Two firms’ analysis of 10.4m routers found 5.4bn attack-category events, with smart TVs/plugs and NAS devices generating most vulnerability observations

An analysis of home-network telemetry collected between January and September 2026* has found that automated port scanning accounted for the overwhelming majority of recorded attack-category events, while publicly catalogued vulnerabilities accounted for nearly all device-vulnerability observations.

The analysis drew on telemetry from approximately 10.4m routers that incorporate Bitdefender smart-home security technology. During the nine-month period, it recorded 5.4bn attack-category events and 6.2bn device-vulnerability observations.

An “event” is a detection record, such as a blocked port scan, brute-force login attempt, or matched exploit pattern; it does not establish that a device was compromised. A “vulnerability observation” pairs an identified device with a known vulnerability, meaning a single device can generate multiple observations.

Main findings

Households in the dataset had an average of 24 connected devices, up from 22 in a prior year’s report. Also:

• Automated port scanning represented 90.1% of attack-category events. The report characterizes this as reconnaissance rather than evidence of a successful intrusion.
• Credential-guessing activity was the next-largest category, at 8.7% of attack-category events. Of protocol-level password-guessing events, 97.8% targeted the Remote Desktop Protocol (RDP).
• Smart TVs accounted for 22.7% of vulnerability observations, smart plugs for 22.4%, and network-attached storage (NAS) devices for 22%. Together, these three categories represented 67.1% of observations.
• 99.97% of vulnerability observations were related to publicly recognized CVEs. Weak passwords and plaintext authentication together represented a very small share of observations.
• Among vulnerability classifications, overflow errors accounted for about 54%, denial-of-service conditions about 18%, and memory-corruption issues about 17%. Categories associated with greater potential impact — privilege escalation, code execution, and information disclosure — accounted for about 10.3% combined.
• Mobile phones were the most common identified device type, at 20.4% of devices, followed by televisions at 10.6%, computers at 10.0%, network equipment at 6.2%, and streaming devices at 5.4%.

What the data can/cannot show

The findings, released by Bitdefender and NETGEAR, describe activity observed within the two firms’ protected-router customer base, not a representative measure of all homes or all connected devices. The report states that its data reflect only what could be observed through its own infrastructure and should be treated as indicative rather than exact measurements.

The high proportion of port scans does not mean that 90.1% of homes were attacked in a meaningful sense. It means that most recorded security events were automated probes. Likewise, a vulnerability observation identifies a potential exposure; it does not establish exploitation, compromise, or harm.

The report associates higher observation counts with long-lived consumer devices that may remain in use after vendor support ends. Smart TVs, smart plugs, and NAS devices accounted for most vulnerability observations in the dataset. Generally, device lifecycle remains a central issue.

The report recommends keeping router firmware current, retiring devices no longer receiving security updates, avoiding exposure of administrative interfaces to the internet, disabling UPnP where it is not needed, and using unique credentials rather than factory defaults.

According to Chandan Nandakumaraiah, Head of Product ad Cybersecurity, NETGEAR: “As enterprises get better at protecting their digital infrastructure, cybercriminals are turning to connected home devices… Once inside, criminals can stay hidden and move laterally across the home network. Monitoring, detecting, and blocking these threats is more important than ever.”