The Internet in 2026: How the Attack Surface Is Changing

External Attack Surface • 34% of SSH services, 68% of HTTP(S) services, and 96% of SOCKS proxies run on non-standard ports. Checking only expected ports may miss a significant portion of Internet-facing infrastructure. • TLS certificates for IP addresses are spreading rapidly: by June, Censys observed more than 60,000 such certificates in use (up from 3,380 at the beginning of the year). In particular, they are used to secure access to IoT devices and backend services that don't have a domain name.

Updating Internet-Exposed Software • Outdated software versions that are several years behind are gradually being replaced, but the oldest versions are rarely updated and barely change a proportion of exposure. • The update pattern is determined by the product's maintenance rhytm: regular releases produce gradual updates, while infrequent releases lead to sharp spikes after major incidents. For example, Jenkins was updated monthly on 5–9% of hosts, and Cleo MFT on 1.9%, but after active exploitation, 63% of systems were updated within a month.

Industrial Control Systems (ICS) on the Internet • Censys observed approximately 134,000 Internet-exposed hosts running ICS services — about 4% more than in 2024. • About 70% of these systems are located on consumer or mobile networks, making it difficult to identify the owner and notify them of the exposure. • More than 80% of these hosts also provide standard IT services such as HTTP, SSH, or FTP, so attacking them does not always require knowledge of industrial protocols.

Attacker Infrastructure • China leads in hosting attacker infrastructure: 36.5% of C2 servers, remote access tools, and other similar infrastructure, compared with 16.8% in the United States. • The situation is reversed for phishing pages: 45.5% of the observed infrastructure is hosted in the United States and 20.9% in China (although this may partly be explained by better detection of English-language threats).

AI as a New Attack Surface • In just nine months, the number of hosts with Internet-accessible AI tools grew by 63% — from 164,000 to nearly 268,000. • In addition to familiar AI chatbots, the external attack surface for AI systems includes orchestrators, LLM gateways, vector databases, RAG systems, and LLM observability tools. • The most common software is n8n, with nearly 114,000 accessible hosts. Among systems with an identifiable version, 76% were running versions affected by at least one vulnerability with a CVSS score of 9.0+.