- Bitdefender's 2026 IoT Security Landscape Report says televisions made up 22.7% of vulnerability observations across about 10.4 million protected home routers, January to September.
- The report says a gadget may stay in a home for a decade, while its maker may support it with security updates for only two to four years.
- Organisations with home-working staff can ask what connected devices share those networks and who owns their updates.
A TV can keep running after its security support may have ended
A television is bought once and then forgotten. It sits on the home network for years. Its security support, the report says, can end much sooner.
That gap is the core finding in Bitdefender's 2026 IoT Security Landscape Report. Gadgets may sit in a home for five to ten years, yet the maker may stop patching them after two to four.
When that support stops, the report says, TVs, plugs and home storage systems can stay online with unresolved flaws.
The lesson here is that a home device can outlast the care it was sold with. It has a long lease and, in time, no landlord who still looks after it.
What Bitdefender measured
Bitdefender analysed about 10.4 million home routers it protects, from January to September. It says televisions made up 22.7% of vulnerability observations. Smart plugs came next at 22.4%.
These are shares of what the routers recorded. They do not say how many households were breached.
The report counts blocked scans, login attempts and exploit patterns. It says these do not show how many homes suffered a successful intrusion.
Most attack traffic is knocking, not entering
Bitdefender says automated port scans made up 90.1% of the attack events it detected. That is about 4.85 billion scan attempts over nine months.
A port scan is a machine trying doors. It checks for reachable services such as remote desktop, remote login and administration pages. An open service can be a starting point for further attempts. The report is clear that a scan does not show anyone broke in.
Password guessing made up about 8.7% of attack events. The report counts 466.6 million brute-force events. Roughly 455 million of them targeted Remote Desktop Protocol, a common way to reach Windows computers remotely.
One television, four jobs
The report says connected equipment can play four roles. It can be a target. It can be a proxy that carries outside traffic. It can be a sensor that gathers information. It can be a foothold inside a network.
The proxy role is the least obvious. The report points to research from the security firm Spur. Some free smart-TV apps bundle software that turns the set into a residential proxy. This happens after the user accepts the app's consent terms.
The household's broadband then carries a stranger's traffic. The report says this traffic is marketed for web scraping, advertising verification and market research. The websites that receive it see the household's public internet address.
Clicking "accept" counts as permission for this. Yet users may not grasp what they agreed to. That makes it a consent problem, not only a malware problem. The family agreed, though perhaps without knowing what they agreed to.
The sensor role
A TV can also gather data about its viewers and their surroundings. The report cites Gamers Nexus findings on LG televisions. These findings describe the sets gathering what people watch and recordings of their voices.
They also describe location data, details of other devices on the home network and information about nearby wireless networks.
The mechanism is Automatic Content Recognition, or ACR. It works out what is on screen by matching samples against a reference database. The report says the technology supports personalized advertising.
The Gamers Nexus findings concern LG sets. The report does not say every maker does the same.
Why this reaches the office
Chandan Nandakumaraiah of NETGEAR, who leads product and cybersecurity there, is quoted in the report. His warning is that criminals who get in "can stay hidden and move laterally" across a home network.
This is where the story meets an organisation. Staff who work from home share a network with these devices. Bitdefender does not say that TVs have been used to reach employers.
The point is narrower. A company has no control over what is plugged into a home network. It also cannot know who still patches it.
Questions to put to your team
Ask whether remote-work policy says anything about the home network. Ask whether staff are told to keep work devices apart from smart TVs and plugs. Ask whether guest or separate networks are an option for them.
Ask the procurement side a plainer question for any connected device the company buys. How many years of security updates are promised, and what happens on the last day?
A television that outlives its support is not broken. It is unattended. That is the risk worth planning for.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Help Net Security.
