, or a foothold into the wider network. Smart TVs, where all four roles converge, led all categories with 270.3 million vulnerability observations, showing how an ordinary product can create risks beyond itself.
• Connected device counts climb as reconnaissance leads attack types - The average household now has 24 connected devices, up from 22 last year. Reconnaissance made up 90.1% of detected attack activity, with automated scans identifying weakly secured networks and devices for larger attacks or botnet recruitment.
• Televisions, plugs, and storage are most exposed - Smart TVs (22.7%), smart plugs (22.4%), and network-attached storage (22%) account for 67.1% of vulnerability observations. Compared with 2025, when streaming devices (25.9%) and smart TVs (21.3%) led the list, the findings signal that long-lived devices that are rarely replaced and often remain online beyond their update and support windows carry the greatest vulnerability burden.
• Nearly all observed device vulnerabilities are publicly known - Flaws cataloged as Common Vulnerabilities and Exposures (CVEs) account for 99.97% of the total, while weak passwords and plaintext authentication make up a fraction of one percent. This finding reinforces the need for timely patching and better device management.
• Phones and TVs top the list of connected devices - Mobile phones account for 20.4% of the devices identified on home networks, followed by TVs (10.6%), computers (10.0%), network equipment (6.2%), and streaming devices (5.4%, down from 7.3% in 2025). Tablets (4.8%) and IP cameras (4.1%) follow.
• Memory errors and service disruption lead potential attack outcomes - Overflow errors account for about 54%, followed by denial-of-service (about 18%) and memory corruption (about 17%), which point to weak memory safety and input validation in device software. The most serious outcomes, giving attackers control of a device or its data, are far less common: privilege escalation (5.3%), code execution (3.8%), and obtaining information (1.2%), about 10.3% combined.

“A connected home depends on more than speed, coverage, and reliability. It also depends on the visibility and protection that services such as NETGEAR Armor™ powered by Bitdefender® bring to activity across the network, plus security at the router level,” said Chandan Nandakumaraiah, head of product and cybersecurity at NETGEAR and member of the CVE Board. “As enterprises get better at protecting their digital infrastructure, cybercriminals are turning to connected home devices. These devices are increasingly smart and powerful, which makes them an ideal foothold: always on, reliable, and rarely monitored. Once inside, criminals can stay hidden and move laterally across the home network. Monitoring, detecting, and blocking these threats is more important than ever.”

Bitdefender and NETGEAR continue to address these challenges through NETGEAR Armor™ powered by Bitdefender®, a built-in security platform available on NETGEAR’s Nighthawk routers and Orbi Mesh WiFi systems. Armor helps detect and block known and emerging threats, identify vulnerabilities, and safeguard users against phishing, data theft, and other attacks—helping families maintain a safer, more resilient smart home environment.

To download a copy of the full 2026 IoT Security Landscape Report, visit our website.

About Bitdefender

Bitdefender is a cybersecurity leader delivering best-in-class threat prevention, detection, and response solutions worldwide. Guardian over millions of consumer, enterprise, and government environments, Bitdefender is one of the industry’s most trusted experts for eliminating threats, protecting privacy, digital identity, and data, and enabling cyber resilience. With deep investments in research and development, Bitdefender Labs discovers hundreds of new threats each minute and validates billions of threat queries daily. The company has pioneered breakthrough innovations in antimalware, IoT security, behavioral analytics, and artificial intelligence. Its technology is licensed by more than 180 of the world’s most recognized technology brands. Founded in 2001, Bitdefender has customers in 170+ countries with offices around the world. For more information, visit https://www.bitdefender.com.

Trusted. Always.

About NETGEAR

Founded in 1996 and headquartered in the USA, NETGEAR® (NASDAQ: NTGR) is a global leader in innovative networking technologies for businesses, homes, and service providers. NETGEAR delivers a wide range of award-winning, intelligent solutions designed to unleash the full potential of connectivity and power extraordinary experiences. For businesses, NETGEAR offers reliable, easy-to-use, high-performance networking solutions, including switches, routers, access points, software, and AV over IP technologies, tailored to meet the diverse needs of small and medium enterprises. NETGEAR’s consumer products deliver advanced connectivity, powerful performance, and enhanced security features right out of the box, designed to help keep families safe online, whether at home or on the go. More information is available from the NETGEAR Press Room or by emailing pressrelations@netgear.com. Connect with NETGEAR on LinkedIn, Facebook, Instagram and the NETGEAR blog at NETGEAR.com.

View source version on businesswire.com: https://www.businesswire.com/news/home/20261028263954/en/

Steve Fiore
Bitdefender
1-954-776-6262
sfiore@bitdefender.com

Source: Bitdefender

Key Terms

internet of things technical

A network of everyday objects—like appliances, machines, vehicles, and sensors—connected to the internet so they can send and receive information and act automatically, like a thermostat that learns your schedule or a factory machine that reports wear. Investors care because these connected devices create new revenue streams, recurring service and data opportunities, and efficiency gains, while also concentrating risks such as security vulnerabilities and ongoing maintenance costs.

cves technical

CVEs (Common Vulnerabilities and Exposures) are unique ID numbers assigned to publicly known security flaws in software or hardware, like a catalog entry that describes a specific weak spot. For investors, CVEs matter because they signal potential risks to a company’s systems and customer data—similar to a product recall number that warns of problems requiring fixes, which can lead to costs, downtime, regulatory scrutiny, or reputational damage.

denial-of-service technical

A denial-of-service (DoS) attack is an intentional action that makes a computer system, website, network, or online service unavailable to its legitimate users by overwhelming it with excessive traffic, exploiting a software or protocol weakness, or otherwise consuming its resources. A distributed denial-of-service (DDoS) is the same effect produced from many sources at once, typically using networks of compromised devices; the practical result is service interruption or degraded performance until the attack is stopped or the system is mitigated.

privilege escalation technical

Privilege escalation is when someone gains higher access rights in a computer system than they are supposed to have, for example turning a basic user account into an administrator. Think of it like a visitor finding a master key that opens restricted offices: it can expose sensitive data, disrupt operations, or allow malicious actions. For investors, such breaches can lead to financial losses, regulatory fines and lasting reputational damage that affect a company’s value.

code execution technical

The process by which a computer, server, virtual machine, or other programmable device carries out a sequence of programmed instructions. When code is executed those instructions are read and performed by a processor or interpreter, producing outputs and often changing the system’s state (for example updating memory, writing files, sending network messages, or modifying a database). Code execution can run locally on a device or remotely on a server or cloud environment, and may involve compiled machine code, interpreted scripts, or bytecode run by a virtual machine.