2026 IoT Security Report: When Smart Devices Work for Someone Else Too

Introduction

The average home now contains 24 connected devices, ranging from smart TVs and voice assistants to industrial-grade sensors. This digital proliferation has transformed households into micro-datacenters, each with its own processing power, network access, and data collection capabilities. The promise of convenience and automation comes with an increasingly complex security landscape that most users neither understand nor control.

Across 2026, the conversation has shifted from "can my smart devices be hacked?" to "what could my smart devices be doing for someone else?" The most unsettling discovery is that many devices operate in ways their owners never intended \u2014 sometimes without their knowledge, sometimes with only superficial awareness.

A television, a smart plug, and a network storage box serve very different purposes, yet they share a striking commonality: together, these three categories account for roughly two-thirds of all vulnerability observations recorded across 10.4 million protected home routers between January and September 2026. The data reveals uncomfortable truths about the devices we trust with our homes and our security.

This analysis draws from Bitdefender and NETGEAR's 2026 IoT Security Landscape Report, examining not just whether devices can be breached, but what they could be doing for someone else once connected to a household network. The report captures 5.4 billion security events and approximately 1.20 billion vulnerability observations, providing unprecedented insight into how connected devices serve interests beyond their owners.

The Hidden Jobs Smart Devices Do for Others

For years, the primary security concern was simple: could a device be hacked? In 2026, the report asks a more sophisticated question: what could a device do for someone else once it's on your WiFi? The answer reveals four distinct roles, only one of which resembles a traditional break-in.

What's particularly concerning is that the last three jobs can happen while everything appears normal. The TV still streams perfectly, the smart plug still controls the lamp, but both devices are serving hidden purposes.

The Numbers Don't Lie: Everyday Devices, Massive Exposure

The equipment we keep in our homes is part of the exposure. Televisions generated 270.3 million vulnerability observations, the largest count of any device category. Smart plugs followed with 266.7 million, while network-attached storage (NAS) accounted for 261.6 million.

These figures describe recorded matches between devices and known vulnerabilities. They are not counts of unique vulnerable products or successful attacks. One device can contribute multiple observations across different vulnerability databases.

For consumers, the practical issue is support. A television can remain useful long after its manufacturer stops issuing security updates. A smart plug can sit behind a cupboard for years without anyone checking its firmware. A NAS may hold irreplaceable family photos while running services and software its owner rarely reviews.

Before buying connected equipment, the support period deserves attention alongside the price and features. For equipment already in the home, knowing whether updates are still available is part of knowing whether it should stay connected.

Network Traffic: Mostly Automated Reconnaissance

The report recorded 4.85 billion port scans, accounting for 90.1% of approximately 5.38 billion attack-category events. A port scan checks which services answer at an internet address. It can help an attacker identify potential targets, but it is not evidence that a device was compromised.

Password bruteforcing was the next-largest category, with 466.6 million brute-force events. Of those, 455 million targeted Windows Remote Desktop Protocol (RDP), a service used to access computers remotely.

A household network connects personal computers, storage systems, entertainment devices and other equipment. Activity recorded at the router can target any exposed service behind it. The RDP finding underlines why remote-access services should not be left openly reachable from the internet.

Your TV May Know More Than You Think

The TV is now the riskiest device in most homes, with the largest share of known weak spots in the report (22.7%). TVs stay on the wall for years, often long after the maker stops updating them. One TV model from 2020 still showed up 29.1 million times in the report's data.

Two other things came to light this year:

• Some free TV apps can borrow your internet. They let other companies send their online traffic through your TV, using your home's connection. You agree to it in the fine print when you install the app.
• Some TVs collect more than what you watch. Public reports suggest some TVs can pick up voice recordings, your location and details about other devices in your home, even when the TV appears to be off.

None of this is hacking in the usual sense. But it’s your home and your internet connection, so your privacy settings across your apps are worth a quick look.

The Devices You Forgot You Had

Two of the quietest devices in your home are also among the riskiest:

• Smart plugs (22.4% of weak spots). They're cheap, tucked behind furniture and rarely updated. Once a plug stops being sold, it often stops getting fixes, but it stays connected for years.
• Photo and file drives (22%). If your family photos live on a storage drive plugged into your router, it's a favorite target for criminals who lock up files and demand payment to unlock them.

Add TVs, and these three devices hold 2 in 3 of all the known weak spots in the report.

GOOD NEWS: UPDATES WORK Last year, streaming sticks and boxes were among the riskiest devices in the home. This year they're not, largely because people installed their updates.

When the Problem Comes Built In

Some of 2026's biggest stories weren't about hackers breaking in. They were about devices that had a problem before they ever reached their owners:

• Cameras with a hidden back door. In Slovakia, officials examined 279 newly delivered traffic cameras and found a hidden way to take control of them remotely, including built-in passwords that couldn't be changed. The cameras were kept offline until fixed. About 13,000 similar cameras are in use across Europe.
• Routers with a back door from the factory. Researchers found a hidden way in, installed before shipping, on 20 router models from one Chinese manufacturer.
• Hijacked devices put to work. In March, US authorities shut down four networks built from hijacked everyday devices like routers and cameras. One of them, Aisuru, powered record-breaking attacks in 2025.

THE LESSON FOR HOME A bargain device from a brand you've never heard of can cost more than it saves. Who makes a device, and how long they'll keep it updated, matters as much as the price.

What to Watch for in 2027

• More apps that borrow your internet. Especially on cheap streaming boxes and apps from outside the official app stores. Stick to official app stores and well-known brands.
• One flaw, many brands. Many smart devices, even from different brands, are built from the same off-the-shelf parts and software. That means a single flaw could affect cameras and video recorders from several brands at once, and some makers will fix it much faster than others. Your best defense: choose brands with a track record of regular updates, keep automatic updates switched on, and retire devices whose maker has gone quiet.
• More attention on TV privacy. Expect a closer look at what TVs collect and who they share it with. A few minutes in your TV's privacy settings puts you ahead of the curve.

Your Six-Step Home Checkup

Most smart home risks come from devices that are outdated, set up once and forgotten. All of that is fixable, and most of it takes minutes. Learn more about smart home security in our IoT category.

And if you ever need a hand, we're here to help.

References

• Bitdefender and NETGEAR's 2026 IoT Security Landscape Report

• Slovak authorities' traffic camera investigation, March 2026

• US authorities' shutdown of hijacked device networks, March 2026

• NETGEAR Armor security technology documentation

• Connected device market analysis reports 2024-2026

• Bitdefender 2026 IoT Security Report

• NETGEAR 2026 IoT Security Report

• IoT Security Best Practices