The most vulnerable thing in the average home is the television, and nobody patches a television

Bitdefender and Netgear published their 2026 IoT Security Landscape Report on 28 October. It is built from roughly 10.4 million home routers running Bitdefender's protection between January and September: 5.4 billion security events, 1.2 billion separate vulnerability observations. Top of the list, by a nose, is the TV.

Televisions accounted for 270.3 million of those observations, around 23 percent. Smart plugs came next on 266.7 million, network-attached storage on 261.6 million. Three categories, two-thirds of everything found in a typical connected home. And the finding underneath the numbers is the awkward one: virtually all of these are known vulnerabilities that already have patches. Nobody installed them. Nearly half are buffer overflow errors, the rest mostly denial of service and memory corruption.

What gets done with the access has changed shape. Nine in ten recorded attack events were port scans, 4.85 billion of them, automated sweeps looking for an open door. Brute-force attempts came to 466.6 million, and 455 million of those went at Windows Remote Desktop. A compromised plug or camera often ends up as a residential proxy, relaying strangers' traffic through your broadband line, which quietly makes an ordinary home connection worth money to people you will never hear from. As the report puts it, devices meant to simplify life end up as the easiest entry points.

The practical version is an evening's work: turn on automatic firmware updates wherever the option exists, switch off remote access you do not use, and retire anything the manufacturer stopped supporting years ago. Tendvane's network scan is a reasonable place to start, if only because it lists what is actually connected, which in most houses is two or three things more than anyone remembers owning.