What does more than two years of intelligence reveal about the vast & volatile Internet?
In Episode 6 of Censys ARC Flash, our researchers break down key findings from the 2026 Censys State of the Internet Report, examining the rapid growth of exposed AI infrastructure, shifting threat actor infrastructure, persistent legacy software, and industrial control systems (ICS) exposure.
Michael Schwartz, VP of Research, Security & IT at Censys, moderates a discussion with Emily Austin, Principal Security Researcher, and Himaja Motheram, Senior Security Researcher, the report’s lead authors.
Michael Schwartz
Well, good morning. At least good morning to those in the United States. Hopefully we have a few people joining from across the pond. Welcome to the ARC Flash very special session today. We’re kicking off the release of our 2026 State of the Internet Report or SOTIR as it’s called. This report is created by the Censys ARC team, so our research program. Again, the release is today, and I’m joined by Emily Austin and Himaja Motheram, the two main authors of this report.
Download the Full Report
Download the 2026 State of the Internet Report for a deeper look at trends in AI exposure, threat infrastructure, vulnerability response, and more.
And we’re gonna go through a lot of the main findings and and talk through them. It’s really, really quite interesting. We’ve been we’ve been at this for almost a year in and total research time. Chat is open throughout. Definitely pepper in questions for Q&A that we’ll have at the end, but that’ll be there to to collect your thoughts as we run through the report today. And I might have mentioned the acronym SOTIR, so you hear that a lot, or S-O-T-I-R, that stands for State of the Internet [Report]. This is our flagship report where we focus on the most interesting and notable phenomena in our data and what it means for the industry.
Michael Schwartz
All right. Emily, Himaja, this is the fifth year of this report, the fifth version. What’s the difference between this report versus what we’ve done in previous years?
Emily Austin
Yeah, it is the fifth year, which is honestly really wild to think about. You can see the the initial cover for the first report here next to this this year’s as well. It’s like lots has evolved, lots has changed. But I think there are a couple of key things that are a little different about this year’s report.
So yes, it’s the fifth year we’ve published it, but one of the things that’s a little bit different is in previous reports, we picked one facet of our data to go in depth on. So we’ve done a report on ICS or industrial control systems, we’ve done a report on the web, we’ve done a report on threat infrastructure. And those reports were also focused on a particular point in time or several snapshots of our data.
Emily Austin
This report is starting a fresh wave or fresh edition of the report where we’re making a couple of key changes. So one is that we’re looking at several different facets of the Internet that we think are particularly relevant for defenders, especially right now. And we’re doing that sometimes as far back as two and a half years, going back that far in our data historically, to better understand how these different parts of the Internet have evolved over time. So I think this sets us up.
With a really nice baseline for future years where we can say, okay, we’ve looked at threats, we’ve looked at software on the Internet, here’s where things were in twenty twenty six. What do we see going forward? So I’m excited about the potential and the possibilities of future reports building on what we’ve re envisioned for this year.
Michael Schwartz
Fascinating.
Himaja Motheram
I think another part of this is that some several sections of this report that we’ve done this year couldn’t even have existed in previous years because of just how much we’ve expanded our coverage capabilities in our data set. So we scan the entire Internet, but without context on top of that scan data, it’s very hard to to dig in as deep as we’ve done in this report and we’ve grown a lot in the past year.
We launched our platform adversary investigations module, which has capabilities for tracking over 270 different threats and different threat assets. We’ve added over 40 new detections for various AI-related technologies in our data set. We’ve added around 77 new protocol scanners. So when we scan the Internet, we intelligently detect and speak protocols to these services.
Himaja Motheram
And a lot of those include very niche industrial control systems protocols that we’re now able to categorize and actually detect. And it’s really exciting to see what a big difference it makes and what we can actually study.
Michael Schwartz
Hmm. Interesting. So I noticed on the there’s like a theme for the report for this year. I don’t say the not a sub theme, but like maybe some subtext, the vast and volatile Internet. Vast makes sense because Internet is large, right? forever increasing. Volatile is interesting. And why do we specify volatility? What do we mean?
Himaja Motheram
Yeah, so volatility here means a lot of dispersion, right? So very different rates and patterns of change in different exposed populations over time. Nothing on the Internet when we’re examining it over these long stretches of time is really moving or changing quite the same way. And we sort of split them in the report into these two groups. And the first is these things that are moving very quickly, turning extremely rapidly, and are increasingly important for defenders to to really make sure that they’re monitoring proactively. And that includes this sort of new emerging attack surface of AI infrastructure, and we’ll get more into that, but how AI infrastructure that we observe exposed on the Internet is like the plumbing, exposing and supporting applications, has grown 63% in less than a year. and that includes as well threat actor infrastructure. So the tools that malicious actors are using are in that same bucket of things that are changing very quickly on the Internet. And and we’re seeing a lot of short term spikes and shifts in how both of those two categories of assets are changing on the Internet.
Emily Austin
Yeah, and conversely, we’re also seeing some things really not change very much at all. And it’s actually the things, the areas where we would hope we might see change. So industrial control systems exposure continues to be a problem globally that hasn’t really changed. We aren’t seeing material shifts there globally. And also old enterprise software, the oldest versions of some of this software is just very sticky. It seems to hang around. These might be forgotten systems, these might be like shadow IT, maybe we aren’t maintained anymore. It’s not really clear, but there are definitely things on the Internet that aren’t moving as much as maybe we wish they were and are a very stark contrast to things like AI infrastructure and threat infrastructure that we see constantly shifting.
Michael Schwartz
So so this is interesting. as Himaja just mentioned that it’s like, we added a bunch of fingerprints and bunch of scanners, and that gave us that new visibility because it’s new. and we talk about volatility of the Internet and and measuring either how it expands or it’s changing over time. So what do we how do we know like what real growth in a sector is versus us just getting better at scanning?
Himaja Motheram
This is such a great question and could be its own field of study, which it is, it’s Internet measurement. But we took really great pains in our methods with looking at this data to make sure we were trying to separate Internet noise from what real trends were. And we did this by normalizing for, you know, fluctuations in our data set. So, you know, some days we scan more hosts, some days we scan less hosts.
And hosts are going up and down all the time. We did our best to normalize for that over time and really separate out what is what is growth that is happening at a rate of change much more quickly than the rest of the the Internet population. And we also made sure that we were comparing consistent populations of technologies over time. So for example, for the the honey pots for for the AI section we really tried our best to filter out honey pots. What so or things that look like dummy or demo instances that are intended to look vulnerable and and just sit outside and be exposed and capture attack traffic for for research or for for all sorts of purposes, but in either case are not really what we’d consider to be real hosts on the Internet. And we did that across all these sections. So scanning the Internet is is one thing, but we took a lot of time to make sure we were measuring how it changed reliably in this report.
Michael Schwartz
Interesting. So let’s start with AI, because everyone’s interested in AI. Headlines every day about you know an attack that might have been conducted via an AI offensive tooling or these AI endpoints and businesses are being exploited, right? They’re just left in a in a vulnerable state and they’re being exploited. Do we get a sense in this research that the headlines are driving people to be worried about the right things or the wrong.
Himaja Motheram
You know, this is changing every day, but what I’m noticing is that a lot of the headlines focus on what AI can do, right? So AI enabled attacks, like the ways that threat actors are using AI to conduct exploitation. Things like agents misbehaving during testing or during, you know, trials or things like that, or how to get your agent to to stick to its guard guardrails and all of that is important, but what I see less attention on is how the security of the infrastructure behind all of these capabilities is increasingly web facing and is increasingly deployed as this stack of interconnected services that are alarmingly autonomous and alarmingly privileged and have access to things like credentials and databases and and vector stores and all sorts of things and are increasingly independently reachable from the Internet when really they should only be talking to the application itself. So it’s becoming this whole separate exposure attack surface that of just like ordinary applications that I’m seeing get less attention that we talk about in this report.
Michael Schwartz
So are you when we say exposed AI infrastructures, there’s sometimes there’s a lot of emphasis on exposed. What do you mean exposed? Like what what are we talking about here? Is it just chatbots? Is it MCP? Like what is it?
Himaja Motheram
Yeah. So I think this is important and we spend some time on it in our in our writing where it’s like, what what do we even mean when we say AI AI anymore? It’s such a loaded term. And the definition that we used for this report was really any sort of tool that is really integrated with AI workflows, AI agents, supports user facing AI applications, things that sit next to those applications like vector databases or monitoring software that is adjacent to it, but is still sort of plugged into that internal network of credentials and and and a gen tech infrastructure that could be a foothold into that system.
And so what we did was like I mentioned, we wrote a ton of new detection capabilities for over 40 products. And what we did is we categorized them into different categories based on their functional purpose. And so the most popular one we saw was workflow automation. And that is probably not what you would consider to be AI maybe a few years ago, but now it is. It’s a lot of things like there are popular tools like n8n that sort of have nodes that are enabled for AI agents and can hook into all these different other sorts of interfaces and are super privileged and sit at the kind of like the orchestration layer of like DevOps for these applications. and some of the other categories we see here are personal agents and assistants that are meant to act on behalf of the user, all of these other sorts of inference and and knowledge base and and data storing applications that are meant to work with the agent. So not a lot of chatbots and not a lot of models, which makes sense because to your point about what we’re talking about with exposure, what we’re saying is that each of these products is is has like a port that’s open to the Internet at its simplest definition when likely it should not be it should not be publicly accessible. It should really only be talking to the application itself.
Michael Schwartz
Interesting. So we we’re able to count classify the number of port protocol exposures, service exposures on Internet. We can also then say how you know widespread this is, either geolocation or maybe even industry stack as well.
Himaja Motheram
We can. First we could look at just over time how it’s really grown, which is what we looked at with, like Emily mentioned, the dearth of historical data that we had. And so when we looked over the past nine months, the total number of exposures grew by sixty-three percent. So from 164,000 to over 267,000.
And so, without a lot of context about Internet data, those numbers might not mean a lot. But for us who are digging in this sort of data every day, this is quite a large — this is not something you see every day. You don’t see these sorts of huge increases in a lot of types of infrastructure. More often than not, as we’ll get into things sort of stay stagnant or are persistently stubborn across the Internet at the same rates.
And when we look at what specific networks that these were in, to your point, it was interesting to see actually that there didn’t seem to be any specific network provider that really emerged as where most of this is coming from or any specific country. The the two countries that led in exposure were the United States and China, but those also tend to be where we see a lot of exposure on the Internet in general. And we could also speculate that it’s because there are a lot of incentives in both of those places to increasingly use AI infrastructure.
But when it came to networks, what we saw was just kind of a pretty even distribution across a bunch of your typical budget cloud or or hosting providers, which will mean that it’s gonna be a little bit harder for people to to attribute these.
Michael Schwartz
Fantastic. I’m also thinking that regionally, you know, the the large cloud providers in both China and in the US enable like rapid deployment of a lot of this tooling. Is that in your opinion, how s how something grows as fast? Right? How do we take something that, you know, in the in the late part of 2025 was, you know, I say, you 165,000 hosts and and and nearly doubles itself in a handful of months. Is that the way?
Himaja Motheram
Yeah, we can actually we can look at a couple of anecdotes of what might be causing this growth when we break out the actual growth by distinct products. And so like I mentioned, n8n is a big representation of the workflow automation tools that we see exposed. And that was the most exposed one we saw by far, and it grew over the nine month period.
That orange line there represents a tool called OpenClaw, which was one of the more, maybe viral security stories of the first half of this year where you know this really a hype cycle story. This really cool new hobbyist tool comes out. Like the the developer is just one person they put security warnings in their in their GitHub readme, you know, like don’t expose your control panel, but people are just so excited to adopt it. and also ironically like a lot of people are deploying these AI tools using other AI tools using LLMs and Agentic workflows. And sometimes those workflows prioritize getting something up right away.
Something that we see with with both n8n and OpenClaw, I know that there are actually certain hosting providers that provide like one click templates, like kind of as the a package deal. So like I think DigitalOcean maybe does like a one click like spin up a server with n8n included as part of their selling point. And so you have hype driven adoption, spinning things up using AI tools. So a layer of abstraction where you’re not necessarily seeing that it’s being secured. And then also these templates makes all of these really easy to just explode on the Internet when they shouldn’t.
Michael Schwartz
Wow. Yeah. I explicitly remember OpenClaw. and it being from almost like this little rumor. Have you have you checked this thing out until the explosion of the news and then us building detection for it and just watching, you know, tens of thousands of endpoints get put on daily. It was pretty wild. Awesome.
Well, I’m I’m gonna transition us. So we’re let’s talk about something a little less I should say shadow IT-ish. But for defenders, it’s like this is what you’re having to deal within your particular organization is is AI tools is all the rage, right? They’re gonna get spun up in your environment whether you sort of like it or not. and we’re seeing this sort of across the board and and exposures.
But with exposures comes threats. So I want to talk a little bit about threats. threat infrastructure changes, I don’t want to say it it changes just as much, but it moves just as fast. And Emily, I know you’ve taken a, you know, a long look at the the particular threats that that we track and we have some I think cool visuals to show.
Emily Austin
So this is a visual of all the host-based threat detections that we have for a nine month period. So this just kind of goes to show there is a wild amount of volatility among these different types of threats. And some of these are commodities, some of these are more tied to nation states. Like there’s a wide variety, some of these are dual use tools that aren’t necessarily explicitly malicious, right? So lots and lots of different things covered in this category.
But I think what’s really interesting about our threat data is a lot of times in the threat research community or security research community, when we talk about those things, we’re talking a lot about a specific campaign or a specific teardown of a piece of malware or reversing something, which of course, all of those things are really important for understanding the mechanics of exploitation and how that happens. But I think what’s really cool about our perspective here is we’re sort of the other piece of that. We’re the opposite side of that, which is: this very zoomed out. Broad view of the threat landscape globally. And so this enables us to better understand these broader trends in threat infrastructure.
And so if we look at this next graph, we can see, for instance, regionally, the US and China, much like AI infrastructure, the US and China really dominate the threat infrastructure landscape. So when we are talking about that, right, like we see China kind of in this even keel across the top, the US has sort of barreled into second place over time. And those are really the two places where we see both host uh-based threat infrastructure, so on a bare IP address, and also web-based threat infrastructure. So these are things that are user-facing and designed to be presented to the user, phishing pages, other duplicitous content, that type of thing.
What starts to get interesting when we look a little further into this is what we see in the next graph. And that is where these types of threats are hosted. There’s a little bit of a dichotomy. So the US actually leads 45.5% of the share of host or excuse me, web-based threats that we see. So again, that’s that phishing content, deceptive content, things that are again designed to be put in front of a user to get them to interact with to to do something malicious, your click fix, et cetera. Conversely, China is responsible for over a third of host-based threat infrastructure. And when we talk about host-based threats, sometimes yes, those are those are things that you might see a page or something presented, but we’re talking really about like C2 infrastructure or other tooling servers or other things that are not really designed to be put right in front of the user, but are designed to do things sort of behind the scenes. And I think that’s a really interesting dichotomy that that emerged when we were looking at this from a from a really broad perspective.
Michael Schwartz
Mm-hmm. Interesting. I’m we take great interest in geopolitics, obviously, like right, if like the world is chopped up that way. The Internet isn’t, right? You can easily reach a host in China, usually, or Germany, you know, UK, Netherlands, as much as you can the United States. And when you’re functionally interacting, you’re not saying, I have to cross a border. Not none of that’s happening. So how meaningful is this data and what what can defenders use from this now?
Emily Austin
So that’s a great point. I think we have to be very careful when we talk about geography. And I think this graph actually shows a little bit of more of that picture, right? And so a lot of this really does come down. You’re right, like threat actors aren’t choosing infrastructure necessarily because it’s like, I want to choose a host in China or I wanna choose a host in the US. It really comes down to permissiveness and availability and like, cost of providers. You know, do they have an API that I could use to provision a lot of infrastructure really quickly? Do they allow my phishing infrastructure to stay up long enough that I get a return on my investment? Is it worth it for me to use them? And so this graph actually shows the split between web based and host based kind of skewed networks. And so you can see Cloudflare on the top line here absolutely dominates where we see web based threats, which completely makes sense.
But we also see a couple of other US-based providers up there as well. So AWS, Linode, DigitalOcean, and tend to skew more heavy on the website. Whereas when we look on the left of this graph where we see the orange bars, that tends to skew more host-based threat-sided. And so a lot of these you see your China based providers here. And again, I would say this really comes down to what the networks allow and less about like choosing a host in a particular place unless of course that’s part of your campaign somehow, like that is is a thing that you’re focusing on. But like largely it really just comes down to to availability and what’s like the easiest thing to do.
Michael Schwartz
Mm-hmm. Fascinating. Very interesting. What I mean, is there anything else that we can give defenders you know, I want to say a tip or like some some guidance and on utilizing Censys data for this? I’ve always said it yeah, in from the defender perspective, it’s like you know, knowing your lines of business to say like, hey, if I if you don’t if you’re not doing business with you know, China, do you need to ensure that you maintain connectivity with China? It’s a bit more difficult these days with the the interconnectivity, but is there any what what is the big sort of takeaways here for defenders in this space?
Emily Austin
Yeah, so you actually make a great point of, what are my lines of business? Is it, does it make sense that I would see traffic coming from here or things like that? This also gets into why this is a little bit hard because a lot of the tooling that we track is also dual use, meaning there are benign use cases for it. And so we see it used in benign ways all the time, but there are also places where we see it adopted really widely by threat actors. So FRP is a great example of that.
And so this I think really gets to having the full context, the fullest context you can about a given host or piece of infrastructure, because you can’t make a decision based on a single data point. You shouldn’t be in that position. You should be enriching as much as you can. And so some of the context that we provide around these different hosts, I think is very useful as a defender, kind of, you know, I think back to my days doing, you know, basically IR work and going, what’s going on with this IP address? And it’s like, well, let’s look and see what’s actually on the host. What why are there a bunch of routers, you know, DoSing my login page, right? Like that seems a little weird. and so I think it’s just really having that full context that is very useful here. And I think that’s what defenders could take away from this data.
Michael Schwartz
Yeah, excellent. I’m gonna transition us a bit away from threat and go back to topically, you know, the the vast and volatile Internet. We’re volatile in our in the Internet measurement world is ephemerality, right? Things generally don’t stick around. Well, there is a body of things that do stick around. We’ve talked about like mail servers, those tend to be around forever. and then there’s stuff that isn’t, and we do our best. I think in the world we’re we’re tracking and explaining the ephemerality, which is the consistency in which we’re scanning as well. but there are things that aren’t changing besides male servers. Like, what does that look like? So we talk about the stuff that changes all the time, the stuff that’s consistent. What is that?
Himaja Motheram
Yes. So something that when when you say like dead mail servers, I think of an often quoted refrain in the security community, which is the dead Internet theory, which is that theory that, you know, all is the Internet actually museums or not museums, is it users or is it like just bots and infrastructure that is abandoned. And I saw this a lot, particularly during my work on Censys Rapid Response, which is our program on the research team to respond with Censys’ perspective to emerging threats. So CISA puts a new CVE that is critical on its known exploited vulnerabilities list. We take a look in Censys and measure, you know, how many things are affected by this vulnerability, how many how many systems are patching, how many systems aren’t patching.
Is anybody patching? And a lot of times that research would only really cover the first like week or two weeks after an incident, right? Because we’re trying to measure the immediate aftermath. And of course there’s a new one coming right after the one that we’re studying. but what we were interested in to look at for for this report was okay, what is happening like a year later? You know, what are these things eventually patching, even if they aren’t in the immediate aftermath? do like how often do hosts upgrade when times are quiet and there’s no CVEs? And does this change for different products? and so it in contrast with like the threats and the AI stuff that we talked about, what we looked at was we took sort of this like legacy, not not always legacy, but just like popular enterprise software. Your report servers, your mail servers, your things that are are just in every enterprise and they’re changing much more slowly. and we we actually looked at that. So we took four different products we took Jenkins which is a CI/CD a very popular CI/CD software we took SharePoint server
Telerik Report Server and then Cleo MFT, which is a pretty niche managed file transfer platform. And we had unusually rich version data and exposure data for all four of these over two and a half years. So we took them as four case studies. They all have different version release schedules from their vendors. They all have different environments that they’re typically deployed in. And we saw some really interesting things there.
Michael Schwartz
This is by far one of my most favorite topics. The one that I I I pushed, I think, you two the most to to cover. and it there’s a lot of reasons why, but I think one of them, and I I hopefully I don’t improperly attribute this to Phil Venables, the CISO at at Google Cloud, but I’m pretty sure it’s him where he said like the typical acquisition cycle for any organization with a piece of technology is about 18 months. and if we look at, you know, and we typically say to ourselves, hey, like this why does this organization or this piece of software or this device, they consistently have security vulnerabilities. How come organizations just don’t yeet them out the door? and it’s because if you make a decision to like, hey, you’re going, it’s gonna take 18 months to two years in a lot of these large enterprise organizations to like get rid of the thing. and so it’s like, okay, well, our time horizon for how we evaluate, you know, how stuff is getting patched or where those exposures exist has to also exist for a longer period of time as well. So this is I love it. I wish we could do it for all, but like as you said, that like in a lot of cases the data, right? The the the data is hard right in this space, especially going over two and a half years where scanning changes, fingerprints change, you know, et cetera. but for these case studies, what are we actually finding? Is it consistent? Are we seeing organizations be able to consistently update a lot of these, you know, the classic edge pieces of software and devices, or are we not?
Himaja Motheram
So there’s some there’s some good news and there’s some bad news. So let’s look at the actual data that we did.
So what this graph shows is for each of those four enterprise products I mentioned, top to bottom, from left to right it plots kind of the distribution of its relative age of its version at the time that we collected this data. so the dark teal on each graph is the very oldest versions. So, you know, maybe like eight or ten years out of date or possibly end of life. And then the orange ones are the newest ones. So released within the past month or or like the most the newest release that’s available that a a host could be on.
And so what you can see is that none of these graphs look super similar, but there are similar features of each. So what we notice is that I think the overall good news here is that in each of these, you can see this gradual movement towards newer software. The darkest colors, the oldest software, does seem to slowly be making up less of a percentage of the overall software population that we see exposed. And this could be, you know, organizations retiring old servers. It could be them patching them, which we’ll look at in a bit.
But in addition, you see that some of these populations were more out of date at the start of the observation period, which was January 2024 than others. So for example, Cleo MFT, a lot of hosts, about like seventy percent were on one of the past three most recent versions, whereas Telerik Report server, they had a a kind of like a more dramatic upgrade trajectory around the middle twenty twenty four.
But the bad news I think that you can see from this graph is that, when you look at the bottom of each of them, that very darkest color, so the the darkest teal seems to sort of just be persistent. Like it decreases in all of them, but it’s kind of the same like sticky, tiny percentage. And a lot of this seems like it might just be legacy software that will stick around forever.
Michael Schwartz
I’m also seeing other patterns here like Microsoft SharePoint. So I guess more context here is like we’re looking at these because there’s prior incidents here, right? There’s vulnerabilities that get exploited. and that exploitation requires organizations to do a thing. So it’s like Telerik had it had an issue and it’s like, crap, we had all these old versions and then something happened and we need to do a thing. Same thing with Jenkins, although not as not as well. I think Cleo was ransomware. Was that a ransomware attack against Cleo?
Himaja Motheram
It was a ransomware, yeah.
Michael Schwartz
But I think that was already in a better state. SharePoint. SharePoint doesn’t look like a thing that gets constant attention, or maybe it does, or there’s mitigations to be put in place. But from a versioning perspective, we’re not seeing big changes over the course of two years.
Himaja Motheram
No, and it’s worth mentioning that here SharePoint is measuring additions, but I think 2016 just got marked EOL or end of life as of I wanna say like July or June of this year. So as of now, like the the orange on on SharePoint is really the only one that is not end of life. And yeah, I think it it might just be I should also say that each of these has a very different level of exposure on the Internet. So we see a lot of Jenkins and SharePoint on the Internet because they’re very popular. We see a lot less of Telerik Report Server and Cleo MFT. Those are more niche. and so I think what we can say, honestly, from looking at this data is that it seems to really be a direct link between the vendor’s sort of like maintenance cycle and the and how users update, which seems obvious, but I guess I hadn’t thought about it. Like and we’ll look at some more specific graphs, but like Jenkins, for example, is really consistently updating. And I think that’s because it’s the product where the vendor puts out patches the most frequently and and probably is configured to to pick up automatic updates the most. Whereas with Cleo, it’s much more reactive rather than routine.
Michael Schwartz
Yeah, I guess that’s that’s I don’t know if you call it the big call out here, but what makes an organization update. It’s like, well, yeah, you have to know you have an Internet facing thing and then there has to be a vulnerability. Like that’s your forcing hand unless you have a routine process to apply there. The software has a routine process to apply the updates. It’s sort of built in where you can click the button, you get the next thing, right?
Himaja Motheram
Yes. So we looked at this was a this is a graph for Cleo MFT where we plotted we measured from month to month how many hosts are moving to a newer software version, just from an older version to a newer version, and we kind of measure that as an upgrade. So that’s what you’re seeing on this graph. and then those vertical lines represent the disclosure timelines of various CVEs.
Himaja Motheram
And so this is a really interesting look because it lets us kind of obviously correlation is not causation, but it lets us start to ask what makes an organization update? Is it only CVEs or are they updating outside of that? and for Cleo in particular, like you mentioned, this was an interesting case because in 2024, in November 2024, there were two C VEs that were disclosed in Cleo, both RCEs. And the first actually was in the patch for it was incomplete. And so the second CVE had a patch that also covered the first one, which is interesting because you can see that the there was a spike after that first CVE disclosure, but then there’s a bigger one after the second one. So maybe more people had to patch who had already patched the first one. And then we also see that both of them were added to CISA’s known exploited vulnerabilities catalog around the same time shortly after.
And the Cl0p ransomware gang later took credit and and claimed that had breached multiple organizations using both of these vulnerabilities. And so there’s a lot of hype around these two. So not a lot of upgrade activity, then huge spikes in response to two different unique vulnerability disclosures, but then it goes back to normal.
Himaja Motheram
And again there are a lot of other factors here. It could be that, you know. A lot of orgs were already on the most recent version or maybe there was there were other controls in place where they d they felt like for they had mitigations in place. But it’s just interesting to see how this compares to Jenkins like we talked about, which is by contrast way more flat, despite having many more CVEs timeframe. So around nine CVEs here, I believe, all that were medium or critical, that were a high CVE score. And a very, very flat kind of routine baseline churn of about seven to nine percent of returning hosts that would upgrade. And so what that might show is that there’s there’s a couple things that make organizations update, but they might be inverse of each other. Maybe people who update constantly like Jenkins accumulate less sort of upgrade debt when a big crisis hits and they don’t have to have these dramatic events. Or again, maybe it’s the way that these products are configured and it’s just easier for for Jenkins instances to automatically jump to the next version.
Michael Schwartz
Yeah. It’s — yeah. I have thoughts here where it’s like, hey, MFT stuff is generally off in a corner and not thought about. It might support a handful of business practices. And maybe that like the there’s like a person or two in an organization that might know what it is and and own that thing, versus, you know, a full CI/CD pipeline is gonna have a generally a lot of attention on it as well. Although I don’t — I also don’t know why so many have their full CI/CD pipeline exposed to the Internet or what it’s actually doing for them. So at least if it if you’re keeping it exposed, it looks like it’s cons getting consistent updates in most organizations.
Himaja Motheram
It it’s it it it’s getting consistent updates, but also we have to take into account this is a very small number, right? it is only nine nine is a very small fraction of them are upgrading. So one has to wonder what the rest of them are are up to.
Michael Schwartz
Hmm. What what are you doing? What are you doing out there?
All right. We’ve talked about enterprise software for a bit here. I know we’ve heard a lot about ICS attacks, especially nation state enabled ICS attacks or ICS Internet control systems. we have a lot of data here. We’ve been looking at ICS post Internet now for I don’t know, two and a half, three years, maybe more. what’s the full story here? Is what’s the data telling us what’s going on?
Emily Austin
The data is telling, I don’t want to call it a full out tragedy, but the data’s not telling like a happy feel-good story. This is like a movie that you leave and you’re like, wow, that’s really gonna sit with me for a while because it didn’t feel great. So the the headline is right, like industrial control systems exposure is up four percent globally over the two and a half year period that we studied. It’s essentially not moving. Things are not really getting better.
The majority of exposure is driven by North America, which is driven by exposure in the US. The US has 32% of the entire global ICS landscape. Some of that, of course, is a numbers game just because the US has tremendous amount of exposed infrastructure, but also it does start to make you kind of ask questions about why is the US such an outlier here. This graph that’s being shown is actually log scaled because if it weren’t, you wouldn’t be able to see any of the other countries. They would all just group together at the very bottom. And the US would be way up here. So not exactly a heartening story over this long time horizon.
Michael Schwartz
So when we’re, I mean, when we’re talking about exposure here, like exposed how. I we mentioned in the past what you know, in the prior topics what it means, but what are we seeing here? Like is can someone reach physical machinery or can we tell it’s like that’s that’s a conveyor belt, that’s a picker, or that’s a thing here? Like what is it?
Emily Austin
Yeah, yes. So the the short answer is yes. it depends on the type of system that is exactly exposed to the Internet. But a lot of times what we see, so we kind of group these into two separate categories, right? We talk about industrial control systems protocols, these things like your BACnet, your Modbus, Tridium Fox, Fox Protocol, et cetera.
We talk about those as they are these low-level protocols. A lot of them have been around for a really long time and maybe don’t necessarily have a lot of security functionality baked in, but they’re very niche in a lot of ways to the industrial community. On the other hand, we do see a lot of things like interfaces or human machine interfaces, HMIs, exposed to the Internet. So these are graphical interfaces designed to essentially allow an operator to remotely access or manage the particular infrastructure that they’re responsible for. So I could, be, 100 miles away from a substation and could pull up one of these and administrate it remotely, right? Which is great and incredibly convenient. But the problem comes when these things are sitting on the Internet exposed without a password, with a default password, with a very weak password. It’s it’s not a great secure situation.
And so we’ve seen these things online for years and years. And, you know, we’re far from the first people to talk about this as a problem. I mean, this research has gone on long before we were doing it. And yet the problem still persists. And I think, you know, we we just over the weekend saw this example in Europe where commercial refrigerators were impacted. So they these interfaces, we don’t exactly know the specifics of how this happened, at least I don’t think yet. But they were interacted with over the Internet, right? Like remote access tooling connected to these devices can be really dangerous if it’s not protected well. And I think we see that time and time again. like in this situation, right?
Michael Schwartz
Yeah, I I’m thinking so there’s two things here. One we have we have the HMIs in which there’s a warning at the top in this one, it’s like, hey, you can cost some damage here just by clicking some buttons. and then we also have the niche protocols that you mentioned, like BACnet and Modbus, et cetera. Does that, I mean, just because those are exposed in their niche, does it raise the barrier to entry? You need some sort of specialized knowledge, or are we not finding the same as would be for like an HMI?
Emily Austin
Yes, so this is a really important point, I think. So when we talk about ICS specific malware, right, I think as of now there are the as I think I’ve heard numbers between nine and eleven specific pieces of malware that target ICS protocols. I’m not talking about malware that has affected ICS organizations, but specifically things that go after Modbus or IEC type protocols. Those are very nation specific and do require some level of understanding of environment, the systems, and how those operate and interact with each other, and exactly what you could do with control of one of those protocols. But on the flip side, one of the things that we looked at for this report that we actually haven’t looked at broadly before is this dichotomy of the ICS and IT landscape where we see IT services co-hosted on the same hosts where we see ICS services. So this heat map that you’re looking at essentially shows some of the along the Y-axis, you see some of the most popular ICS protocols we track. And along the X-axis or this this bottom, you see some of the most popular IT protocols or non-ICS things like HTTP or SSH or FTP. And one thing I’ll call out, I mean, I think the graph calls it out quite well, is that first column is the number of hosts that are running a particular ICS protocol that also have an HTTP service open on them.
Which is kind of wild to think about. And then you go down the list and you see SSH and you see FTP. And of course, some of these are things that are interfaces for the device itself, right? Like some of those can’t really be decoupled. That makes sense. But when we’re talking about the attack surface of ICS, like I think we have to take all of these things into account, right? Like it’s not just the the protocol itself, right? Like that’s sort of a one-dimensional view of it, but rather when we have these HMIs that are that are connected to the Internet with, weak or default authentication or no authentication. And then we also have a lot of IT services sitting on the same hosts as some of these things that, you know, we’re we’re talking about industrial control systems as a whole and and of that as a subset that is critical infrastructure. I mean, that’s that really rapidly expands that attack surface, I think, really quickly. And so all you need to do is find a vulnerability in one of these IT services to potentially give you a foothold into a network that’s running potentially sensitive things.
Michael Schwartz
Yeah, I bet the patching cadence is not what you would wanna see. it’s not gonna be something that looks like, you know, what we looked at previously. There’s probably gonna be a lot of unpatched vulnerabilities in these surrounding systems as well.
Emily Austin
Yeah, I mean it’s like it’s every week we see CISA come out with their their digest of like new ICS advisories covering these these new vulnerabilities that have been disclosed in these products. And you know, I think there’s well over a thousand products included now. there’s a tremendous amount of of history here in a lot of these systems. And it’s not always easy to upgrade them. It’s not a clear path necessarily. We’re kind of talking about this upgrade and patch cycle and like, you know.
Ripping and replacing is really expensive and sometimes impossible. And it’s on this very long time horizon. and these types of systems don’t always have the same maintenance activity or the ease of maintenance that you might see for for other like more traditional IT appliances. So it’s it’s a real it’s it’s a real problem, right?
Michael Schwartz
So we can we could see the stuff. We can find it, obviously. We can see the stuff. we a lot of it’s connected to critical systems, water, waste, water. We know that for sure. Energy infrastructure, we’ve seen that as well. why can’t we just tell people to take it off the Internet?
Emily Austin
That’s the dream, right? It would be incredible if every time we found one of these, we could just email the owner, call them, and say, Hey, we found this thing of yours, local water utility, local power utility. It’s online. It really shouldn’t be. You should take it off. The problem is, so apart from like HMIs, which sometimes expose information about the geography, like the name of the plant or the name of the city that’s located in, a lot of these, particularly like the protocols that we look at, that are involved in water and wastewater and electric utilities, et cetera, they are overwhelmingly found. Over 70% are found on consumer or mobile ISPs. So things like your Verizon or your T-Mobile or your Turkcell in Turkey. That’s another really popular place we see these globally. And it’s if you think about it, it makes a lot of sense. These are a lot of times systems that are in remote locations that don’t necessarily have a wired Internet connection.
And so they need connectivity somehow. And so they get it through a cellular, cellular modem, which is cool. That’s again amazing connectivity. The problem is when we’re looking at this, and I know for a fact, when even when asset owners are looking at this, because I’ve I’ve had conversations with folks who manage some of these, from the host side, all you see is a protocol that, you know, maybe it’s EIP, maybe it’s Modbus, etc. And
All of the metadata on the host points back to the telecommunications company. So you’re essentially looking at a host on a Verizon or a T-Mobile or an ATT that gives you nothing else to go on. Like there’s no other who is DNS, like everything is just you’re kind of left scratching your head because there’s absolutely no way to discern. There’s no useful certificate metadata, nothing to tell you this might be who owns this device. And it’s further complicated by geolocation issues, which are a little bit more intense on mobile. I think a lot of us know about the challenge of geolocation generally speaking when we’re looking at things on the Internet, but it’s kind of ratcheted up tenfold when we’re looking at things on these mobile networks. so it’s just like layers and layers of complication for trying to find owners of these devices. And again, we’re looking at you know 70% of devices are are on one of these types of networks. So it’s just like it’s not really encouraging. At all. And you can see that line is is flat. Like that has not changed. Again, this is one of the most stagnant things we’ve looked at in the report. This is the most boring graph I think I’ve ever made. so yeah, not changing. Not at all.
Michael Schwartz
Well on that note, man. Yeah, I this is this is gonna be one to watch. I mean, hopefully we’re not back here next year with the same graph. Although you could see in prior years we would use the same graph as well, so.
Emily Austin
Yeah, I don’t expect anything different.
Michael Schwartz
Interesting. Yeah, we’ll be we’ll be we’ll we’ll be following this more. I want to say more closely because we’ve been following it closely, but you know, we’ll see if we can make a dent in it for for next year. Well awesome. We’ve covered a lot in a short amount of time. across all the topics we just talked about. Obviously, there’s much more content in the state of the Internet this year than there has been in past years. Other than telling people like, read the report for more details, go and download the thing. What’s a closing thought from each of you that you know could be derived from set of report or is in the report or that you you had, you know, an epiphany when doing the research and writing. I’m really curious as to
Michael Schwartz
I don’t know, whoever, Emily if you want to go first.
Emily Austin
Yeah, I think for for me, really the the big takeaway, and I think this comes at the end of so many research projects that I’ve worked on here at Censys specifically, is that the boring basics are the basics for a reason when it comes to securing your organization. I think we’re constantly in this world of of so many new technologies, so many exploding things, AI, et cetera. But I think it all comes back to basic security hygiene. just don’t put these things on the Internet. If you don’t know how to not do that, maybe talk to someone who can help you. And a lot of it is like the things you don’t know, you don’t know. I think in a lot of these cases. But I I just come back to every time it’s a matter of security hygiene. And it’s so boring. And I’m so tired of saying it because it’s the same problem over and over again. But I do think that would really move us to a new kind of a new model of security if everyone kind of did the basics right.
Himaja Motheram
Building on that, I think I kind of had the same impression where it’s like we’re not really we’re not seeing new flashy sophisticated exploits. Like what we were talking about with the the ways people are hosting these things, hosting threats, like threat actors are usually trying to do things cheap and quick. And so are we. And I think a lot of the discussion right now is how agentic tools will help defenders with their workloads.
But what I’m noticing is that, you know, it’s an arms race, right? So I think there’s a lot of discussion that AI will make security hygiene work and s and and and inventorying and and triaging a lot more quick and a lot more cost effective. But I would caution that what will actually probably my prediction, my hot take is that our workloads of the things we must do might actually just balloon to compensate for that because of how quick and cheap exploitation is becoming at the same time. And what I actually think would be a more ambitious thing to think about is not that, you know, not that like efficiency is not necessarily the advantage here. I think the advantage with AI is that it eventually changes the nature of the defensive work from being so reactive to becoming a little bit more proactive to doing a little bit of the being able to reach more of the insights that we’ve done in this report for your own organization, left of boom and and being able to do it at a completely different and more thorough scale and being able to handle ambiguity much more quickly. And that’s my hope because I don’t think that the work will necessarily decrease, but I do hope that the timing of it will.
Michael Schwartz
Yeah, I think, after, reading said report and and talking to you both about it, I again Emily calls it out, it’s like the the basics are boring, but it’s like, understand your exposure, understand your, you know, attack surface. It’s you know, I think one of the things Censys does best is Internet scanning. We can we could say with, you know, with I don’t want to say with with accuracy, certainty, these are the things that you have open in your attack service. And if you don’t know that they’re open, then what are you going to do about it when there’s a caved voe and you don’t know you have Cleo MFT on your edge? That’s the basics. Right. And yeah, an attack can be AI enabled. and it’s just gonna happen that much faster where it’s like, hey, there might there might be a voe in there. There’s no there’s no POC, but we can utilize these tools in this agent swarm to develop a POC and go and exploit that endpoint. But at least if you know you have a you have a fighting chance to either go take the thing offline, deploy a WAF rule, or patch as soon as possible. And those, yeah, those things are taking your vitamins, right? And there’s not, I don’t think in a in an AI world that there’s gonna be an AI enabled defense, at least today, that can do that thing for you. The hope is that yes, we will and we will develop that and and you know, it’s Censys is gonna be there.
As your input to your tooling because we know. and that’s where I think we have to drive ourselves towards is yeah, we have we have the data, we have the information, we know where threat actors are going, we know what’s exposed, we know what’s vulnerable. Therefore, we’re part of the solution. So I find this this research fascinating. And I hope like next year we’re we’re sitting here talking about how we’ve enabled, you know, those AI defense workflows. And we’re also still preaching that like, yeah, you still gotta do the basics, right? Not not all of this is gonna be, you know, AI enabled in a year. Well, we still have to patch things, we still have to figure out ways to limit exposures to the Internet, et cetera. amazing. we’re out of time today. but to to recap, I mean, we we’ve talked about all sorts of things today, right? We’ve talked about A AI exposures, we’ve talked about patching cycles, threats. ICS OT. I mean, the the the gamut is large in regards to State of the Internet. definitely, you know, download the report, read the report. if you have additional questions, email address arc-flash@censys.com. And we can source those and respond in kind as well and you know a reminder is it’s like all this data that we’ve done the analysis on this is all Censys source data it’s all in-house analysis etc much of this research can be reproduced say by those playing at home utilizing the Censys platform although we have access to the raw data and can run specialized reporting it is all there for you as well
That’s all the time we have today. Emily Himaja, thank you. Congratulations. This is a fantastic piece of research. I hope everyone following along at home that’s gonna read this or or watch the webcast later. Definitely sourcing your questions as well and follow up, whether it’s it via social media or or directly to us in an email as well. and thank you. And we’ll see you in the next ARC Flash where we have our regular scheduled content. See you everyone.
Get a Closer Look at the Data
Dive deeper into Censys ARC’s latest Internet and threat research in the full 2026 State of the Internet Report.