The numbers behind the gap
The average home now runs 24 connected devices, and most of them are running on borrowed time. NETGEAR and Bitdefender's 2026 IoT Security Landscape Report, built from anonymized data covering about 10.4 million homes between January and September 2026, found that families keep smart devices for five to ten years while most manufacturers push security updates for only two to four. That gap is where the risk lives.
The report recorded 4.85 billion automated attempts to break into home networks across those nine months. That works out to roughly two attempts per home per day, every day, from software scanning millions of addresses for an easy target like a device still using its factory password. Password guessing alone accounted for 466.6 million of those attempts.
The threat model has changed
The report's central finding is simple: the threat model has changed. For years the question was whether a device could be hacked. The 2026 edition asks what someone can do with a device once it is already on the WiFi, and lists four possible jobs. Only one of them looks like a break-in.
The four jobs are break-in target, borrowed connection, eyes and ears, and open door. A break-in target is what most people picture: automated programs trying the lock, hunting for an old device or a weak password, and it accounts for about 90% of the activity in the report. The other three are quieter. A borrowed connection means your home internet carries someone else's traffic, as with free TV apps that route other companies' data through your television. Eyes and ears means a device collects information about your home and family, such as TVs reported to record audio. An open door means one weak device gives access to everything else on the WiFi, which is why routers and photo drives sit at the heart of so many incidents. The last three can run while everything looks normal. The TV still streams. The smart plug still turns on the lamp.
The television is now the riskiest device
The television has become the riskiest device in most homes, holding 22.7% of the known weak spots in the report. TVs stay on the wall for years, often long after the maker stops updating them, and one 2020 model still appeared 29.1 million times in the data. Two findings make this worse than a simple patching problem. Some free TV apps can borrow your internet, routing other companies' traffic through your set in exchange for access you agreed to in the fine print at install. And some TVs collect more than viewing habits, including voice recordings, location data and details about other devices on the network, even when the screen looks off. None of that is hacking in the usual sense, but it is your home and your connection.
The devices you forgot about
Two of the quietest devices in the house are also among the riskiest. Smart plugs account for 22.4% of weak spots: they are cheap, tucked behind furniture and rarely updated, and once a model stops being sold it often stops getting fixes while staying connected for years. Photo and file drives account for 22%, and if family photos live on a storage drive plugged into the router, that drive is a favorite target for criminals who lock the files and demand payment. Add TVs, and these three device types hold two thirds of all known weak spots in the report. Streaming sticks and boxes, which were among the riskiest categories last year, dropped off the list largely because owners installed their updates. That is the report's one piece of good news, and it is a useful one: updates work.
When the problem is built in
Some of the bigger 2026 stories were not about hackers breaking in at all. They were about devices that arrived with a problem already built in. In Slovakia, officials examined 279 newly delivered traffic cameras and found a hidden way to take control of them remotely, including built-in passwords that could not be changed; the cameras were kept offline until fixed, and about 13,000 similar cameras are in use across Europe. Researchers also found a hidden back door installed before shipping on 20 router models from one Chinese manufacturer. In March, US authorities shut down four networks built from hijacked everyday devices such as routers and cameras, including Aisuru, which powered record-breaking attacks in 2025. The lesson the report draws is blunt: a bargain device from a brand you have never heard of can cost more than it saves, and who makes a device, and how long they will keep it updated, matters as much as the price.
What to watch in 2027
Looking ahead to 2027, the report flags three trends. More apps that borrow your internet, especially on cheap streaming boxes and apps from outside official stores. One flaw affecting many brands, because so many devices are built from the same off-the-shelf parts and software, meaning a single vulnerability could hit cameras and video recorders from several makers at once. And more attention on TV privacy, with a closer look at what sets collect and who they share it with.
The fix
The fix is mostly mechanical. Turn on automatic router updates. Change default passwords, router first, then cameras and other devices. Retire devices that no longer get updates, starting with old smart plugs. Check your TV's privacy settings and turn off viewing data and voice features you do not use. Put smart gadgets on a guest network, away from phones and laptops. Add protection that runs on its own, such as router-level security software. Most of it takes minutes, and it closes the gap that the report says most of the risk lives in.
It is not clear this will hold. The average household is not going to audit 24 devices, and the market keeps shipping new ones faster than anyone updates the old. The report's own data says most of the risk comes from devices that are outdated, set up once and forgotten. Until manufacturers extend support windows or regulators force them to, the burden stays with the buyer.
For more on the underlying data, see the 2026 IoT Security Landscape Report. Related coverage on this site lives at /category/iot. A wider view of connected-device growth is available from IoT Analytics.
