This report is built on Bitdefender and NETGEAR security events sampled between January and September 2026 — 9 months of automated observation across roughly 10.4million routers protected by Bitdefender smart-home security technologies.
Across that window, the sensors logged 5.4billion security events and 6.2billion vulnerability observations against devices sitting behind those routers. We also placed these insights next to the year’s better- documented public IoT incidents – in Slovakia, Iran and inside smart- TV app stores – to ask a broader question.
That question is no longer only can this device be hacked? It is: what can this device see, what network position does it occupy, and what can an adversary do with the trust, bandwidth or sensors attached to it.
What counts as an event: An event is a detection record: a port scan stopped at the router, a brute-force login attempt, an exploit pattern matched and blocked. It is not proof of compromise. Most of what we count is automated machinery probing everything that answers.
What counts as a vulnerability observation: Devices behind protected routers are identified and matched against known-vulnerability data. One observation is one device–vulnerability pairing; a single device can generate many such pairs.
