Bitdefender report warns of rising home network risks

Bitdefender and NETGEAR have published a report on security risks in connected homes, finding that households now average 24 connected devices.

The study draws on telemetry from about 10.4 million smart homes worldwide. It covers 5.4 billion security events and 1.2 billion vulnerability observations collected between January and September 2026. It argues that internet-connected household devices are no longer just attack targets, but can also be used as proxies, sensors and entry points into wider home networks.

Researchers found that reconnaissance accounted for 90.1% of detected attack activity, indicating that automated scanning remains the dominant home network threat pattern. Such scans are typically used to identify weakly secured devices and networks that can later be drawn into broader attacks or botnet activity.

Average device counts rose from 22 a year earlier to 24. Phones made up the largest share of devices identified on home networks at 20.4%, followed by televisions at 10.6%, computers at 10.0%, network equipment at 6.2% and streaming devices at 5.4%.

Most exposed devices

Smart TVs accounted for 22.7% of all vulnerability observations, narrowly ahead of smart plugs at 22.4% and network attached storage devices at 22%. Together, those three categories represented 67.1% of observed vulnerabilities in the dataset.

The ranking marks a shift from the previous year, when streaming devices and smart TVs topped the list. The report links the latest pattern to longer-lived consumer devices that stay online for years and may remain in use after software support weakens or update cycles slow.

Smart TVs stood out in particular because they combined multiple forms of risk. The study recorded 270.3 million vulnerability observations involving televisions and found they could serve simultaneously as direct targets, traffic relays, information-gathering points and stepping stones into the rest of a household network.

Nearly all observed vulnerabilities were already publicly documented. Common Vulnerabilities and Exposures accounted for 99.97% of the total, while weak passwords and plaintext authentication represented only a small fraction of issues observed.

Attack outcomes

On the technical side, overflow errors represented about 54% of the potential attack outcomes observed in the study. Denial-of-service issues followed at about 18%, with memory corruption making up about 17%.

More severe outcomes that could give attackers direct control over devices or data appeared less often. Privilege escalation accounted for 5.3%, code execution for 3.8% and information disclosure for 1.2%, or about 10.3% combined.

The report also referred to major incidents during the year, including the dismantling of four IoT botnets by the US Department of Justice. It highlighted the discovery of proxy software bundled into smart TV applications that can turn televisions into relays for third-party internet traffic.

"The increase in connected devices has turned homes into complex digital ecosystems, and every addition gives attackers another doorway in," said Ciprian Istrate, Senior Vice President of Operations, Bitdefender Consumer Solutions Group.

"Cybercriminals are using AI to speed attacks on newly discovered vulnerabilities from days to a matter of hours, putting families at far greater risk. Our research with NETGEAR shows that router-level protection is now critical for defending against malware, identity theft, and increasingly sophisticated scams," Istrate said.

The findings reflect a broader shift in cybercrime towards consumer environments as business systems become harder to penetrate. Home networks often combine large numbers of devices from different manufacturers, with varying update practices and limited user oversight.

For networking suppliers and security vendors, that creates a commercial incentive to position routers and network gateways as the first line of monitoring and filtering for household traffic. The report supports the case for security tools built into home networking products.

NETGEAR linked the findings to the importance of visibility across household networks, particularly as devices become more numerous and less visible to users once installed. The report suggests that always-on devices such as televisions, cameras and storage systems can offer persistent access if weaknesses are left unaddressed.

"A connected home depends on more than speed, coverage, and reliability. It also depends on the visibility and protection that services such as NETGEAR Armour(tm) powered by Bitdefender(r) bring to activity across the network, plus security at the router level," said Chandan Nandakumaraiah, Head of Product and Cybersecurity, NETGEAR, and member of the CVE Board.

"As enterprises get better at protecting their digital infrastructure, cybercriminals are turning to connected home devices. These devices are increasingly smart and powerful, which makes them an ideal foothold: always on, reliable, and rarely monitored. Once inside, criminals can stay hidden and move laterally across the home network. Monitoring, detecting, and blocking these threats is more important than ever," Nandakumaraiah said.