Censys 2026 State of the Internet Report: Key Findings

The Censys 2026 State of the Internet Report takes an outside-in view of the public Internet. It uses continuous Internet scanning to examine where services appear, persist, move and become difficult to attribute to an owner.

Rather than treating exposure as a single problem, the report connects five areas: ports and certificates, the aging of exposed software, industrial control systems, malicious infrastructure and AI tooling. That makes it useful for teams that need to understand what an external view can—and cannot—say about their attack surface.

The report also draws a careful boundary. A host visible from the public Internet is not automatically vulnerable or compromised. But visibility, unusual service placement and unclear ownership can make risk assessment and response harder.

Short answer

The report’s central message is that external exposure is broad, uneven and often persistent. Censys finds that default-port assumptions miss substantial portions of some services, that the oldest exposed software can be the least likely to change, and that ICS hosts frequently expose additional IT services. It also documents growing Internet-facing AI infrastructure, including orchestration-layer tooling. Security teams can use the report as a prompt to test asset inventory, service discovery, ownership resolution and remediation follow-through from an attacker’s external perspective.

What does the report cover?

Censys examines public Internet exposure across ports, protocols and TLS certificates; version and exposure trends for four software products; ICS and critical-infrastructure exposure; adversary-related infrastructure; and AI/LLM-related tooling.

Its methodology is an external observation model. The report states that it scans public IPv4 space, uses redirects and DNS to discover IPv6 systems, and observes more than 200 protocols. That makes its findings useful for identifying visible patterns, while limiting what can be concluded about exploitability, compensating controls or compromise inside an organization.

Key findings from the report

• Default-port assumptions leave blind spots. Censys reports that 34% of SSH services, 68% of HTTP(S) services and 96% of SOCKS proxies it observed ran on non-standard ports. By contrast, DNS, NTP and SNMP were almost always on their assigned ports.

  The report gives SOCKS as a useful illustration: only 4% of the observed population used its assigned port 1080, while 34% used 10801. It also finds regional and carrier-specific patterns for CWMP, the protocol used to manage customer-premises equipment. The practical implication is not that every unusual port is malicious; it is that discovery, detection and exposure reviews that begin and end with defaults will describe only part of what is reachable.

• The longest-lived software can be the slowest to move. Across four case studies, the report finds that older versions generally declined but the very oldest cohorts changed by roughly one percentage point or less over the observation period. It cautions that declining host counts alone can reflect retirement, migration or a change in outside visibility rather than a security improvement.

  Censys follows Telerik Report Server, Jenkins, Cleo managed-file-transfer products and self-hosted Microsoft SharePoint Server from January 2024 through May 2026. All four populations declined in Internet-visible exposure, from a 23.9% reduction for Jenkins to 67.1% for Telerik. But the report distinguishes a host disappearing from a host moving to a newer version. Its case studies find that middle-aged releases often made the largest shifts, while very old releases tended to persist in small but comparatively static populations.

• ICS exposure often includes additional reachable services. More than 80% of hosts running ICS devices and services also ran at least one non-ICS service such as HTTP, SSH or FTP, according to the report. It also highlights how provider-facing metadata can make ownership and notification difficult.

  The report describes this as an IT-plus-ICS attack surface. HTTP appears alongside at least one ICS protocol on 31% to 99% of hosts, depending on the protocol. For example, Censys observes Tridium Niagara with an HTTP management interface on 99% of the hosts it identifies, while FINS hosts frequently co-expose FTP, SSH, MySQL, VNC or Telnet. These adjacent services can create paths to a system without requiring an attacker to interact directly with an industrial protocol.

  Ownership is part of the problem. Roughly 70% of the observed ICS hosts sit on consumer and mobile networks, where public metadata commonly identifies the telecommunications provider rather than the device operator. The report says this makes discovery straightforward but notification and remediation coordination difficult. Over its two-and-a-half-year view, global ICS exposure rose 4%, despite sustained attention to removing such systems from the public Internet.

• Threat infrastructure has different observed hosting profiles. The report says China hosted 36.5% of malicious host-level infrastructure it observed, while the United States hosted 45.5% of observed web-based threats. These figures describe the report’s observed categories, not a measure of all malicious activity.

  The distinction follows the report’s collection method. Host-based threats are found by scanning an IP address and port; web-based threats are found by retrieving content from a hostname. Censys maintained 275 threat fingerprints for this analysis, with 162 appearing at least once from October 2025 through June 2026. It explicitly notes that many tracked tools are dual use, so a fingerprint is a starting point for hunting or investigation, not a standalone attribution finding.

• Internet-facing AI infrastructure is expanding. By July 2026, Censys observed 267,915 unique hosts exposing AI/LLM-related tooling, up 63% from October 2025. It identifies orchestration, gateways, RAG systems, vector databases and observability as parts of the exposed stack, and notes n8n as its most exposed product.

  The report treats that growth as an infrastructure story rather than a model-only story. It documents the rapid rise of exposed OpenClaw control panels, which grew from two observed panels six days after the relevant release to a peak of 85,478 hosts in April. The report uses this example to show how quickly a new agent interface connected to personal accounts can become externally reachable.

  n8n illustrates a different risk profile: a workflow and AI-orchestration layer between external inputs, stored credentials and downstream services. Censys observed 113,926 Internet-facing n8n IPs, and says 67% of the exposed instances had port 5678 directly reachable. Among versioned hosts, 76.1% fell within the affected range of at least one CVSS 9.0-or-higher vulnerability disclosed between December 2025 and May 2026. The report cautions that exposure alone does not prove exploitation, but argues that reachable orchestration layers deserve attention because their compromise can extend to connected systems and credentials.

Main Cyntari themes

Vulnerability & Exposure Management

The report is directly relevant to external attack-surface work because it shows why inventory and discovery routines that only check expected ports or short remediation windows can miss visible exposure.

OT/ICS & Critical Infrastructure Security

Its ICS section links externally reachable operational technology to adjacent IT services and to the practical difficulty of establishing ownership for notification and remediation.

AI Security & AI Governance

The report frames AI infrastructure as a multi-layer Internet-facing environment, including orchestration and credential-bearing components that may need explicit hardening and trust controls.

Threat Actors, Geopolitics & Intelligence

Its threat-infrastructure analysis distinguishes host-level tooling from web-based threats and compares their observed hosting distributions.

Who should read this report?

This report is most useful to attack-surface management, vulnerability-management and exposure-reduction teams; security architects responsible for Internet-facing services; OT/ICS security practitioners; and threat-intelligence analysts who need a broad external context.

It is also useful for leaders who need to understand the limits of externally observed data. The report provides a basis for questions and prioritization, not proof that a visible asset is exploitable or compromised.

Questions this report helps answer

• Which kinds of public services are most likely to appear outside their standard ports?
• Why can an external asset inventory differ from an organization’s internal view?
• What does long-term observation suggest about remediation of aging exposed software?
• Why should declining Internet-visible host counts be interpreted cautiously?
• What additional services are commonly visible alongside exposed ICS devices?
• Why can ownership of an exposed asset be hard to determine from public data?
• How do the observed profiles of host-level malicious infrastructure and web-based threats differ?
• Which layers make up the exposed AI infrastructure described by the report?