The 24 devices that the average connected home has, according to the 2026 IoT report from Bitdefender and NETGEAR, are no longer just a household problem: vulnerable TVs, cameras and routers are being used as intermediaries for other people’s traffic and as ammunition for the botnets that launch denial-of-service attacks against cloud services. The study, which opensecurity has analyzed in detail, is based on telemetry from roughly 10.4 million households between January and September 2026 and on 5.4 billion security events.
The 2026 IoT report and its impact beyond the home, in 20 seconds
- The households analyzed have an average of 24 connected devices, up from 22 in 2025.
- The same vulnerable device can act as a target, proxy, sensor or entry point into the network.
- 99.97% of the vulnerabilities observed are public CVEs that already have a fix.
The report, titled the 2026 IoT Security Landscape Report, starts from an idea that also matters to anyone running infrastructure: a vulnerable device can play four roles. It can be attacked directly, relay third-party traffic as a proxy, collect information as a sensor, or serve as a foothold for moving across the network. According to Bitdefender, smart TVs combine all four roles and account for 270.3 million vulnerability observations, the highest figure of any category.
The figures are worth reading in context. The press release doesn’t specify which devices the telemetry comes from, and the study is part of the promotion for NETGEAR Armor, the router-based security service the two companies sell together. Even so, the data lines up with what has been seen elsewhere in 2026.
From the Home Network to Attacks on the Cloud
The first is botnets. The US Department of Justice dismantled four networks of infected IoT devices this year, Aisuru, KimWolf, JackSkid and Mossad, which according to Help Net Security controlled millions of video recorders, cameras and routers and launched denial-of-service attacks of up to 30 Tbps — part of a surge in attacks over 1 Tbps that has been multiplying this year. The largest attack attributed to Aisuru in 2025 reached 31.4 Tbps. These are volumes that put even major mitigation providers to the test, and that are built from unpatched home devices.
The second is residential proxies. In June, Spur Intelligence reviewed 6,038 apps for LG and Samsung TVs and found that 2,058 included residential proxy software, which lets third parties send web requests that appear to come from a home connection. That traffic is used, among other things, for mass web scraping, and it complicates life for anyone defending a cloud service, because the requests arrive from legitimate residential IP addresses rather than from data centers that are easy to block. Samsung and LG later announced they would ban these apps from their stores.
Where the Risk Lies, and Why It Isn’t Going Away
By device count, phones make up 20.4% of devices detected, followed by TVs (10.6%), computers (10%) and networking equipment (6.2%). But three categories account for 67.1% of vulnerabilities: smart TVs (22.7%), smart plugs (22.4%) and network storage (22%). In 2025, media players (25.9%) and TVs (21.3%) topped the list. Bitdefender attributes this to long-lived devices, which get replaced rarely and stay connected after the manufacturer stops updating them, being the ones that accumulate the most risk.
90.1% of the detected attack activity was reconnaissance, meaning automated scans looking for weak devices to attack or recruit into a botnet. And 99.97% of the vulnerabilities observed are public flaws with a CVE identifier, versus a tiny fraction of weak passwords or plaintext authentication. By type of impact, overflows account for around 54%, denial of service 18% and memory corruption 17%, while the more severe ones, such as privilege escalation (5.3%), code execution (3.8%) or information access (1.2%), add up to around 10.3%.
What Users and Businesses Can Do
Ciprian Istrate, of Bitdefender, argues that attackers are using AI to go from days to hours when exploiting new flaws, and Chandan Nandakumaraiah, of NETGEAR, that criminals are turning to the home because businesses protect their infrastructure better. Beyond those assessments, the fact that almost all the risk comes from known flaws leaves a practical conclusion: updating firmware, retiring unsupported devices and isolating IoT gadgets on their own network cuts out a good part of the exposure.
For businesses, the connected home matters in two ways. One is remote work, because the corporate laptop shares a network with those 24 devices. The other is defending their cloud services against botnets and residential proxy traffic, which forces them to rely more on behavioral analysis than on simple IP address lists.
Frequently Asked Questions
What is the 2026 IoT Security Landscape Report?
A report from Bitdefender and NETGEAR based on telemetry from roughly 10.4 million households between January and September 2026, analyzing 5.4 billion security events.
How does home IoT affect cloud services?
Vulnerable devices feed denial-of-service botnets and residential proxy networks that generate traffic that’s hard to tell apart from legitimate traffic.
Which IoT botnets were dismantled in 2026?
Aisuru, KimWolf, JackSkid and Mossad, by the US Department of Justice, according to Help Net Security.
How can the risk from IoT devices be reduced?
By updating their firmware, retiring unsupported ones and separating them onto their own network, since almost all the flaws detected are known CVEs.
Sources:
- opensecurity: The connected home now has 24 devices, and almost all its flaws are known
- Bitdefender: 2026 IoT Security Landscape Report
- Help Net Security: Authorities disrupt four IoT botnets behind record DDoS attacks
- Help Net Security: Residential proxy SDKs are hiding in LG and Samsung smart TV apps
- Cybernews: Samsung joins LG in banning smart TV proxy apps
