New research from Censys’ 2026 State of the Internet Report challenges familiar assumptions about where Internet infrastructure lives, how it changes, and what’s exposed.
The report examines the Internet from five angles: AI exposures, ICS exposures, vulnerability response, threat infrastructure, and the Internet at large. Across these perspectives, one thing remains clear: the Internet is vast and volatile. And while the Internet’s threats are numerous, most aren’t too sophisticated or complex for the average security program; they’re simply lurking where organizations and tools fail to look.
The State of the Internet Report sheds light on the dark corners of the Internet and reveals the blind spots organizations continue to overlook. Armed with these insights, organizations can close gaps in their security programs and improve their defenses against existing and emerging threats.
Get the 2026 State of the Internet Report
The latest insights on the Internet and its threats are available now.
1. AI’s Most Critical Exposures Are the Least Visible
Some of the most concerning AI exposures sit not in user-facing applications, but in the infrastructure that supports them, such as platforms that coordinate automated workflows, connect agents, and store credentials for external services.
Between October 2025 and July 2026, the number of hosts exposing AI-related tools grew more than 63%. The most widely exposed product by a substantial margin was n8n, a workflow and AI-agent automation platform, with 113,926 exposed hosts. Among n8n hosts with a parseable version, 76% reported versions within the affected range of at least one recent critical vulnerability.
Exposure alone does not prove a system is insecure. But these platforms’ access to credentials and connected services means a compromise could reach well beyond the AI application itself. For businesses, the administrative infrastructure behind AI deserves particular scrutiny: some of the highest-impact risks may lie in the tools users never see.
2. Industrial Infrastructure Remains Exposed
Global industrial control system (ICS) exposure has remained disappointingly steady: it has grown roughly 4% over the past two years, with North America maintaining a strong lead.
Due to the remote nature of many of these systems, they tend to sit on mobile networks: Censys found that roughly 70% of hosts running ICS devices and services globally are consistently found on consumer and mobile networks. Hosting a system on a mobile network obscures ownership visibility and makes exposure remediation difficult. An operator searching only its corporate network addresses, for example, would miss exposures of its own mobile-connected systems. Similarly, when researchers discover these exposed systems, they’re unable to identify and alert responsible parties of the exposure.
While it’s nearly impossible to determine ownership for many exposed mobile-connected ICS systems, it’s trivially easy for attackers to discover them. This puts exposed mobile-connected ICS devices at high risk.
3. The Oldest Software Lingers Longest
Software upgrade patterns tell a contrasting story. On one hand, Censys researchers found that the majority of exposed software has been gradually updating to newer versions over a 2.5 year period. Further, the more consistently a product upgrades, the less it exhibits an upgrade spike surrounding a major vulnerability or exploitation. This demonstrates increasingly healthy update hygiene and its benefits: these software populations have likely absorbed more version change gradually over time and are less susceptible to emerging vulnerabilities.
However, in the dark corner of the upgrade landscape lurks the oldest software. The exposure rates of the oldest versions of software barely changed over a 2.5-year period, persisting in small but remarkably stable levels. These are likely abandoned remnants of forgotten software; they’re unlikely to ever upgrade — they may not even be monitored or tracked anymore — but they can still pose risk.
4. Threat Actors Prioritize Cost and Permissiveness When Choosing Hosts
The United States hosts 45.5% of the observed web-based threats, including phishing and other deceptive pages. However, while it can be tempting to make assumptions about the actor’s identity, intent, and origin based on where the infrastructure is located, threat actors don’t pick a country; they pick a provider. Hosting and infrastructure providers are selected primarily based on cost and permissiveness.
Threat actors often prioritize speed and cost. They tend to opt for the hosting provider that can provide them the best combination of both while enabling them to avoid detection.
Therefore, while geography can help shape detection patterns, it does not heavily influence deployment or hosting conditions.
5. Standard Ports Are Not the Norm
Web services are not guaranteed to live on their default ports. Many of the top 25 protocols are deployed on non-standard ports. For example, 96% of SOCKS proxies, 68% of HTTP(S), and 34% of SSH services run on non-standard ports.
Security tooling that assumes devices and services run on their default ports misses a significant subset of Internet-exposed assets. Security programs need tooling that offers visibility into all ports on the Internet — not just the common ones.
Get the Internet and Threat Insights You Need to Protect Your Organization
These are just a few of the insights from this year’s State of the Internet Report. The full report draws on Censys’ comprehensive, real-time Map of the Internet to help businesses understand emerging patterns across the entire Internet and its threats. Download the report now for the insights you need to protect your business.
