For years, security leaders have treated the home network as someone else’s problem. Employees plug in laptops, join video calls, and get on with their day, while the smart TV, the plug in the hallway, and the aging network storage box in the closet sit quietly in the background. New research from Bitdefender and NETGEAR suggests that is precisely what makes them valuable to attackers.
The 2026 IoT Security Landscape Report draws on telemetry from roughly 10.4 million smart homes worldwide, collected between January and September 2026. Bitdefender researchers analyzed 5.4 billion security events and 1.2 billion vulnerability observations. The headline finding is less about any single exploit than about the changing role of the device itself. A vulnerable gadget is no longer just a target. It can also act as a proxy that relays someone else’s traffic, a sensor that quietly gathers information, or a foothold from which an intruder moves across the rest of the network.
One device, four jobs
Smart TVs illustrate the problem best. According to the report, they are the one category where all four roles converge, and they led every other device type with 270.3 million vulnerability observations. The researchers point to a notable 2026 incident to underline the point: proxy software bundled into smart TV apps, which can quietly turn a television into a relay for third-party traffic. The owner sees a screen. The attacker sees infrastructure.
That shift matters because it blurs the line between consumer nuisance and enterprise risk. A compromised home device can mask malicious traffic behind a residential IP address, and a foothold on a home network is a short hop from the work laptop sitting next to it. Chandan Nandakumaraiah, head of product and cybersecurity at NETGEAR and a member of the CVE Board, put it bluntly in the announcement: as enterprises get better at protecting their digital infrastructure, cybercriminals are turning to connected home devices, which are always on, reliable, and rarely monitored.
The scale of the surface
The average household now has 24 connected devices, up from 22 a year earlier. Phones make up the largest share at 20.4 percent of identified devices, followed by TVs at 10.6 percent and computers at 10.0 percent. Network equipment accounts for 6.2 percent, streaming devices for 5.4 percent (down from 7.3 percent in 2025), tablets for 4.8 percent, and IP cameras for 4.1 percent.
Most of the activity aimed at those devices is not sophisticated, at least not yet. Reconnaissance accounted for 90.1 percent of detected attack activity, mostly automated scanning that sorts weakly secured networks and devices into piles for larger attacks or botnet recruitment. The scanning is the front end of a pipeline. It is also a reminder that being small and unremarkable offers no protection when the sorting is done by machines.
Old devices, known flaws
The vulnerability data should reshape how IT leaders think about risk in remote and hybrid work. Smart TVs (22.7 percent), smart plugs (22.4 percent), and network-attached storage (22 percent) together account for 67.1 percent of vulnerability observations. A year earlier, streaming devices at 25.9 percent and smart TVs at 21.3 percent led the list. The researchers read that change as a signal that long-lived devices, which are rarely replaced and often stay online well past their update and support windows, now carry the heaviest burden.
The flaws themselves are rarely exotic. Issues cataloged as Common Vulnerabilities and Exposures made up 99.97 percent of observed vulnerabilities, while weak passwords and plaintext authentication amounted to a fraction of one percent. In other words, attackers are overwhelmingly going after problems the industry already knows about and has often already fixed. The gap is in patching and device management, not discovery.
The likely outcomes of those flaws skew toward the mundane but disruptive. Overflow errors represent about 54 percent of potential attack outcomes, followed by denial of service at about 18 percent and memory corruption at about 17 percent, pointing to weak memory safety and input validation in device software. The most serious results, which hand attackers control of a device or its data, are far rarer: privilege escalation at 5.3 percent, code execution at 3.8 percent, and information theft at 1.2 percent, roughly 10.3 percent combined. Rare is not the same as harmless, however. Those are the outcomes that turn a noisy scan into a quiet foothold.
Speed is the new variable
Bitdefender’s Ciprian Istrate, senior vice president of operations for its Consumer Solutions Group, argues that attackers are using AI to compress the time between a newly discovered vulnerability and an attack on it from days to hours. If that holds, the traditional comfort of a patch cycle measured in weeks looks increasingly thin, especially for devices that may never receive a patch at all. The report also notes that the U.S. Department of Justice dismantled four IoT botnets this year, evidence that these networks of hijacked devices remain a live, large-scale problem.